Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. identity
  6. TpmGroup
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.identity.TpmGroup

vault logo vault logo
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Creates an Identity TPM Group for Vault. TPM groups allow you to organize multiple TPM records (machines with TPM 2.0 hardware) into logical groups for easier policy management and authorization.

    Important This resource requires Vault Enterprise 2.2.0 or later.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const server1 = new vault.identity.Tpm("server1", {
    name: "production-server-01",
    tpmEkPublicKey: std.file({
        input: "server1-ek.pem",
    }).then(invoke => invoke.result),
});
const server2 = new vault.identity.Tpm("server2", {
    name: "production-server-02",
    tpmEkPublicKey: std.file({
        input: "server2-ek.pem",
    }).then(invoke => invoke.result),
});
const productionServers = new vault.identity.TpmGroup("production_servers", {
    name: "production-servers",
    memberTpmIds: [
        server1.tpmId,
        server2.tpmId,
    ],
    metadata: {
        environment: "production",
        team: "platform",
    },
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

server1 = vault.identity.Tpm("server1",
    name="production-server-01",
    tpm_ek_public_key=std.file(input="server1-ek.pem").result)
server2 = vault.identity.Tpm("server2",
    name="production-server-02",
    tpm_ek_public_key=std.file(input="server2-ek.pem").result)
production_servers = vault.identity.TpmGroup("production_servers",
    name="production-servers",
    member_tpm_ids=[
        server1.tpm_id,
        server2.tpm_id,
    ],
    metadata={
        "environment": "production",
        "team": "platform",
    })

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "server1-ek.pem",
		}, nil)
		if err != nil {
			return err
		}
		server1, err := identity.NewTpm(ctx, "server1", &identity.TpmArgs{
			Name:           pulumi.String("production-server-01"),
			TpmEkPublicKey: pulumi.String(invokeFile.Result),
		})
		if err != nil {
			return err
		}
		invokeFile1, err := std.File(ctx, &std.FileArgs{
			Input: "server2-ek.pem",
		}, nil)
		if err != nil {
			return err
		}
		server2, err := identity.NewTpm(ctx, "server2", &identity.TpmArgs{
			Name:           pulumi.String("production-server-02"),
			TpmEkPublicKey: pulumi.String(invokeFile1.Result),
		})
		if err != nil {
			return err
		}
		_, err = identity.NewTpmGroup(ctx, "production_servers", &identity.TpmGroupArgs{
			Name: pulumi.String("production-servers"),
			MemberTpmIds: pulumi.StringArray{
				server1.TpmId,
				server2.TpmId,
			},
			Metadata: pulumi.StringMap{
				"environment": pulumi.String("production"),
				"team":        pulumi.String("platform"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var server1 = new Vault.Identity.Tpm("server1", new()
    {
        Name = "production-server-01",
        TpmEkPublicKey = Std.File.Invoke(new()
        {
            Input = "server1-ek.pem",
        }).Apply(invoke => invoke.Result),
    });

    var server2 = new Vault.Identity.Tpm("server2", new()
    {
        Name = "production-server-02",
        TpmEkPublicKey = Std.File.Invoke(new()
        {
            Input = "server2-ek.pem",
        }).Apply(invoke => invoke.Result),
    });

    var productionServers = new Vault.Identity.TpmGroup("production_servers", new()
    {
        Name = "production-servers",
        MemberTpmIds = new[]
        {
            server1.TpmId,
            server2.TpmId,
        },
        Metadata = 
        {
            { "environment", "production" },
            { "team", "platform" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.identity.Tpm;
import com.pulumi.vault.identity.TpmArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import com.pulumi.vault.identity.TpmGroup;
import com.pulumi.vault.identity.TpmGroupArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var server1 = new Tpm("server1", TpmArgs.builder()
            .name("production-server-01")
            .tpmEkPublicKey(StdFunctions.file(FileArgs.builder()
                .input("server1-ek.pem")
                .build()).result())
            .build());

        var server2 = new Tpm("server2", TpmArgs.builder()
            .name("production-server-02")
            .tpmEkPublicKey(StdFunctions.file(FileArgs.builder()
                .input("server2-ek.pem")
                .build()).result())
            .build());

        var productionServers = new TpmGroup("productionServers", TpmGroupArgs.builder()
            .name("production-servers")
            .memberTpmIds(            
                server1.tpmId(),
                server2.tpmId())
            .metadata(Map.ofEntries(
                Map.entry("environment", "production"),
                Map.entry("team", "platform")
            ))
            .build());

    }
}

    resources:
  server1:
    type: vault:identity:Tpm
    properties:
      name: production-server-01
      tpmEkPublicKey:
        fn::invoke:
          function: std:file
          arguments:
            input: server1-ek.pem
          return: result
  server2:
    type: vault:identity:Tpm
    properties:
      name: production-server-02
      tpmEkPublicKey:
        fn::invoke:
          function: std:file
          arguments:
            input: server2-ek.pem
          return: result
  productionServers:
    type: vault:identity:TpmGroup
    name: production_servers
    properties:
      name: production-servers
      memberTpmIds:
        - ${server1.tpmId}
        - ${server2.tpmId}
      metadata:
        environment: production
        team: platform

    terraform {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_identity_tpm" "server1" {
  lifecycle {
    create_before_destroy = true
  }
  name              = "production-server-01"
  tpm_ek_public_key = file("server1-ek.pem")
}
resource "vault_identity_tpm" "server2" {
  lifecycle {
    create_before_destroy = true
  }
  name              = "production-server-02"
  tpm_ek_public_key = file("server2-ek.pem")
}
resource "vault_identity_tpm_group" "production_servers" {
  lifecycle {
    create_before_destroy = true
  }
  name           = "production-servers"
  member_tpm_ids = [vault_identity_tpm.server1.tpm_id, vault_identity_tpm.server2.tpm_id]
  metadata = {
    "environment" = "production"
    "team"        = "platform"
  }
}

    Create TpmGroup Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new TpmGroup(name: string, args?: TpmGroupArgs, opts?: CustomResourceOptions);
    @overload
def TpmGroup(resource_name: str,
             args: Optional[TpmGroupArgs] = None,
             opts: Optional[ResourceOptions] = None)

@overload
def TpmGroup(resource_name: str,
             opts: Optional[ResourceOptions] = None,
             member_tpm_ids: Optional[Sequence[str]] = None,
             metadata: Optional[Mapping[str, str]] = None,
             name: Optional[str] = None,
             namespace: Optional[str] = None)
    func NewTpmGroup(ctx *Context, name string, args *TpmGroupArgs, opts ...ResourceOption) (*TpmGroup, error)
    public TpmGroup(string name, TpmGroupArgs? args = null, CustomResourceOptions? opts = null)
    public TpmGroup(String name, TpmGroupArgs args)
public TpmGroup(String name, TpmGroupArgs args, CustomResourceOptions options)

    type: vault:identity:TpmGroup
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_identity_tpm_group" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args TpmGroupArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args TpmGroupArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args TpmGroupArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args TpmGroupArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args TpmGroupArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var tpmGroupResource = new Vault.Identity.TpmGroup("tpmGroupResource", new()
{
    MemberTpmIds = new[]
    {
        "string",
    },
    Metadata = 
    {
        { "string", "string" },
    },
    Name = "string",
    Namespace = "string",
});

    example, err := identity.NewTpmGroup(ctx, "tpmGroupResource", &identity.TpmGroupArgs{
	MemberTpmIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	Metadata: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Name:      pulumi.String("string"),
	Namespace: pulumi.String("string"),
})

    resource "vault_identity_tpm_group" "tpmGroupResource" {
  lifecycle {
    create_before_destroy = true
  }
  member_tpm_ids = ["string"]
  metadata = {
    "string" = "string"
  }
  name      = "string"
  namespace = "string"
}

    var tpmGroupResource = new TpmGroup("tpmGroupResource", TpmGroupArgs.builder()
    .memberTpmIds("string")
    .metadata(Map.of("string", "string"))
    .name("string")
    .namespace("string")
    .build());

    tpm_group_resource = vault.identity.TpmGroup("tpmGroupResource",
    member_tpm_ids=["string"],
    metadata={
        "string": "string",
    },
    name="string",
    namespace="string")

    const tpmGroupResource = new vault.identity.TpmGroup("tpmGroupResource", {
    memberTpmIds: ["string"],
    metadata: {
        string: "string",
    },
    name: "string",
    namespace: "string",
});

    type: vault:identity:TpmGroup
properties:
    memberTpmIds:
        - string
    metadata:
        string: string
    name: string
    namespace: string

    TpmGroup Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The TpmGroup resource accepts the following input properties:

    MemberTpmIds List<string>
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    Metadata Dictionary<string, string>
    A map of additional metadata to associate with the TPM group.
    Name string
    Name of the TPM group. Vault generates a name if one is not specified.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    MemberTpmIds []string
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    Metadata map[string]string
    A map of additional metadata to associate with the TPM group.
    Name string
    Name of the TPM group. Vault generates a name if one is not specified.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    member_tpm_ids list(string)
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata map(string)
    A map of additional metadata to associate with the TPM group.
    name string
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    memberTpmIds List<String>
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata Map<String,String>
    A map of additional metadata to associate with the TPM group.
    name String
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    memberTpmIds string[]
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata {[key: string]: string}
    A map of additional metadata to associate with the TPM group.
    name string
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    member_tpm_ids Sequence[str]
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata Mapping[str, str]
    A map of additional metadata to associate with the TPM group.
    name str
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    memberTpmIds List<String>
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata Map<String>
    A map of additional metadata to associate with the TPM group.
    name String
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the TpmGroup resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    TpmGroupId string
    The unique ID Vault assigns to this TPM group.
    Id string
    The provider-assigned unique ID for this managed resource.
    TpmGroupId string
    The unique ID Vault assigns to this TPM group.
    id string
    The provider-assigned unique ID for this managed resource.
    tpm_group_id string
    The unique ID Vault assigns to this TPM group.
    id String
    The provider-assigned unique ID for this managed resource.
    tpmGroupId String
    The unique ID Vault assigns to this TPM group.
    id string
    The provider-assigned unique ID for this managed resource.
    tpmGroupId string
    The unique ID Vault assigns to this TPM group.
    id str
    The provider-assigned unique ID for this managed resource.
    tpm_group_id str
    The unique ID Vault assigns to this TPM group.
    id String
    The provider-assigned unique ID for this managed resource.
    tpmGroupId String
    The unique ID Vault assigns to this TPM group.

    Look up Existing TpmGroup Resource

    Get an existing TpmGroup resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: TpmGroupState, opts?: CustomResourceOptions): TpmGroup
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        member_tpm_ids: Optional[Sequence[str]] = None,
        metadata: Optional[Mapping[str, str]] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        tpm_group_id: Optional[str] = None) -> TpmGroup
    func GetTpmGroup(ctx *Context, name string, id IDInput, state *TpmGroupState, opts ...ResourceOption) (*TpmGroup, error)
    public static TpmGroup Get(string name, Input<string> id, TpmGroupState? state, CustomResourceOptions? opts = null)
    public static TpmGroup get(String name, Output<String> id, TpmGroupState state, CustomResourceOptions options)
    resources:  _:    type: vault:identity:TpmGroup    get:      id: ${id}
    import {
  to = vault_identity_tpm_group.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    MemberTpmIds List<string>
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    Metadata Dictionary<string, string>
    A map of additional metadata to associate with the TPM group.
    Name string
    Name of the TPM group. Vault generates a name if one is not specified.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    TpmGroupId string
    The unique ID Vault assigns to this TPM group.
    MemberTpmIds []string
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    Metadata map[string]string
    A map of additional metadata to associate with the TPM group.
    Name string
    Name of the TPM group. Vault generates a name if one is not specified.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    TpmGroupId string
    The unique ID Vault assigns to this TPM group.
    member_tpm_ids list(string)
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata map(string)
    A map of additional metadata to associate with the TPM group.
    name string
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpm_group_id string
    The unique ID Vault assigns to this TPM group.
    memberTpmIds List<String>
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata Map<String,String>
    A map of additional metadata to associate with the TPM group.
    name String
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpmGroupId String
    The unique ID Vault assigns to this TPM group.
    memberTpmIds string[]
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata {[key: string]: string}
    A map of additional metadata to associate with the TPM group.
    name string
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpmGroupId string
    The unique ID Vault assigns to this TPM group.
    member_tpm_ids Sequence[str]
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata Mapping[str, str]
    A map of additional metadata to associate with the TPM group.
    name str
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpm_group_id str
    The unique ID Vault assigns to this TPM group.
    memberTpmIds List<String>
    Set of TPM IDs that are members of this TPM group. These are the unique IDs assigned by Vault to TPM records (SHA256 of the EK public key).
    metadata Map<String>
    A map of additional metadata to associate with the TPM group.
    name String
    Name of the TPM group. Vault generates a name if one is not specified.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    tpmGroupId String
    The unique ID Vault assigns to this TPM group.

    Import

    Identity TPM groups can be imported using the tpmGroupId, e.g.

    $ pulumi import vault:identity/tpmGroup:TpmGroup production_servers <tpm_group_id>

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.14.1
    published on Tuesday, Oct 27, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial