Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. keymgmt
  6. AzureKms
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.keymgmt.AzureKms

vault logo vault logo
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages an Azure Key Vault provider in the Vault Key Management secrets engine. This resource configures Vault to integrate with Azure Key Vault, allowing keys created in Vault to be distributed to Azure Key Vault for use in Azure services.

    Once configured, keys can be distributed to Azure Key Vault using the vault.keymgmt.DistributeKey resource.

    Important This resource requires Terraform 1.11+ for write-only attribute support. The credentialsWo field is write-only and will never be stored in Terraform state. See the main provider documentation for more details.

    For more information on managing Azure Key Vault with Vault, please refer to the Vault documentation.

    Note this feature is available only with Vault Enterprise.

    Example Usage

    Using Explicit Credentials

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const keymgmt = new vault.Mount("keymgmt", {
    path: "keymgmt",
    type: "keymgmt",
});
const production = new vault.keymgmt.AzureKms("production", {
    mount: keymgmt.path,
    name: "azure-production",
    keyCollection: "my-keyvault",
    credentialsWo: {
        tenant_id: azureTenantId,
        client_id: azureClientId,
        client_secret: azureClientSecret,
        environment: "AzurePublicCloud",
    },
    credentialsWoVersion: 1,
});

    import pulumi
import pulumi_vault as vault

keymgmt = vault.Mount("keymgmt",
    path="keymgmt",
    type="keymgmt")
production = vault.keymgmt.AzureKms("production",
    mount=keymgmt.path,
    name="azure-production",
    key_collection="my-keyvault",
    credentials_wo={
        "tenant_id": azure_tenant_id,
        "client_id": azure_client_id,
        "client_secret": azure_client_secret,
        "environment": "AzurePublicCloud",
    },
    credentials_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keymgmt2, err := vault.NewMount(ctx, "keymgmt", &vault.MountArgs{
			Path: pulumi.String("keymgmt"),
			Type: pulumi.String("keymgmt"),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewAzureKms(ctx, "production", &keymgmt.AzureKmsArgs{
			Mount:         keymgmt2.Path,
			Name:          pulumi.String("azure-production"),
			KeyCollection: pulumi.String("my-keyvault"),
			CredentialsWo: pulumi.StringMap{
				"tenant_id":     pulumi.Any(azureTenantId),
				"client_id":     pulumi.Any(azureClientId),
				"client_secret": pulumi.Any(azureClientSecret),
				"environment":   pulumi.String("AzurePublicCloud"),
			},
			CredentialsWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var keymgmt = new Vault.Mount("keymgmt", new()
    {
        Path = "keymgmt",
        Type = "keymgmt",
    });

    var production = new Vault.KeyMgmt.AzureKms("production", new()
    {
        Mount = keymgmt.Path,
        Name = "azure-production",
        KeyCollection = "my-keyvault",
        CredentialsWo = 
        {
            { "tenant_id", azureTenantId },
            { "client_id", azureClientId },
            { "client_secret", azureClientSecret },
            { "environment", "AzurePublicCloud" },
        },
        CredentialsWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.keymgmt.AzureKms;
import com.pulumi.vault.keymgmt.AzureKmsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keymgmt = new Mount("keymgmt", MountArgs.builder()
            .path("keymgmt")
            .type("keymgmt")
            .build());

        var production = new AzureKms("production", AzureKmsArgs.builder()
            .mount(keymgmt.path())
            .name("azure-production")
            .keyCollection("my-keyvault")
            .credentialsWo(Map.ofEntries(
                Map.entry("tenant_id", azureTenantId),
                Map.entry("client_id", azureClientId),
                Map.entry("client_secret", azureClientSecret),
                Map.entry("environment", "AzurePublicCloud")
            ))
            .credentialsWoVersion(1)
            .build());

    }
}

    resources:
  keymgmt:
    type: vault:Mount
    properties:
      path: keymgmt
      type: keymgmt
  production:
    type: vault:keymgmt:AzureKms
    properties:
      mount: ${keymgmt.path}
      name: azure-production
      keyCollection: my-keyvault
      credentialsWo:
        tenant_id: ${azureTenantId}
        client_id: ${azureClientId}
        client_secret: ${azureClientSecret}
        environment: AzurePublicCloud
      credentialsWoVersion: 1

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "keymgmt" {
  path = "keymgmt"
  type = "keymgmt"
}
resource "vault_keymgmt_azurekms" "production" {
  mount          = vault_mount.keymgmt.path
  name           = "azure-production"
  key_collection = "my-keyvault"
  credentials_wo = {
    "tenant_id"     = azureTenantId
    "client_id"     = azureClientId
    "client_secret" = azureClientSecret
    "environment"   = "AzurePublicCloud"
  }
  credentials_wo_version = 1
}

    Using Azure Environment Variables or Managed Identity

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

// When credentials_wo is not provided, Vault uses its own environment to
// authenticate with Azure. Supported options include:
// 1. Environment variables set on the Vault server:
//    AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
// 2. Azure Managed Identity (when Vault runs on an Azure VM or service
//    with an assigned identity)
const keymgmt = new vault.Mount("keymgmt", {
    path: "keymgmt",
    type: "keymgmt",
});
const production = new vault.keymgmt.AzureKms("production", {
    mount: keymgmt.path,
    name: "azure-production",
    keyCollection: "my-keyvault",
});

    import pulumi
import pulumi_vault as vault

# When credentials_wo is not provided, Vault uses its own environment to
# authenticate with Azure. Supported options include:
# 1. Environment variables set on the Vault server:
#    AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
# 2. Azure Managed Identity (when Vault runs on an Azure VM or service
#    with an assigned identity)
keymgmt = vault.Mount("keymgmt",
    path="keymgmt",
    type="keymgmt")
production = vault.keymgmt.AzureKms("production",
    mount=keymgmt.path,
    name="azure-production",
    key_collection="my-keyvault")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// When credentials_wo is not provided, Vault uses its own environment to
		// authenticate with Azure. Supported options include:
		//  1. Environment variables set on the Vault server:
		//     AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
		//  2. Azure Managed Identity (when Vault runs on an Azure VM or service
		//     with an assigned identity)
		keymgmt2, err := vault.NewMount(ctx, "keymgmt", &vault.MountArgs{
			Path: pulumi.String("keymgmt"),
			Type: pulumi.String("keymgmt"),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewAzureKms(ctx, "production", &keymgmt.AzureKmsArgs{
			Mount:         keymgmt2.Path,
			Name:          pulumi.String("azure-production"),
			KeyCollection: pulumi.String("my-keyvault"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    // When credentials_wo is not provided, Vault uses its own environment to
    // authenticate with Azure. Supported options include:
    // 1. Environment variables set on the Vault server:
    //    AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
    // 2. Azure Managed Identity (when Vault runs on an Azure VM or service
    //    with an assigned identity)
    var keymgmt = new Vault.Mount("keymgmt", new()
    {
        Path = "keymgmt",
        Type = "keymgmt",
    });

    var production = new Vault.KeyMgmt.AzureKms("production", new()
    {
        Mount = keymgmt.Path,
        Name = "azure-production",
        KeyCollection = "my-keyvault",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.keymgmt.AzureKms;
import com.pulumi.vault.keymgmt.AzureKmsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // When credentials_wo is not provided, Vault uses its own environment to
        // authenticate with Azure. Supported options include:
        // 1. Environment variables set on the Vault server:
        //    AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
        // 2. Azure Managed Identity (when Vault runs on an Azure VM or service
        //    with an assigned identity)
        var keymgmt = new Mount("keymgmt", MountArgs.builder()
            .path("keymgmt")
            .type("keymgmt")
            .build());

        var production = new AzureKms("production", AzureKmsArgs.builder()
            .mount(keymgmt.path())
            .name("azure-production")
            .keyCollection("my-keyvault")
            .build());

    }
}

    resources:
  # When credentials_wo is not provided, Vault uses its own environment to
  # authenticate with Azure. Supported options include:
  # 1. Environment variables set on the Vault server:
  #    AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
  # 2. Azure Managed Identity (when Vault runs on an Azure VM or service
  #    with an assigned identity)
  keymgmt:
    type: vault:Mount
    properties:
      path: keymgmt
      type: keymgmt
  production:
    type: vault:keymgmt:AzureKms
    properties:
      mount: ${keymgmt.path}
      name: azure-production
      keyCollection: my-keyvault

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

# When credentials_wo is not provided, Vault uses its own environment to
# authenticate with Azure. Supported options include:
# 1. Environment variables set on the Vault server:
#    AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
# 2. Azure Managed Identity (when Vault runs on an Azure VM or service
#    with an assigned identity)
resource "vault_mount" "keymgmt" {
  path = "keymgmt"
  type = "keymgmt"
}
resource "vault_keymgmt_azurekms" "production" {
  mount          = vault_mount.keymgmt.path
  name           = "azure-production"
  key_collection = "my-keyvault"
}

    Create AzureKms Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AzureKms(name: string, args: AzureKmsArgs, opts?: CustomResourceOptions);
    @overload
def AzureKms(resource_name: str,
             args: AzureKmsArgs,
             opts: Optional[ResourceOptions] = None)

@overload
def AzureKms(resource_name: str,
             opts: Optional[ResourceOptions] = None,
             key_collection: Optional[str] = None,
             mount: Optional[str] = None,
             credentials_wo: Optional[Mapping[str, str]] = None,
             credentials_wo_version: Optional[int] = None,
             name: Optional[str] = None,
             namespace: Optional[str] = None)
    func NewAzureKms(ctx *Context, name string, args AzureKmsArgs, opts ...ResourceOption) (*AzureKms, error)
    public AzureKms(string name, AzureKmsArgs args, CustomResourceOptions? opts = null)
    public AzureKms(String name, AzureKmsArgs args)
public AzureKms(String name, AzureKmsArgs args, CustomResourceOptions options)

    type: vault:keymgmt:AzureKms
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_keymgmt_azure_kms" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AzureKmsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AzureKmsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AzureKmsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AzureKmsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AzureKmsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var azureKmsResource = new Vault.KeyMgmt.AzureKms("azureKmsResource", new()
{
    KeyCollection = "string",
    Mount = "string",
    CredentialsWo = 
    {
        { "string", "string" },
    },
    CredentialsWoVersion = 0,
    Name = "string",
    Namespace = "string",
});

    example, err := keymgmt.NewAzureKms(ctx, "azureKmsResource", &keymgmt.AzureKmsArgs{
	KeyCollection: pulumi.String("string"),
	Mount:         pulumi.String("string"),
	CredentialsWo: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	CredentialsWoVersion: pulumi.Int(0),
	Name:                 pulumi.String("string"),
	Namespace:            pulumi.String("string"),
})

    resource "vault_keymgmt_azure_kms" "azureKmsResource" {
  lifecycle {
    create_before_destroy = true
  }
  key_collection = "string"
  mount          = "string"
  credentials_wo = {
    "string" = "string"
  }
  credentials_wo_version = 0
  name                   = "string"
  namespace              = "string"
}

    var azureKmsResource = new AzureKms("azureKmsResource", AzureKmsArgs.builder()
    .keyCollection("string")
    .mount("string")
    .credentialsWo(Map.of("string", "string"))
    .credentialsWoVersion(0)
    .name("string")
    .namespace("string")
    .build());

    azure_kms_resource = vault.keymgmt.AzureKms("azureKmsResource",
    key_collection="string",
    mount="string",
    credentials_wo={
        "string": "string",
    },
    credentials_wo_version=0,
    name="string",
    namespace="string")

    const azureKmsResource = new vault.keymgmt.AzureKms("azureKmsResource", {
    keyCollection: "string",
    mount: "string",
    credentialsWo: {
        string: "string",
    },
    credentialsWoVersion: 0,
    name: "string",
    namespace: "string",
});

    type: vault:keymgmt:AzureKms
properties:
    credentialsWo:
        string: string
    credentialsWoVersion: 0
    keyCollection: string
    mount: string
    name: string
    namespace: string

    AzureKms Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AzureKms resource accepts the following input properties:

    KeyCollection string
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    CredentialsWo Dictionary<string, string>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    Name string
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    KeyCollection string
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    CredentialsWo map[string]string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    Name string
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    key_collection string
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentials_wo map(string)
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name string
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyCollection String
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentialsWo Map<String,String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Integer
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name String
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyCollection string
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentialsWo {[key: string]: string}
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name string
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    key_collection str
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentials_wo Mapping[str, str]
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name str
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyCollection String
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentialsWo Map<String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name String
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AzureKms resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing AzureKms Resource

    Get an existing AzureKms resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AzureKmsState, opts?: CustomResourceOptions): AzureKms
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        credentials_wo: Optional[Mapping[str, str]] = None,
        credentials_wo_version: Optional[int] = None,
        key_collection: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None) -> AzureKms
    func GetAzureKms(ctx *Context, name string, id IDInput, state *AzureKmsState, opts ...ResourceOption) (*AzureKms, error)
    public static AzureKms Get(string name, Input<string> id, AzureKmsState? state, CustomResourceOptions? opts = null)
    public static AzureKms get(String name, Output<String> id, AzureKmsState state, CustomResourceOptions options)
    resources:  _:    type: vault:keymgmt:AzureKms    get:      id: ${id}
    import {
  to = vault_keymgmt_azure_kms.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CredentialsWo Dictionary<string, string>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    KeyCollection string
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Name string
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    CredentialsWo map[string]string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    KeyCollection string
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Name string
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentials_wo map(string)
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    key_collection string
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name string
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentialsWo Map<String,String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Integer
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    keyCollection String
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name String
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentialsWo {[key: string]: string}
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    keyCollection string
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name string
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentials_wo Mapping[str, str]
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    key_collection str
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name str
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentialsWo Map<String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    keyCollection String
    Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name String
    Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Import

    Azure Key Vault providers can be imported using the format {path}/kms/{name}, e.g.

    $ pulumi import vault:keymgmt/azureKms:AzureKms production keymgmt/kms/azure-production

    Note: Import sets the mount attribute from the import ID. The credentialsWo and credentialsWoVersion fields will not be populated as they are not returned by the Vault API. You must supply these values in your configuration after import. The corresponding vault.Mount resource must also be present in your configuration (or separately imported).

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.11.0
    published on Wednesday, Jul 22, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial