Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. keymgmt
  6. DistributeKey
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.keymgmt.DistributeKey

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Distributes a key from Vault’s Key Management secrets engine to an external Key Management Service provider (AWS KMS, Azure Key Vault, or GCP Cloud KMS). This resource manages the distribution of cryptographic keys to external KMS systems, allowing them to be used for encryption, decryption, signing, and verification operations in cloud environments.

    Important All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform, and will appear in the console output when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.

    For more information on distributing keys with Vault, please refer to the Vault documentation.

    Note this feature is available only with Vault Enterprise.

    Example Usage

    Distribute to AWS KMS

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const keymgmt = new vault.Mount("keymgmt", {
    path: "keymgmt",
    type: "keymgmt",
});
const encryptionKey = new vault.keymgmt.Key("encryption_key", {
    mount: keymgmt.path,
    name: "aws-encryption-key",
    type: "aes256-gcm96",
});
const aws = new vault.keymgmt.AwsKms("aws", {
    mount: keymgmt.path,
    name: "aws-kms",
    keyCollection: "us-west-2",
    credentialsWo: {
        access_key: awsAccessKeyId,
        secret_key: awsSecretAccessKey,
    },
    credentialsWoVersion: 1,
});
const awsDist = new vault.keymgmt.DistributeKey("aws_dist", {
    mount: keymgmt.path,
    kmsName: aws.name,
    keyName: encryptionKey.name,
    purposes: [
        "encrypt",
        "decrypt",
    ],
    protection: "hsm",
});

    import pulumi
import pulumi_vault as vault

keymgmt = vault.Mount("keymgmt",
    path="keymgmt",
    type="keymgmt")
encryption_key = vault.keymgmt.Key("encryption_key",
    mount=keymgmt.path,
    name="aws-encryption-key",
    type="aes256-gcm96")
aws = vault.keymgmt.AwsKms("aws",
    mount=keymgmt.path,
    name="aws-kms",
    key_collection="us-west-2",
    credentials_wo={
        "access_key": aws_access_key_id,
        "secret_key": aws_secret_access_key,
    },
    credentials_wo_version=1)
aws_dist = vault.keymgmt.DistributeKey("aws_dist",
    mount=keymgmt.path,
    kms_name=aws.name,
    key_name=encryption_key.name,
    purposes=[
        "encrypt",
        "decrypt",
    ],
    protection="hsm")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keymgmt2, err := vault.NewMount(ctx, "keymgmt", &vault.MountArgs{
			Path: pulumi.String("keymgmt"),
			Type: pulumi.String("keymgmt"),
		})
		if err != nil {
			return err
		}
		encryptionKey, err := keymgmt.NewKey(ctx, "encryption_key", &keymgmt.KeyArgs{
			Mount: keymgmt2.Path,
			Name:  pulumi.String("aws-encryption-key"),
			Type:  pulumi.String("aes256-gcm96"),
		})
		if err != nil {
			return err
		}
		aws, err := keymgmt.NewAwsKms(ctx, "aws", &keymgmt.AwsKmsArgs{
			Mount:         keymgmt2.Path,
			Name:          pulumi.String("aws-kms"),
			KeyCollection: pulumi.String("us-west-2"),
			CredentialsWo: pulumi.StringMap{
				"access_key": pulumi.Any(awsAccessKeyId),
				"secret_key": pulumi.Any(awsSecretAccessKey),
			},
			CredentialsWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewDistributeKey(ctx, "aws_dist", &keymgmt.DistributeKeyArgs{
			Mount:   keymgmt2.Path,
			KmsName: aws.Name,
			KeyName: encryptionKey.Name,
			Purposes: pulumi.StringArray{
				pulumi.String("encrypt"),
				pulumi.String("decrypt"),
			},
			Protection: pulumi.String("hsm"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var keymgmt = new Vault.Mount("keymgmt", new()
    {
        Path = "keymgmt",
        Type = "keymgmt",
    });

    var encryptionKey = new Vault.KeyMgmt.Key("encryption_key", new()
    {
        Mount = keymgmt.Path,
        Name = "aws-encryption-key",
        Type = "aes256-gcm96",
    });

    var aws = new Vault.KeyMgmt.AwsKms("aws", new()
    {
        Mount = keymgmt.Path,
        Name = "aws-kms",
        KeyCollection = "us-west-2",
        CredentialsWo = 
        {
            { "access_key", awsAccessKeyId },
            { "secret_key", awsSecretAccessKey },
        },
        CredentialsWoVersion = 1,
    });

    var awsDist = new Vault.KeyMgmt.DistributeKey("aws_dist", new()
    {
        Mount = keymgmt.Path,
        KmsName = aws.Name,
        KeyName = encryptionKey.Name,
        Purposes = new[]
        {
            "encrypt",
            "decrypt",
        },
        Protection = "hsm",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.keymgmt.Key;
import com.pulumi.vault.keymgmt.KeyArgs;
import com.pulumi.vault.keymgmt.AwsKms;
import com.pulumi.vault.keymgmt.AwsKmsArgs;
import com.pulumi.vault.keymgmt.DistributeKey;
import com.pulumi.vault.keymgmt.DistributeKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keymgmt = new Mount("keymgmt", MountArgs.builder()
            .path("keymgmt")
            .type("keymgmt")
            .build());

        var encryptionKey = new Key("encryptionKey", KeyArgs.builder()
            .mount(keymgmt.path())
            .name("aws-encryption-key")
            .type("aes256-gcm96")
            .build());

        var aws = new AwsKms("aws", AwsKmsArgs.builder()
            .mount(keymgmt.path())
            .name("aws-kms")
            .keyCollection("us-west-2")
            .credentialsWo(Map.ofEntries(
                Map.entry("access_key", awsAccessKeyId),
                Map.entry("secret_key", awsSecretAccessKey)
            ))
            .credentialsWoVersion(1)
            .build());

        var awsDist = new DistributeKey("awsDist", DistributeKeyArgs.builder()
            .mount(keymgmt.path())
            .kmsName(aws.name())
            .keyName(encryptionKey.name())
            .purposes(            
                "encrypt",
                "decrypt")
            .protection("hsm")
            .build());

    }
}

    resources:
  keymgmt:
    type: vault:Mount
    properties:
      path: keymgmt
      type: keymgmt
  encryptionKey:
    type: vault:keymgmt:Key
    name: encryption_key
    properties:
      mount: ${keymgmt.path}
      name: aws-encryption-key
      type: aes256-gcm96
  aws:
    type: vault:keymgmt:AwsKms
    properties:
      mount: ${keymgmt.path}
      name: aws-kms
      keyCollection: us-west-2
      credentialsWo:
        access_key: ${awsAccessKeyId}
        secret_key: ${awsSecretAccessKey}
      credentialsWoVersion: 1
  awsDist:
    type: vault:keymgmt:DistributeKey
    name: aws_dist
    properties:
      mount: ${keymgmt.path}
      kmsName: ${aws.name}
      keyName: ${encryptionKey.name}
      purposes:
        - encrypt
        - decrypt
      protection: hsm

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "keymgmt" {
  path = "keymgmt"
  type = "keymgmt"
}
resource "vault_keymgmt_key" "encryption_key" {
  mount = vault_mount.keymgmt.path
  name  = "aws-encryption-key"
  type  = "aes256-gcm96"
}
resource "vault_keymgmt_awskms" "aws" {
  mount          = vault_mount.keymgmt.path
  name           = "aws-kms"
  key_collection = "us-west-2"
  credentials_wo = {
    "access_key" = awsAccessKeyId
    "secret_key" = awsSecretAccessKey
  }
  credentials_wo_version = 1
}
resource "vault_keymgmt_distributekey" "aws_dist" {
  mount      = vault_mount.keymgmt.path
  kms_name   = vault_keymgmt_awskms.aws.name
  key_name   = vault_keymgmt_key.encryption_key.name
  purposes   = ["encrypt", "decrypt"]
  protection = "hsm"
}

    Distribute to AWS KMS (Using Environment Variables)

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

// When AWS credentials are configured via environment variables or IAM roles
// on the Vault server, you can omit access_key and secret_key
const aws = new vault.keymgmt.AwsKms("aws", {
    mount: keymgmt.path,
    name: "aws-kms",
    keyCollection: "us-west-2",
});
const awsDist = new vault.keymgmt.DistributeKey("aws_dist", {
    mount: keymgmt.path,
    kmsName: aws.name,
    keyName: encryptionKey.name,
    purposes: [
        "encrypt",
        "decrypt",
    ],
});

    import pulumi
import pulumi_vault as vault

# When AWS credentials are configured via environment variables or IAM roles
# on the Vault server, you can omit access_key and secret_key
aws = vault.keymgmt.AwsKms("aws",
    mount=keymgmt["path"],
    name="aws-kms",
    key_collection="us-west-2")
aws_dist = vault.keymgmt.DistributeKey("aws_dist",
    mount=keymgmt["path"],
    kms_name=aws.name,
    key_name=encryption_key["name"],
    purposes=[
        "encrypt",
        "decrypt",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// When AWS credentials are configured via environment variables or IAM roles
		// on the Vault server, you can omit access_key and secret_key
		aws, err := keymgmt.NewAwsKms(ctx, "aws", &keymgmt.AwsKmsArgs{
			Mount:         pulumi.Any(keymgmt.Path),
			Name:          pulumi.String("aws-kms"),
			KeyCollection: pulumi.String("us-west-2"),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewDistributeKey(ctx, "aws_dist", &keymgmt.DistributeKeyArgs{
			Mount:   pulumi.Any(keymgmt.Path),
			KmsName: aws.Name,
			KeyName: pulumi.Any(encryptionKey.Name),
			Purposes: pulumi.StringArray{
				pulumi.String("encrypt"),
				pulumi.String("decrypt"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    // When AWS credentials are configured via environment variables or IAM roles
    // on the Vault server, you can omit access_key and secret_key
    var aws = new Vault.KeyMgmt.AwsKms("aws", new()
    {
        Mount = keymgmt.Path,
        Name = "aws-kms",
        KeyCollection = "us-west-2",
    });

    var awsDist = new Vault.KeyMgmt.DistributeKey("aws_dist", new()
    {
        Mount = keymgmt.Path,
        KmsName = aws.Name,
        KeyName = encryptionKey.Name,
        Purposes = new[]
        {
            "encrypt",
            "decrypt",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.keymgmt.AwsKms;
import com.pulumi.vault.keymgmt.AwsKmsArgs;
import com.pulumi.vault.keymgmt.DistributeKey;
import com.pulumi.vault.keymgmt.DistributeKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // When AWS credentials are configured via environment variables or IAM roles
        // on the Vault server, you can omit access_key and secret_key
        var aws = new AwsKms("aws", AwsKmsArgs.builder()
            .mount(keymgmt.path())
            .name("aws-kms")
            .keyCollection("us-west-2")
            .build());

        var awsDist = new DistributeKey("awsDist", DistributeKeyArgs.builder()
            .mount(keymgmt.path())
            .kmsName(aws.name())
            .keyName(encryptionKey.name())
            .purposes(            
                "encrypt",
                "decrypt")
            .build());

    }
}

    resources:
  # When AWS credentials are configured via environment variables or IAM roles
  # on the Vault server, you can omit access_key and secret_key
  aws:
    type: vault:keymgmt:AwsKms
    properties:
      mount: ${keymgmt.path}
      name: aws-kms
      keyCollection: us-west-2
  awsDist:
    type: vault:keymgmt:DistributeKey
    name: aws_dist
    properties:
      mount: ${keymgmt.path}
      kmsName: ${aws.name}
      keyName: ${encryptionKey.name}
      purposes:
        - encrypt
        - decrypt

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

# When AWS credentials are configured via environment variables or IAM roles
# on the Vault server, you can omit access_key and secret_key
resource "vault_keymgmt_awskms" "aws" {
  mount          = keymgmt.path
  name           = "aws-kms"
  key_collection = "us-west-2"
}
resource "vault_keymgmt_distributekey" "aws_dist" {
  mount    = keymgmt.path
  kms_name = vault_keymgmt_awskms.aws.name
  key_name = encryptionKey.name
  purposes = ["encrypt", "decrypt"]
}

    Distribute to Azure Key Vault

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const signingKey = new vault.keymgmt.Key("signing_key", {
    mount: keymgmt.path,
    name: "azure-signing-key",
    type: "rsa-2048",
});
const azure = new vault.keymgmt.AzureKms("azure", {
    mount: keymgmt.path,
    name: "azure-kv",
    keyCollection: "my-keyvault",
    credentialsWo: {
        tenant_id: azureTenantId,
        client_id: azureClientId,
        client_secret: azureClientSecret,
    },
    credentialsWoVersion: 1,
});
const azureDist = new vault.keymgmt.DistributeKey("azure_dist", {
    mount: keymgmt.path,
    kmsName: azure.name,
    keyName: signingKey.name,
    purposes: [
        "sign",
        "verify",
    ],
});

    import pulumi
import pulumi_vault as vault

signing_key = vault.keymgmt.Key("signing_key",
    mount=keymgmt["path"],
    name="azure-signing-key",
    type="rsa-2048")
azure = vault.keymgmt.AzureKms("azure",
    mount=keymgmt["path"],
    name="azure-kv",
    key_collection="my-keyvault",
    credentials_wo={
        "tenant_id": azure_tenant_id,
        "client_id": azure_client_id,
        "client_secret": azure_client_secret,
    },
    credentials_wo_version=1)
azure_dist = vault.keymgmt.DistributeKey("azure_dist",
    mount=keymgmt["path"],
    kms_name=azure.name,
    key_name=signing_key.name,
    purposes=[
        "sign",
        "verify",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		signingKey, err := keymgmt.NewKey(ctx, "signing_key", &keymgmt.KeyArgs{
			Mount: pulumi.Any(keymgmt.Path),
			Name:  pulumi.String("azure-signing-key"),
			Type:  pulumi.String("rsa-2048"),
		})
		if err != nil {
			return err
		}
		azure, err := keymgmt.NewAzureKms(ctx, "azure", &keymgmt.AzureKmsArgs{
			Mount:         pulumi.Any(keymgmt.Path),
			Name:          pulumi.String("azure-kv"),
			KeyCollection: pulumi.String("my-keyvault"),
			CredentialsWo: pulumi.StringMap{
				"tenant_id":     pulumi.Any(azureTenantId),
				"client_id":     pulumi.Any(azureClientId),
				"client_secret": pulumi.Any(azureClientSecret),
			},
			CredentialsWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewDistributeKey(ctx, "azure_dist", &keymgmt.DistributeKeyArgs{
			Mount:   pulumi.Any(keymgmt.Path),
			KmsName: azure.Name,
			KeyName: signingKey.Name,
			Purposes: pulumi.StringArray{
				pulumi.String("sign"),
				pulumi.String("verify"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var signingKey = new Vault.KeyMgmt.Key("signing_key", new()
    {
        Mount = keymgmt.Path,
        Name = "azure-signing-key",
        Type = "rsa-2048",
    });

    var azure = new Vault.KeyMgmt.AzureKms("azure", new()
    {
        Mount = keymgmt.Path,
        Name = "azure-kv",
        KeyCollection = "my-keyvault",
        CredentialsWo = 
        {
            { "tenant_id", azureTenantId },
            { "client_id", azureClientId },
            { "client_secret", azureClientSecret },
        },
        CredentialsWoVersion = 1,
    });

    var azureDist = new Vault.KeyMgmt.DistributeKey("azure_dist", new()
    {
        Mount = keymgmt.Path,
        KmsName = azure.Name,
        KeyName = signingKey.Name,
        Purposes = new[]
        {
            "sign",
            "verify",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.keymgmt.Key;
import com.pulumi.vault.keymgmt.KeyArgs;
import com.pulumi.vault.keymgmt.AzureKms;
import com.pulumi.vault.keymgmt.AzureKmsArgs;
import com.pulumi.vault.keymgmt.DistributeKey;
import com.pulumi.vault.keymgmt.DistributeKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var signingKey = new Key("signingKey", KeyArgs.builder()
            .mount(keymgmt.path())
            .name("azure-signing-key")
            .type("rsa-2048")
            .build());

        var azure = new AzureKms("azure", AzureKmsArgs.builder()
            .mount(keymgmt.path())
            .name("azure-kv")
            .keyCollection("my-keyvault")
            .credentialsWo(Map.ofEntries(
                Map.entry("tenant_id", azureTenantId),
                Map.entry("client_id", azureClientId),
                Map.entry("client_secret", azureClientSecret)
            ))
            .credentialsWoVersion(1)
            .build());

        var azureDist = new DistributeKey("azureDist", DistributeKeyArgs.builder()
            .mount(keymgmt.path())
            .kmsName(azure.name())
            .keyName(signingKey.name())
            .purposes(            
                "sign",
                "verify")
            .build());

    }
}

    resources:
  signingKey:
    type: vault:keymgmt:Key
    name: signing_key
    properties:
      mount: ${keymgmt.path}
      name: azure-signing-key
      type: rsa-2048
  azure:
    type: vault:keymgmt:AzureKms
    properties:
      mount: ${keymgmt.path}
      name: azure-kv
      keyCollection: my-keyvault
      credentialsWo:
        tenant_id: ${azureTenantId}
        client_id: ${azureClientId}
        client_secret: ${azureClientSecret}
      credentialsWoVersion: 1
  azureDist:
    type: vault:keymgmt:DistributeKey
    name: azure_dist
    properties:
      mount: ${keymgmt.path}
      kmsName: ${azure.name}
      keyName: ${signingKey.name}
      purposes:
        - sign
        - verify

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_keymgmt_key" "signing_key" {
  mount = keymgmt.path
  name  = "azure-signing-key"
  type  = "rsa-2048"
}
resource "vault_keymgmt_azurekms" "azure" {
  mount          = keymgmt.path
  name           = "azure-kv"
  key_collection = "my-keyvault"
  credentials_wo = {
    "tenant_id"     = azureTenantId
    "client_id"     = azureClientId
    "client_secret" = azureClientSecret
  }
  credentials_wo_version = 1
}
resource "vault_keymgmt_distributekey" "azure_dist" {
  mount    = keymgmt.path
  kms_name = vault_keymgmt_azurekms.azure.name
  key_name = vault_keymgmt_key.signing_key.name
  purposes = ["sign", "verify"]
}

    Distribute to GCP Cloud KMS

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const gcpKey = new vault.keymgmt.Key("gcp_key", {
    mount: keymgmt.path,
    name: "gcp-encryption-key",
    type: "aes256-gcm96",
});
const gcp = new vault.keymgmt.GcpKms("gcp", {
    mount: keymgmt.path,
    name: "gcp-kms",
    keyCollection: "projects/my-project/locations/us-central1/keyRings/my-keyring",
    credentialsWo: {
        service_account_file: std.file({
            input: "gcp-credentials.json",
        }).then(invoke => invoke.result),
        project: "my-project",
        location: "us-central1",
    },
    credentialsWoVersion: 1,
});
const gcpDist = new vault.keymgmt.DistributeKey("gcp_dist", {
    mount: keymgmt.path,
    kmsName: gcp.name,
    keyName: gcpKey.name,
    purposes: [
        "encrypt",
        "decrypt",
    ],
    protection: "software",
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

gcp_key = vault.keymgmt.Key("gcp_key",
    mount=keymgmt["path"],
    name="gcp-encryption-key",
    type="aes256-gcm96")
gcp = vault.keymgmt.GcpKms("gcp",
    mount=keymgmt["path"],
    name="gcp-kms",
    key_collection="projects/my-project/locations/us-central1/keyRings/my-keyring",
    credentials_wo={
        "service_account_file": std.file(input="gcp-credentials.json").result,
        "project": "my-project",
        "location": "us-central1",
    },
    credentials_wo_version=1)
gcp_dist = vault.keymgmt.DistributeKey("gcp_dist",
    mount=keymgmt["path"],
    kms_name=gcp.name,
    key_name=gcp_key.name,
    purposes=[
        "encrypt",
        "decrypt",
    ],
    protection="software")

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		gcpKey, err := keymgmt.NewKey(ctx, "gcp_key", &keymgmt.KeyArgs{
			Mount: pulumi.Any(keymgmt.Path),
			Name:  pulumi.String("gcp-encryption-key"),
			Type:  pulumi.String("aes256-gcm96"),
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "gcp-credentials.json",
		}, nil)
		if err != nil {
			return err
		}
		gcp, err := keymgmt.NewGcpKms(ctx, "gcp", &keymgmt.GcpKmsArgs{
			Mount:         pulumi.Any(keymgmt.Path),
			Name:          pulumi.String("gcp-kms"),
			KeyCollection: pulumi.String("projects/my-project/locations/us-central1/keyRings/my-keyring"),
			CredentialsWo: pulumi.StringMap{
				"service_account_file": pulumi.String(invokeFile.Result),
				"project":              pulumi.String("my-project"),
				"location":             pulumi.String("us-central1"),
			},
			CredentialsWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewDistributeKey(ctx, "gcp_dist", &keymgmt.DistributeKeyArgs{
			Mount:   pulumi.Any(keymgmt.Path),
			KmsName: gcp.Name,
			KeyName: gcpKey.Name,
			Purposes: pulumi.StringArray{
				pulumi.String("encrypt"),
				pulumi.String("decrypt"),
			},
			Protection: pulumi.String("software"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var gcpKey = new Vault.KeyMgmt.Key("gcp_key", new()
    {
        Mount = keymgmt.Path,
        Name = "gcp-encryption-key",
        Type = "aes256-gcm96",
    });

    var gcp = new Vault.KeyMgmt.GcpKms("gcp", new()
    {
        Mount = keymgmt.Path,
        Name = "gcp-kms",
        KeyCollection = "projects/my-project/locations/us-central1/keyRings/my-keyring",
        CredentialsWo = 
        {
            { "service_account_file", Std.File.Invoke(new()
            {
                Input = "gcp-credentials.json",
            }).Apply(invoke => invoke.Result) },
            { "project", "my-project" },
            { "location", "us-central1" },
        },
        CredentialsWoVersion = 1,
    });

    var gcpDist = new Vault.KeyMgmt.DistributeKey("gcp_dist", new()
    {
        Mount = keymgmt.Path,
        KmsName = gcp.Name,
        KeyName = gcpKey.Name,
        Purposes = new[]
        {
            "encrypt",
            "decrypt",
        },
        Protection = "software",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.keymgmt.Key;
import com.pulumi.vault.keymgmt.KeyArgs;
import com.pulumi.vault.keymgmt.GcpKms;
import com.pulumi.vault.keymgmt.GcpKmsArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import com.pulumi.vault.keymgmt.DistributeKey;
import com.pulumi.vault.keymgmt.DistributeKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var gcpKey = new Key("gcpKey", KeyArgs.builder()
            .mount(keymgmt.path())
            .name("gcp-encryption-key")
            .type("aes256-gcm96")
            .build());

        var gcp = new GcpKms("gcp", GcpKmsArgs.builder()
            .mount(keymgmt.path())
            .name("gcp-kms")
            .keyCollection("projects/my-project/locations/us-central1/keyRings/my-keyring")
            .credentialsWo(Map.ofEntries(
                Map.entry("service_account_file", StdFunctions.file(FileArgs.builder()
                    .input("gcp-credentials.json")
                    .build()).result()),
                Map.entry("project", "my-project"),
                Map.entry("location", "us-central1")
            ))
            .credentialsWoVersion(1)
            .build());

        var gcpDist = new DistributeKey("gcpDist", DistributeKeyArgs.builder()
            .mount(keymgmt.path())
            .kmsName(gcp.name())
            .keyName(gcpKey.name())
            .purposes(            
                "encrypt",
                "decrypt")
            .protection("software")
            .build());

    }
}

    resources:
  gcpKey:
    type: vault:keymgmt:Key
    name: gcp_key
    properties:
      mount: ${keymgmt.path}
      name: gcp-encryption-key
      type: aes256-gcm96
  gcp:
    type: vault:keymgmt:GcpKms
    properties:
      mount: ${keymgmt.path}
      name: gcp-kms
      keyCollection: projects/my-project/locations/us-central1/keyRings/my-keyring
      credentialsWo:
        service_account_file:
          fn::invoke:
            function: std:file
            arguments:
              input: gcp-credentials.json
            return: result
        project: my-project
        location: us-central1
      credentialsWoVersion: 1
  gcpDist:
    type: vault:keymgmt:DistributeKey
    name: gcp_dist
    properties:
      mount: ${keymgmt.path}
      kmsName: ${gcp.name}
      keyName: ${gcpKey.name}
      purposes:
        - encrypt
        - decrypt
      protection: software

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_keymgmt_key" "gcp_key" {
  mount = keymgmt.path
  name  = "gcp-encryption-key"
  type  = "aes256-gcm96"
}
resource "vault_keymgmt_gcpkms" "gcp" {
  mount          = keymgmt.path
  name           = "gcp-kms"
  key_collection = "projects/my-project/locations/us-central1/keyRings/my-keyring"
  credentials_wo = {
    "service_account_file" = file("gcp-credentials.json")
    "project"              = "my-project"
    "location"             = "us-central1"
  }
  credentials_wo_version = 1
}
resource "vault_keymgmt_distributekey" "gcp_dist" {
  mount      = keymgmt.path
  kms_name   = vault_keymgmt_gcpkms.gcp.name
  key_name   = vault_keymgmt_key.gcp_key.name
  purposes   = ["encrypt", "decrypt"]
  protection = "software"
}

    Create DistributeKey Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new DistributeKey(name: string, args: DistributeKeyArgs, opts?: CustomResourceOptions);
    @overload
def DistributeKey(resource_name: str,
                  args: DistributeKeyArgs,
                  opts: Optional[ResourceOptions] = None)

@overload
def DistributeKey(resource_name: str,
                  opts: Optional[ResourceOptions] = None,
                  key_name: Optional[str] = None,
                  kms_name: Optional[str] = None,
                  mount: Optional[str] = None,
                  purposes: Optional[Sequence[str]] = None,
                  namespace: Optional[str] = None,
                  protection: Optional[str] = None)
    func NewDistributeKey(ctx *Context, name string, args DistributeKeyArgs, opts ...ResourceOption) (*DistributeKey, error)
    public DistributeKey(string name, DistributeKeyArgs args, CustomResourceOptions? opts = null)
    public DistributeKey(String name, DistributeKeyArgs args)
public DistributeKey(String name, DistributeKeyArgs args, CustomResourceOptions options)

    type: vault:keymgmt:DistributeKey
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_keymgmt_distribute_key" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args DistributeKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args DistributeKeyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args DistributeKeyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args DistributeKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args DistributeKeyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var distributeKeyResource = new Vault.KeyMgmt.DistributeKey("distributeKeyResource", new()
{
    KeyName = "string",
    KmsName = "string",
    Mount = "string",
    Purposes = new[]
    {
        "string",
    },
    Namespace = "string",
    Protection = "string",
});

    example, err := keymgmt.NewDistributeKey(ctx, "distributeKeyResource", &keymgmt.DistributeKeyArgs{
	KeyName: pulumi.String("string"),
	KmsName: pulumi.String("string"),
	Mount:   pulumi.String("string"),
	Purposes: pulumi.StringArray{
		pulumi.String("string"),
	},
	Namespace:  pulumi.String("string"),
	Protection: pulumi.String("string"),
})

    resource "vault_keymgmt_distribute_key" "distributeKeyResource" {
  lifecycle {
    create_before_destroy = true
  }
  key_name   = "string"
  kms_name   = "string"
  mount      = "string"
  purposes   = ["string"]
  namespace  = "string"
  protection = "string"
}

    var distributeKeyResource = new DistributeKey("distributeKeyResource", DistributeKeyArgs.builder()
    .keyName("string")
    .kmsName("string")
    .mount("string")
    .purposes("string")
    .namespace("string")
    .protection("string")
    .build());

    distribute_key_resource = vault.keymgmt.DistributeKey("distributeKeyResource",
    key_name="string",
    kms_name="string",
    mount="string",
    purposes=["string"],
    namespace="string",
    protection="string")

    const distributeKeyResource = new vault.keymgmt.DistributeKey("distributeKeyResource", {
    keyName: "string",
    kmsName: "string",
    mount: "string",
    purposes: ["string"],
    namespace: "string",
    protection: "string",
});

    type: vault:keymgmt:DistributeKey
properties:
    keyName: string
    kmsName: string
    mount: string
    namespace: string
    protection: string
    purposes:
        - string

    DistributeKey Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The DistributeKey resource accepts the following input properties:

    KeyName string
    Specifies the name of the key to distribute to the given KMS provider.
    KmsName string
    Specifies the name of the KMS provider to distribute the given key to.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Purposes List<string>
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Protection string
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    KeyName string
    Specifies the name of the key to distribute to the given KMS provider.
    KmsName string
    Specifies the name of the KMS provider to distribute the given key to.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Purposes []string
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Protection string
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    key_name string
    Specifies the name of the key to distribute to the given KMS provider.
    kms_name string
    Specifies the name of the KMS provider to distribute the given key to.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    purposes list(string)
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection string
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    keyName String
    Specifies the name of the key to distribute to the given KMS provider.
    kmsName String
    Specifies the name of the KMS provider to distribute the given key to.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    purposes List<String>
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection String
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    keyName string
    Specifies the name of the key to distribute to the given KMS provider.
    kmsName string
    Specifies the name of the KMS provider to distribute the given key to.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    purposes string[]
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection string
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    key_name str
    Specifies the name of the key to distribute to the given KMS provider.
    kms_name str
    Specifies the name of the KMS provider to distribute the given key to.
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    purposes Sequence[str]
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection str
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    keyName String
    Specifies the name of the key to distribute to the given KMS provider.
    kmsName String
    Specifies the name of the KMS provider to distribute the given key to.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    purposes List<String>
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection String
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the DistributeKey resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Versions Dictionary<string, string>
    Map of distributed key versions to their identifiers in the KMS provider.
    Id string
    The provider-assigned unique ID for this managed resource.
    Versions map[string]string
    Map of distributed key versions to their identifiers in the KMS provider.
    id string
    The provider-assigned unique ID for this managed resource.
    versions map(string)
    Map of distributed key versions to their identifiers in the KMS provider.
    id String
    The provider-assigned unique ID for this managed resource.
    versions Map<String,String>
    Map of distributed key versions to their identifiers in the KMS provider.
    id string
    The provider-assigned unique ID for this managed resource.
    versions {[key: string]: string}
    Map of distributed key versions to their identifiers in the KMS provider.
    id str
    The provider-assigned unique ID for this managed resource.
    versions Mapping[str, str]
    Map of distributed key versions to their identifiers in the KMS provider.
    id String
    The provider-assigned unique ID for this managed resource.
    versions Map<String>
    Map of distributed key versions to their identifiers in the KMS provider.

    Look up Existing DistributeKey Resource

    Get an existing DistributeKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: DistributeKeyState, opts?: CustomResourceOptions): DistributeKey
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        key_name: Optional[str] = None,
        kms_name: Optional[str] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        protection: Optional[str] = None,
        purposes: Optional[Sequence[str]] = None,
        versions: Optional[Mapping[str, str]] = None) -> DistributeKey
    func GetDistributeKey(ctx *Context, name string, id IDInput, state *DistributeKeyState, opts ...ResourceOption) (*DistributeKey, error)
    public static DistributeKey Get(string name, Input<string> id, DistributeKeyState? state, CustomResourceOptions? opts = null)
    public static DistributeKey get(String name, Output<String> id, DistributeKeyState state, CustomResourceOptions options)
    resources:  _:    type: vault:keymgmt:DistributeKey    get:      id: ${id}
    import {
  to = vault_keymgmt_distribute_key.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    KeyName string
    Specifies the name of the key to distribute to the given KMS provider.
    KmsName string
    Specifies the name of the KMS provider to distribute the given key to.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Protection string
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    Purposes List<string>
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    Versions Dictionary<string, string>
    Map of distributed key versions to their identifiers in the KMS provider.
    KeyName string
    Specifies the name of the key to distribute to the given KMS provider.
    KmsName string
    Specifies the name of the KMS provider to distribute the given key to.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Protection string
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    Purposes []string
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    Versions map[string]string
    Map of distributed key versions to their identifiers in the KMS provider.
    key_name string
    Specifies the name of the key to distribute to the given KMS provider.
    kms_name string
    Specifies the name of the KMS provider to distribute the given key to.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection string
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    purposes list(string)
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    versions map(string)
    Map of distributed key versions to their identifiers in the KMS provider.
    keyName String
    Specifies the name of the key to distribute to the given KMS provider.
    kmsName String
    Specifies the name of the KMS provider to distribute the given key to.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection String
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    purposes List<String>
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    versions Map<String,String>
    Map of distributed key versions to their identifiers in the KMS provider.
    keyName string
    Specifies the name of the key to distribute to the given KMS provider.
    kmsName string
    Specifies the name of the KMS provider to distribute the given key to.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection string
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    purposes string[]
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    versions {[key: string]: string}
    Map of distributed key versions to their identifiers in the KMS provider.
    key_name str
    Specifies the name of the key to distribute to the given KMS provider.
    kms_name str
    Specifies the name of the KMS provider to distribute the given key to.
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection str
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    purposes Sequence[str]
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    versions Mapping[str, str]
    Map of distributed key versions to their identifiers in the KMS provider.
    keyName String
    Specifies the name of the key to distribute to the given KMS provider.
    kmsName String
    Specifies the name of the KMS provider to distribute the given key to.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection String
    Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: hsm, software. Defaults to hsm.
    purposes List<String>
    Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.
    versions Map<String>
    Map of distributed key versions to their identifiers in the KMS provider.

    Import

    Key distributions can be imported using the format {path}/kms/{kms_name}/key/{key_name}, e.g.

    $ pulumi import vault:keymgmt/distributeKey:DistributeKey aws_dist keymgmt/kms/aws-kms/key/aws-encryption-key

    Note: When importing, the purpose and protection fields are not returned by the Vault API and will not be populated in state. Both fields carry Forces new resource, so a missing or mismatched value will trigger a destroy+recreate on the next pulumi up. Always set purpose (and protection if not using the default hsm) explicitly in your configuration after import.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial