Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. azure
  6. SecretBackendStaticRole
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.azure.SecretBackendStaticRole

vault logo
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages a static role in the Azure Secrets Engine.
    Static roles in Vault are linked to existing Azure AD applications, and manage long-lived credentials for those applications.

    Unlike dynamic roles, static roles do not generate new service principals — they manage a fixed application and rotate or import its credentials as needed.

    Important All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform, and will appear in the console output when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const azure = new vault.azure.Backend("azure", {
    subscriptionId: subscriptionId,
    tenantId: tenantId,
    clientSecret: clientSecret,
    clientId: clientId,
});
const static_role = new vault.azure.SecretBackendStaticRole("static-role", {
    backend: azure.path,
    role: "static-role",
    applicationObjectId: "11111111-2222-3333-4444-44444444444",
    ttl: Number("8760h"),
    metadata: {
        team: "test",
        owner: "vault",
    },
});

    import pulumi
import pulumi_vault as vault

azure = vault.azure.Backend("azure",
    subscription_id=subscription_id,
    tenant_id=tenant_id,
    client_secret=client_secret,
    client_id=client_id)
static_role = vault.azure.SecretBackendStaticRole("static-role",
    backend=azure.path,
    role="static-role",
    application_object_id="11111111-2222-3333-4444-44444444444",
    ttl=int("8760h"),
    metadata={
        "team": "test",
        "owner": "vault",
    })

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		azure2, err := azure.NewBackend(ctx, "azure", &azure.BackendArgs{
			SubscriptionId: pulumi.Any(subscriptionId),
			TenantId:       pulumi.Any(tenantId),
			ClientSecret:   pulumi.Any(clientSecret),
			ClientId:       pulumi.Any(clientId),
		})
		if err != nil {
			return err
		}
		_, err = azure.NewSecretBackendStaticRole(ctx, "static-role", &azure.SecretBackendStaticRoleArgs{
			Backend:             azure2.Path,
			Role:                pulumi.String("static-role"),
			ApplicationObjectId: pulumi.String("11111111-2222-3333-4444-44444444444"),
			Ttl:                 pulumi.Int("8760h"),
			Metadata: pulumi.StringMap{
				"team":  pulumi.String("test"),
				"owner": pulumi.String("vault"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var azure = new Vault.Azure.Backend("azure", new()
    {
        SubscriptionId = subscriptionId,
        TenantId = tenantId,
        ClientSecret = clientSecret,
        ClientId = clientId,
    });

    var static_role = new Vault.Azure.SecretBackendStaticRole("static-role", new()
    {
        Backend = azure.Path,
        Role = "static-role",
        ApplicationObjectId = "11111111-2222-3333-4444-44444444444",
        Ttl = "8760h",
        Metadata = 
        {
            { "team", "test" },
            { "owner", "vault" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.azure.Backend;
import com.pulumi.vault.azure.BackendArgs;
import com.pulumi.vault.azure.SecretBackendStaticRole;
import com.pulumi.vault.azure.SecretBackendStaticRoleArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var azure = new Backend("azure", BackendArgs.builder()
            .subscriptionId(subscriptionId)
            .tenantId(tenantId)
            .clientSecret(clientSecret)
            .clientId(clientId)
            .build());

        var static_role = new SecretBackendStaticRole("static-role", SecretBackendStaticRoleArgs.builder()
            .backend(azure.path())
            .role("static-role")
            .applicationObjectId("11111111-2222-3333-4444-44444444444")
            .ttl("8760h")
            .metadata(Map.ofEntries(
                Map.entry("team", "test"),
                Map.entry("owner", "vault")
            ))
            .build());

    }
}

    resources:
  azure:
    type: vault:azure:Backend
    properties:
      subscriptionId: ${subscriptionId}
      tenantId: ${tenantId}
      clientSecret: ${clientSecret}
      clientId: ${clientId}
  static-role:
    type: vault:azure:SecretBackendStaticRole
    properties:
      backend: ${azure.path}
      role: static-role
      applicationObjectId: 11111111-2222-3333-4444-44444444444
      ttl: 8760h
      metadata:
        team: test
        owner: vault

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_azure_backend" "azure" {
  subscription_id = subscriptionId
  tenant_id       = tenantId
  client_secret   = clientSecret
  client_id       = clientId
}
resource "vault_azure_secretbackendstaticrole" "static-role" {
  backend               = vault_azure_backend.azure.path
  role                  = "static-role"
  application_object_id = "11111111-2222-3333-4444-44444444444"
  ttl                   = "8760h"
  metadata = {
    "team"  = "test"
    "owner" = "vault"
  }
}

    Create SecretBackendStaticRole Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendStaticRole(name: string, args: SecretBackendStaticRoleArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendStaticRole(resource_name: str,
                            args: SecretBackendStaticRoleArgs,
                            opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendStaticRole(resource_name: str,
                            opts: Optional[ResourceOptions] = None,
                            application_object_id: Optional[str] = None,
                            backend: Optional[str] = None,
                            role: Optional[str] = None,
                            client_secret: Optional[str] = None,
                            defer_initial_creds: Optional[bool] = None,
                            expiration: Optional[str] = None,
                            metadata: Optional[Mapping[str, str]] = None,
                            namespace: Optional[str] = None,
                            secret_id: Optional[str] = None,
                            skip_import_rotation: Optional[bool] = None,
                            ttl: Optional[int] = None)
    func NewSecretBackendStaticRole(ctx *Context, name string, args SecretBackendStaticRoleArgs, opts ...ResourceOption) (*SecretBackendStaticRole, error)
    public SecretBackendStaticRole(string name, SecretBackendStaticRoleArgs args, CustomResourceOptions? opts = null)
    public SecretBackendStaticRole(String name, SecretBackendStaticRoleArgs args)
public SecretBackendStaticRole(String name, SecretBackendStaticRoleArgs args, CustomResourceOptions options)

    type: vault:azure:SecretBackendStaticRole
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_azure_secret_backend_static_role" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendStaticRoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendStaticRoleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendStaticRoleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendStaticRoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendStaticRoleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var vaultSecretBackendStaticRoleResource = new Vault.Azure.SecretBackendStaticRole("vaultSecretBackendStaticRoleResource", new()
{
    ApplicationObjectId = "string",
    Backend = "string",
    Role = "string",
    ClientSecret = "string",
    DeferInitialCreds = false,
    Metadata = 
    {
        { "string", "string" },
    },
    Namespace = "string",
    SecretId = "string",
    SkipImportRotation = false,
    Ttl = 0,
});

    example, err := azure.NewSecretBackendStaticRole(ctx, "vaultSecretBackendStaticRoleResource", &azure.SecretBackendStaticRoleArgs{
	ApplicationObjectId: pulumi.String("string"),
	Backend:             pulumi.String("string"),
	Role:                pulumi.String("string"),
	ClientSecret:        pulumi.String("string"),
	DeferInitialCreds:   pulumi.Bool(false),
	Metadata: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Namespace:          pulumi.String("string"),
	SecretId:           pulumi.String("string"),
	SkipImportRotation: pulumi.Bool(false),
	Ttl:                pulumi.Int(0),
})

    resource "vault_azure_secret_backend_static_role" "vaultSecretBackendStaticRoleResource" {
  lifecycle {
    create_before_destroy = true
  }
  application_object_id = "string"
  backend               = "string"
  role                  = "string"
  client_secret         = "string"
  defer_initial_creds   = false
  metadata = {
    "string" = "string"
  }
  namespace            = "string"
  secret_id            = "string"
  skip_import_rotation = false
  ttl                  = 0
}

    var vaultSecretBackendStaticRoleResource = new com.pulumi.vault.azure.SecretBackendStaticRole("vaultSecretBackendStaticRoleResource", com.pulumi.vault.azure.SecretBackendStaticRoleArgs.builder()
    .applicationObjectId("string")
    .backend("string")
    .role("string")
    .clientSecret("string")
    .deferInitialCreds(false)
    .metadata(Map.of("string", "string"))
    .namespace("string")
    .secretId("string")
    .skipImportRotation(false)
    .ttl(0)
    .build());

    vault_secret_backend_static_role_resource = vault.azure.SecretBackendStaticRole("vaultSecretBackendStaticRoleResource",
    application_object_id="string",
    backend="string",
    role="string",
    client_secret="string",
    defer_initial_creds=False,
    metadata={
        "string": "string",
    },
    namespace="string",
    secret_id="string",
    skip_import_rotation=False,
    ttl=0)

    const vaultSecretBackendStaticRoleResource = new vault.azure.SecretBackendStaticRole("vaultSecretBackendStaticRoleResource", {
    applicationObjectId: "string",
    backend: "string",
    role: "string",
    clientSecret: "string",
    deferInitialCreds: false,
    metadata: {
        string: "string",
    },
    namespace: "string",
    secretId: "string",
    skipImportRotation: false,
    ttl: 0,
});

    type: vault:azure:SecretBackendStaticRole
properties:
    applicationObjectId: string
    backend: string
    clientSecret: string
    deferInitialCreds: false
    metadata:
        string: string
    namespace: string
    role: string
    secretId: string
    skipImportRotation: false
    ttl: 0

    SecretBackendStaticRole Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendStaticRole resource accepts the following input properties:

    ApplicationObjectId string
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    Backend string
    Path where the Azure Secrets Engine is mounted.
    Role string
    Name of the static role to create or manage.
    ClientSecret string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    DeferInitialCreds bool
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    Expiration string
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    Metadata Dictionary<string, string>
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SecretId string
    When importing an existing credential, specifies the Azure secret’s key ID.
    SkipImportRotation bool
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    Ttl int
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    ApplicationObjectId string
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    Backend string
    Path where the Azure Secrets Engine is mounted.
    Role string
    Name of the static role to create or manage.
    ClientSecret string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    DeferInitialCreds bool
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    Expiration string
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    Metadata map[string]string
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SecretId string
    When importing an existing credential, specifies the Azure secret’s key ID.
    SkipImportRotation bool
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    Ttl int
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    application_object_id string
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend string
    Path where the Azure Secrets Engine is mounted.
    role string
    Name of the static role to create or manage.
    client_secret string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    defer_initial_creds bool
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration string
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata map(string)
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secret_id string
    When importing an existing credential, specifies the Azure secret’s key ID.
    skip_import_rotation bool
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl number
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    applicationObjectId String
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend String
    Path where the Azure Secrets Engine is mounted.
    role String
    Name of the static role to create or manage.
    clientSecret String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    deferInitialCreds Boolean
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration String
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata Map<String,String>
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secretId String
    When importing an existing credential, specifies the Azure secret’s key ID.
    skipImportRotation Boolean
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl Integer
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    applicationObjectId string
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend string
    Path where the Azure Secrets Engine is mounted.
    role string
    Name of the static role to create or manage.
    clientSecret string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    deferInitialCreds boolean
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration string
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata {[key: string]: string}
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secretId string
    When importing an existing credential, specifies the Azure secret’s key ID.
    skipImportRotation boolean
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl number
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    application_object_id str
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend str
    Path where the Azure Secrets Engine is mounted.
    role str
    Name of the static role to create or manage.
    client_secret str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    defer_initial_creds bool
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration str
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata Mapping[str, str]
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secret_id str
    When importing an existing credential, specifies the Azure secret’s key ID.
    skip_import_rotation bool
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl int
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    applicationObjectId String
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend String
    Path where the Azure Secrets Engine is mounted.
    role String
    Name of the static role to create or manage.
    clientSecret String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    deferInitialCreds Boolean
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration String
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata Map<String>
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    secretId String
    When importing an existing credential, specifies the Azure secret’s key ID.
    skipImportRotation Boolean
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl Number
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendStaticRole resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecretBackendStaticRole Resource

    Get an existing SecretBackendStaticRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendStaticRoleState, opts?: CustomResourceOptions): SecretBackendStaticRole
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        application_object_id: Optional[str] = None,
        backend: Optional[str] = None,
        client_secret: Optional[str] = None,
        defer_initial_creds: Optional[bool] = None,
        expiration: Optional[str] = None,
        metadata: Optional[Mapping[str, str]] = None,
        namespace: Optional[str] = None,
        role: Optional[str] = None,
        secret_id: Optional[str] = None,
        skip_import_rotation: Optional[bool] = None,
        ttl: Optional[int] = None) -> SecretBackendStaticRole
    func GetSecretBackendStaticRole(ctx *Context, name string, id IDInput, state *SecretBackendStaticRoleState, opts ...ResourceOption) (*SecretBackendStaticRole, error)
    public static SecretBackendStaticRole Get(string name, Input<string> id, SecretBackendStaticRoleState? state, CustomResourceOptions? opts = null)
    public static SecretBackendStaticRole get(String name, Output<String> id, SecretBackendStaticRoleState state, CustomResourceOptions options)
    resources:  _:    type: vault:azure:SecretBackendStaticRole    get:      id: ${id}
    import {
  to = vault_azure_secret_backend_static_role.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ApplicationObjectId string
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    Backend string
    Path where the Azure Secrets Engine is mounted.
    ClientSecret string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    DeferInitialCreds bool
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    Expiration string
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    Metadata Dictionary<string, string>
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Role string
    Name of the static role to create or manage.
    SecretId string
    When importing an existing credential, specifies the Azure secret’s key ID.
    SkipImportRotation bool
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    Ttl int
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    ApplicationObjectId string
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    Backend string
    Path where the Azure Secrets Engine is mounted.
    ClientSecret string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    DeferInitialCreds bool
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    Expiration string
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    Metadata map[string]string
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Role string
    Name of the static role to create or manage.
    SecretId string
    When importing an existing credential, specifies the Azure secret’s key ID.
    SkipImportRotation bool
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    Ttl int
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    application_object_id string
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend string
    Path where the Azure Secrets Engine is mounted.
    client_secret string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    defer_initial_creds bool
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration string
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata map(string)
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    role string
    Name of the static role to create or manage.
    secret_id string
    When importing an existing credential, specifies the Azure secret’s key ID.
    skip_import_rotation bool
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl number
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    applicationObjectId String
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend String
    Path where the Azure Secrets Engine is mounted.
    clientSecret String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    deferInitialCreds Boolean
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration String
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata Map<String,String>
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    role String
    Name of the static role to create or manage.
    secretId String
    When importing an existing credential, specifies the Azure secret’s key ID.
    skipImportRotation Boolean
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl Integer
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    applicationObjectId string
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend string
    Path where the Azure Secrets Engine is mounted.
    clientSecret string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    deferInitialCreds boolean
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration string
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata {[key: string]: string}
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    role string
    Name of the static role to create or manage.
    secretId string
    When importing an existing credential, specifies the Azure secret’s key ID.
    skipImportRotation boolean
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl number
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    application_object_id str
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend str
    Path where the Azure Secrets Engine is mounted.
    client_secret str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    defer_initial_creds bool
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration str
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata Mapping[str, str]
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    role str
    Name of the static role to create or manage.
    secret_id str
    When importing an existing credential, specifies the Azure secret’s key ID.
    skip_import_rotation bool
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl int
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.
    applicationObjectId String
    The Azure AD Application Object ID associated with the existing application whose credentials Vault will manage.
    backend String
    Path where the Azure Secrets Engine is mounted.
    clientSecret String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. When importing an existing credential, provides the existing client secret value.
    deferInitialCreds Boolean
    If true, the initial credential generation will be deferred until the first read of credentials from this role. Defaults to false.
    expiration String
    Deprecated - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. Vault reads expiration from Azure.

    Deprecated: This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure.

    metadata Map<String>
    A map of string key-value pairs that are stored alongside the role and returned with generated credentials.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    role String
    Name of the static role to create or manage.
    secretId String
    When importing an existing credential, specifies the Azure secret’s key ID.
    skipImportRotation Boolean
    If true, Vault will import the provided credential without performing rotation. Valid only during creation. Defaults to false.
    ttl Number
    Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be at least 1 month. Accepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo
    Viewing docs for HashiCorp Vault v7.11.0
    published on Wednesday, Jul 22, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial