HashiCorp Vault

v5.7.0 published on Thursday, Oct 13, 2022 by Pulumi

getAuthBackendRole

Reads a GCP auth role from a Vault server.

Example Usage

using System.Collections.Generic;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var role = Vault.Gcp.GetAuthBackendRole.Invoke(new()
    {
        Backend = "my-gcp-backend",
        RoleName = "my-role",
    });

    return new Dictionary<string, object?>
    {
        ["role-id"] = role.Apply(getAuthBackendRoleResult => getAuthBackendRoleResult.RoleId),
    };
});
package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v5/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		role, err := gcp.LookupAuthBackendRole(ctx, &gcp.LookupAuthBackendRoleArgs{
			Backend:  pulumi.StringRef("my-gcp-backend"),
			RoleName: "my-role",
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("role-id", role.RoleId)
		return nil
	})
}
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.GcpFunctions;
import com.pulumi.vault.gcp.inputs.GetAuthBackendRoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var role = GcpFunctions.getAuthBackendRole(GetAuthBackendRoleArgs.builder()
            .backend("my-gcp-backend")
            .roleName("my-role")
            .build());

        ctx.export("role-id", role.applyValue(getAuthBackendRoleResult -> getAuthBackendRoleResult.roleId()));
    }
}
import pulumi
import pulumi_vault as vault

role = vault.gcp.get_auth_backend_role(backend="my-gcp-backend",
    role_name="my-role")
pulumi.export("role-id", role.role_id)
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const role = pulumi.output(vault.gcp.getAuthBackendRole({
    backend: "my-gcp-backend",
    roleName: "my-role",
}));

export const role_id = role.roleId;
variables:
  role:
    Fn::Invoke:
      Function: vault:gcp:getAuthBackendRole
      Arguments:
        backend: my-gcp-backend
        roleName: my-role
outputs:
  role-id: ${role.roleId}

Using getAuthBackendRole

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getAuthBackendRole(args: GetAuthBackendRoleArgs, opts?: InvokeOptions): Promise<GetAuthBackendRoleResult>
function getAuthBackendRoleOutput(args: GetAuthBackendRoleOutputArgs, opts?: InvokeOptions): Output<GetAuthBackendRoleResult>
def get_auth_backend_role(backend: Optional[str] = None,
                          namespace: Optional[str] = None,
                          role_name: Optional[str] = None,
                          token_bound_cidrs: Optional[Sequence[str]] = None,
                          token_explicit_max_ttl: Optional[int] = None,
                          token_max_ttl: Optional[int] = None,
                          token_no_default_policy: Optional[bool] = None,
                          token_num_uses: Optional[int] = None,
                          token_period: Optional[int] = None,
                          token_policies: Optional[Sequence[str]] = None,
                          token_ttl: Optional[int] = None,
                          token_type: Optional[str] = None,
                          opts: Optional[InvokeOptions] = None) -> GetAuthBackendRoleResult
def get_auth_backend_role_output(backend: Optional[pulumi.Input[str]] = None,
                          namespace: Optional[pulumi.Input[str]] = None,
                          role_name: Optional[pulumi.Input[str]] = None,
                          token_bound_cidrs: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                          token_explicit_max_ttl: Optional[pulumi.Input[int]] = None,
                          token_max_ttl: Optional[pulumi.Input[int]] = None,
                          token_no_default_policy: Optional[pulumi.Input[bool]] = None,
                          token_num_uses: Optional[pulumi.Input[int]] = None,
                          token_period: Optional[pulumi.Input[int]] = None,
                          token_policies: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                          token_ttl: Optional[pulumi.Input[int]] = None,
                          token_type: Optional[pulumi.Input[str]] = None,
                          opts: Optional[InvokeOptions] = None) -> Output[GetAuthBackendRoleResult]
func LookupAuthBackendRole(ctx *Context, args *LookupAuthBackendRoleArgs, opts ...InvokeOption) (*LookupAuthBackendRoleResult, error)
func LookupAuthBackendRoleOutput(ctx *Context, args *LookupAuthBackendRoleOutputArgs, opts ...InvokeOption) LookupAuthBackendRoleResultOutput

> Note: This function is named LookupAuthBackendRole in the Go SDK.

public static class GetAuthBackendRole 
{
    public static Task<GetAuthBackendRoleResult> InvokeAsync(GetAuthBackendRoleArgs args, InvokeOptions? opts = null)
    public static Output<GetAuthBackendRoleResult> Invoke(GetAuthBackendRoleInvokeArgs args, InvokeOptions? opts = null)
}
public static CompletableFuture<GetAuthBackendRoleResult> getAuthBackendRole(GetAuthBackendRoleArgs args, InvokeOptions options)
// Output-based functions aren't available in Java yet
fn::invoke:
  function: vault:gcp/getAuthBackendRole:getAuthBackendRole
  arguments:
    # arguments dictionary

The following arguments are supported:

RoleName string

The name of the role to retrieve the Role ID for.

Backend string

The unique name for the GCP backend from which to fetch the role. Defaults to "gcp".

Namespace string

The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

TokenBoundCidrs List<string>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

TokenPolicies List<string>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

RoleName string

The name of the role to retrieve the Role ID for.

Backend string

The unique name for the GCP backend from which to fetch the role. Defaults to "gcp".

Namespace string

The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

TokenBoundCidrs []string

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

TokenPolicies []string

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

roleName String

The name of the role to retrieve the Role ID for.

backend String

The unique name for the GCP backend from which to fetch the role. Defaults to "gcp".

namespace String

The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

tokenBoundCidrs List<String>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl Integer

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl Integer

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy Boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses Integer

The period, if any, in number of seconds to set on the token.

tokenPeriod Integer

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

tokenPolicies List<String>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl Integer

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType String

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

roleName string

The name of the role to retrieve the Role ID for.

backend string

The unique name for the GCP backend from which to fetch the role. Defaults to "gcp".

namespace string

The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

tokenBoundCidrs string[]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses number

The period, if any, in number of seconds to set on the token.

tokenPeriod number

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

tokenPolicies string[]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType string

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

role_name str

The name of the role to retrieve the Role ID for.

backend str

The unique name for the GCP backend from which to fetch the role. Defaults to "gcp".

namespace str

The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

token_bound_cidrs Sequence[str]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

token_explicit_max_ttl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

token_max_ttl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_no_default_policy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

token_num_uses int

The period, if any, in number of seconds to set on the token.

token_period int

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

token_policies Sequence[str]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

token_ttl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_type str

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

roleName String

The name of the role to retrieve the Role ID for.

backend String

The unique name for the GCP backend from which to fetch the role. Defaults to "gcp".

namespace String

The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

tokenBoundCidrs List<String>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl Number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl Number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy Boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses Number

The period, if any, in number of seconds to set on the token.

tokenPeriod Number

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

tokenPolicies List<String>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl Number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType String

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

getAuthBackendRole Result

The following output properties are available:

BoundInstanceGroups List<string>

GCP regions bound to the role. Returned when type is gce.

BoundLabels List<string>

GCP labels bound to the role. Returned when type is gce.

BoundProjects List<string>

GCP projects bound to the role.

BoundRegions List<string>

GCP regions bound to the role. Returned when type is gce.

BoundServiceAccounts List<string>

GCP service accounts bound to the role. Returned when type is iam.

BoundZones List<string>

GCP zones bound to the role. Returned when type is gce.

Id string

The provider-assigned unique ID for this managed resource.

RoleId string

The RoleID of the GCP role.

RoleName string
Type string

Type of GCP role. Expected values are iam or gce.

Backend string
Namespace string
TokenBoundCidrs List<string>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

TokenPolicies List<string>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

BoundInstanceGroups []string

GCP regions bound to the role. Returned when type is gce.

BoundLabels []string

GCP labels bound to the role. Returned when type is gce.

BoundProjects []string

GCP projects bound to the role.

BoundRegions []string

GCP regions bound to the role. Returned when type is gce.

BoundServiceAccounts []string

GCP service accounts bound to the role. Returned when type is iam.

BoundZones []string

GCP zones bound to the role. Returned when type is gce.

Id string

The provider-assigned unique ID for this managed resource.

RoleId string

The RoleID of the GCP role.

RoleName string
Type string

Type of GCP role. Expected values are iam or gce.

Backend string
Namespace string
TokenBoundCidrs []string

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

TokenExplicitMaxTtl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

TokenMaxTtl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenNoDefaultPolicy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

TokenNumUses int

The period, if any, in number of seconds to set on the token.

TokenPeriod int

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

TokenPolicies []string

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

TokenTtl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

TokenType string

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

boundInstanceGroups List<String>

GCP regions bound to the role. Returned when type is gce.

boundLabels List<String>

GCP labels bound to the role. Returned when type is gce.

boundProjects List<String>

GCP projects bound to the role.

boundRegions List<String>

GCP regions bound to the role. Returned when type is gce.

boundServiceAccounts List<String>

GCP service accounts bound to the role. Returned when type is iam.

boundZones List<String>

GCP zones bound to the role. Returned when type is gce.

id String

The provider-assigned unique ID for this managed resource.

roleId String

The RoleID of the GCP role.

roleName String
type String

Type of GCP role. Expected values are iam or gce.

backend String
namespace String
tokenBoundCidrs List<String>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl Integer

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl Integer

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy Boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses Integer

The period, if any, in number of seconds to set on the token.

tokenPeriod Integer

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

tokenPolicies List<String>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl Integer

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType String

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

boundInstanceGroups string[]

GCP regions bound to the role. Returned when type is gce.

boundLabels string[]

GCP labels bound to the role. Returned when type is gce.

boundProjects string[]

GCP projects bound to the role.

boundRegions string[]

GCP regions bound to the role. Returned when type is gce.

boundServiceAccounts string[]

GCP service accounts bound to the role. Returned when type is iam.

boundZones string[]

GCP zones bound to the role. Returned when type is gce.

id string

The provider-assigned unique ID for this managed resource.

roleId string

The RoleID of the GCP role.

roleName string
type string

Type of GCP role. Expected values are iam or gce.

backend string
namespace string
tokenBoundCidrs string[]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses number

The period, if any, in number of seconds to set on the token.

tokenPeriod number

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

tokenPolicies string[]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType string

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

bound_instance_groups Sequence[str]

GCP regions bound to the role. Returned when type is gce.

bound_labels Sequence[str]

GCP labels bound to the role. Returned when type is gce.

bound_projects Sequence[str]

GCP projects bound to the role.

bound_regions Sequence[str]

GCP regions bound to the role. Returned when type is gce.

bound_service_accounts Sequence[str]

GCP service accounts bound to the role. Returned when type is iam.

bound_zones Sequence[str]

GCP zones bound to the role. Returned when type is gce.

id str

The provider-assigned unique ID for this managed resource.

role_id str

The RoleID of the GCP role.

role_name str
type str

Type of GCP role. Expected values are iam or gce.

backend str
namespace str
token_bound_cidrs Sequence[str]

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

token_explicit_max_ttl int

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

token_max_ttl int

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_no_default_policy bool

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

token_num_uses int

The period, if any, in number of seconds to set on the token.

token_period int

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

token_policies Sequence[str]

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

token_ttl int

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

token_type str

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

boundInstanceGroups List<String>

GCP regions bound to the role. Returned when type is gce.

boundLabels List<String>

GCP labels bound to the role. Returned when type is gce.

boundProjects List<String>

GCP projects bound to the role.

boundRegions List<String>

GCP regions bound to the role. Returned when type is gce.

boundServiceAccounts List<String>

GCP service accounts bound to the role. Returned when type is iam.

boundZones List<String>

GCP zones bound to the role. Returned when type is gce.

id String

The provider-assigned unique ID for this managed resource.

roleId String

The RoleID of the GCP role.

roleName String
type String

Type of GCP role. Expected values are iam or gce.

backend String
namespace String
tokenBoundCidrs List<String>

List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.

tokenExplicitMaxTtl Number

If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.

tokenMaxTtl Number

The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenNoDefaultPolicy Boolean

If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.

tokenNumUses Number

The period, if any, in number of seconds to set on the token.

tokenPeriod Number

(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token's TTL will be set to the value of this field. Specified in seconds.

tokenPolicies List<String>

List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.

tokenTtl Number

The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.

tokenType String

The type of token that should be generated. Can be service, batch, or default to use the mount's tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.

Package Details

Repository
https://github.com/pulumi/pulumi-vault
License
Apache-2.0
Notes

This Pulumi package is based on the vault Terraform Provider.