Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. identity
  6. Tpm
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.identity.Tpm

vault logo vault logo
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Creates an Identity TPM record for Vault. TPM records represent individual machines with TPM 2.0 hardware and are identified by their TPM Endorsement Key (EK) public key.

    Important This resource requires Vault Enterprise 2.2.0 or later.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const machine1 = new vault.identity.Tpm("machine1", {
    name: "production-server-01",
    tpmEkPublicKey: `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----
`,
    disabled: false,
    metadata: {
        environment: "production",
        datacenter: "us-west-2",
        owner: "platform-team",
    },
});

    import pulumi
import pulumi_vault as vault

machine1 = vault.identity.Tpm("machine1",
    name="production-server-01",
    tpm_ek_public_key="""-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----
""",
    disabled=False,
    metadata={
        "environment": "production",
        "datacenter": "us-west-2",
        "owner": "platform-team",
    })

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := identity.NewTpm(ctx, "machine1", &identity.TpmArgs{
			Name:           pulumi.String("production-server-01"),
			TpmEkPublicKey: pulumi.String("-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...\n-----END PUBLIC KEY-----\n"),
			Disabled:       pulumi.Bool(false),
			Metadata: pulumi.StringMap{
				"environment": pulumi.String("production"),
				"datacenter":  pulumi.String("us-west-2"),
				"owner":       pulumi.String("platform-team"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var machine1 = new Vault.Identity.Tpm("machine1", new()
    {
        Name = "production-server-01",
        TpmEkPublicKey = @"-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----
",
        Disabled = false,
        Metadata = 
        {
            { "environment", "production" },
            { "datacenter", "us-west-2" },
            { "owner", "platform-team" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.identity.Tpm;
import com.pulumi.vault.identity.TpmArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var machine1 = new Tpm("machine1", TpmArgs.builder()
            .name("production-server-01")
            .tpmEkPublicKey("""
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----
            """)
            .disabled(false)
            .metadata(Map.ofEntries(
                Map.entry("environment", "production"),
                Map.entry("datacenter", "us-west-2"),
                Map.entry("owner", "platform-team")
            ))
            .build());

    }
}

    resources:
  machine1:
    type: vault:identity:Tpm
    properties:
      name: production-server-01
      tpmEkPublicKey: |
        -----BEGIN PUBLIC KEY-----
        MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
        -----END PUBLIC KEY-----
      disabled: false
      metadata:
        environment: production
        datacenter: us-west-2
        owner: platform-team

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_identity_tpm" "machine1" {
  lifecycle {
    create_before_destroy = true
  }
  name              = "production-server-01"
  tpm_ek_public_key = <<-EOT
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----
EOT

  disabled          = false
  metadata = {
    "environment" = "production"
    "datacenter"  = "us-west-2"
    "owner"       = "platform-team"
  }
}

    Create Tpm Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Tpm(name: string, args: TpmArgs, opts?: CustomResourceOptions);
    @overload
def Tpm(resource_name: str,
        args: TpmArgs,
        opts: Optional[ResourceOptions] = None)

@overload
def Tpm(resource_name: str,
        opts: Optional[ResourceOptions] = None,
        tpm_ek_public_key: Optional[str] = None,
        disabled: Optional[bool] = None,
        metadata: Optional[Mapping[str, str]] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None)
    func NewTpm(ctx *Context, name string, args TpmArgs, opts ...ResourceOption) (*Tpm, error)
    public Tpm(string name, TpmArgs args, CustomResourceOptions? opts = null)
    public Tpm(String name, TpmArgs args)
public Tpm(String name, TpmArgs args, CustomResourceOptions options)

    type: vault:identity:Tpm
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_identity_tpm" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args TpmArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args TpmArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args TpmArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args TpmArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args TpmArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var tpmResource = new Vault.Identity.Tpm("tpmResource", new()
{
    TpmEkPublicKey = "string",
    Disabled = false,
    Metadata = 
    {
        { "string", "string" },
    },
    Name = "string",
    Namespace = "string",
});

    example, err := identity.NewTpm(ctx, "tpmResource", &identity.TpmArgs{
	TpmEkPublicKey: pulumi.String("string"),
	Disabled:       pulumi.Bool(false),
	Metadata: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Name:      pulumi.String("string"),
	Namespace: pulumi.String("string"),
})

    resource "vault_identity_tpm" "tpmResource" {
  lifecycle {
    create_before_destroy = true
  }
  tpm_ek_public_key = "string"
  disabled          = false
  metadata = {
    "string" = "string"
  }
  name      = "string"
  namespace = "string"
}

    var tpmResource = new Tpm("tpmResource", TpmArgs.builder()
    .tpmEkPublicKey("string")
    .disabled(false)
    .metadata(Map.of("string", "string"))
    .name("string")
    .namespace("string")
    .build());

    tpm_resource = vault.identity.Tpm("tpmResource",
    tpm_ek_public_key="string",
    disabled=False,
    metadata={
        "string": "string",
    },
    name="string",
    namespace="string")

    const tpmResource = new vault.identity.Tpm("tpmResource", {
    tpmEkPublicKey: "string",
    disabled: false,
    metadata: {
        string: "string",
    },
    name: "string",
    namespace: "string",
});

    type: vault:identity:Tpm
properties:
    disabled: false
    metadata:
        string: string
    name: string
    namespace: string
    tpmEkPublicKey: string

    Tpm Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Tpm resource accepts the following input properties:

    TpmEkPublicKey string
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    Disabled bool
    Whether the TPM is disabled. Defaults to false.
    Metadata Dictionary<string, string>
    A map of additional metadata to associate with the TPM record.
    Name string
    Name of the TPM record. Vault generates a name if one is not specified.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    TpmEkPublicKey string
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    Disabled bool
    Whether the TPM is disabled. Defaults to false.
    Metadata map[string]string
    A map of additional metadata to associate with the TPM record.
    Name string
    Name of the TPM record. Vault generates a name if one is not specified.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpm_ek_public_key string
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    disabled bool
    Whether the TPM is disabled. Defaults to false.
    metadata map(string)
    A map of additional metadata to associate with the TPM record.
    name string
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpmEkPublicKey String
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    disabled Boolean
    Whether the TPM is disabled. Defaults to false.
    metadata Map<String,String>
    A map of additional metadata to associate with the TPM record.
    name String
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpmEkPublicKey string
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    disabled boolean
    Whether the TPM is disabled. Defaults to false.
    metadata {[key: string]: string}
    A map of additional metadata to associate with the TPM record.
    name string
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpm_ek_public_key str
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    disabled bool
    Whether the TPM is disabled. Defaults to false.
    metadata Mapping[str, str]
    A map of additional metadata to associate with the TPM record.
    name str
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpmEkPublicKey String
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    disabled Boolean
    Whether the TPM is disabled. Defaults to false.
    metadata Map<String>
    A map of additional metadata to associate with the TPM record.
    name String
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Tpm resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    TpmId string
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    Id string
    The provider-assigned unique ID for this managed resource.
    TpmId string
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    id string
    The provider-assigned unique ID for this managed resource.
    tpm_id string
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    id String
    The provider-assigned unique ID for this managed resource.
    tpmId String
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    id string
    The provider-assigned unique ID for this managed resource.
    tpmId string
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    id str
    The provider-assigned unique ID for this managed resource.
    tpm_id str
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    id String
    The provider-assigned unique ID for this managed resource.
    tpmId String
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).

    Look up Existing Tpm Resource

    Get an existing Tpm resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: TpmState, opts?: CustomResourceOptions): Tpm
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        disabled: Optional[bool] = None,
        metadata: Optional[Mapping[str, str]] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        tpm_ek_public_key: Optional[str] = None,
        tpm_id: Optional[str] = None) -> Tpm
    func GetTpm(ctx *Context, name string, id IDInput, state *TpmState, opts ...ResourceOption) (*Tpm, error)
    public static Tpm Get(string name, Input<string> id, TpmState? state, CustomResourceOptions? opts = null)
    public static Tpm get(String name, Output<String> id, TpmState state, CustomResourceOptions options)
    resources:  _:    type: vault:identity:Tpm    get:      id: ${id}
    import {
  to = vault_identity_tpm.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Disabled bool
    Whether the TPM is disabled. Defaults to false.
    Metadata Dictionary<string, string>
    A map of additional metadata to associate with the TPM record.
    Name string
    Name of the TPM record. Vault generates a name if one is not specified.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    TpmEkPublicKey string
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    TpmId string
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    Disabled bool
    Whether the TPM is disabled. Defaults to false.
    Metadata map[string]string
    A map of additional metadata to associate with the TPM record.
    Name string
    Name of the TPM record. Vault generates a name if one is not specified.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    TpmEkPublicKey string
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    TpmId string
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    disabled bool
    Whether the TPM is disabled. Defaults to false.
    metadata map(string)
    A map of additional metadata to associate with the TPM record.
    name string
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpm_ek_public_key string
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    tpm_id string
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    disabled Boolean
    Whether the TPM is disabled. Defaults to false.
    metadata Map<String,String>
    A map of additional metadata to associate with the TPM record.
    name String
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpmEkPublicKey String
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    tpmId String
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    disabled boolean
    Whether the TPM is disabled. Defaults to false.
    metadata {[key: string]: string}
    A map of additional metadata to associate with the TPM record.
    name string
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpmEkPublicKey string
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    tpmId string
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    disabled bool
    Whether the TPM is disabled. Defaults to false.
    metadata Mapping[str, str]
    A map of additional metadata to associate with the TPM record.
    name str
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpm_ek_public_key str
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    tpm_id str
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).
    disabled Boolean
    Whether the TPM is disabled. Defaults to false.
    metadata Map<String>
    A map of additional metadata to associate with the TPM record.
    name String
    Name of the TPM record. Vault generates a name if one is not specified.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpmEkPublicKey String
    PEM-encoded TPM Endorsement Key (EK) public key. This uniquely identifies the TPM hardware. Note: This field cannot be changed after creation; changing it will force recreation of the resource.
    tpmId String
    The unique ID Vault assigns to this TPM record (SHA256 hash of the EK public key).

    Import

    Identity TPM records can be imported using the tpmId, e.g.

    $ pulumi import vault:identity/tpm:Tpm machine1 sha256-<hex>

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.14.1
    published on Tuesday, Oct 27, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial