Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. keymgmt
  6. Key
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.keymgmt.Key

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages keys in the Vault Key Management secrets engine. This resource creates and manages cryptographic keys that can be distributed to external Key Management Services (KMS).

    Keys created with this resource can be distributed to AWS KMS, Azure Key Vault, or GCP Cloud KMS using the appropriate distribution resources.

    Important All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform, and will appear in the console output when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.

    For more information on Key Management in Vault, please refer to the Vault documentation.

    Note this feature is available only with Vault Enterprise.

    Example Usage

    Basic Symmetric Key

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const keymgmt = new vault.Mount("keymgmt", {
    path: "keymgmt",
    type: "keymgmt",
});
const aesKey = new vault.keymgmt.Key("aes_key", {
    mount: keymgmt.path,
    name: "aes-encryption-key",
    type: "aes256-gcm96",
});

    import pulumi
import pulumi_vault as vault

keymgmt = vault.Mount("keymgmt",
    path="keymgmt",
    type="keymgmt")
aes_key = vault.keymgmt.Key("aes_key",
    mount=keymgmt.path,
    name="aes-encryption-key",
    type="aes256-gcm96")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keymgmt2, err := vault.NewMount(ctx, "keymgmt", &vault.MountArgs{
			Path: pulumi.String("keymgmt"),
			Type: pulumi.String("keymgmt"),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewKey(ctx, "aes_key", &keymgmt.KeyArgs{
			Mount: keymgmt2.Path,
			Name:  pulumi.String("aes-encryption-key"),
			Type:  pulumi.String("aes256-gcm96"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var keymgmt = new Vault.Mount("keymgmt", new()
    {
        Path = "keymgmt",
        Type = "keymgmt",
    });

    var aesKey = new Vault.KeyMgmt.Key("aes_key", new()
    {
        Mount = keymgmt.Path,
        Name = "aes-encryption-key",
        Type = "aes256-gcm96",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.keymgmt.Key;
import com.pulumi.vault.keymgmt.KeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keymgmt = new Mount("keymgmt", MountArgs.builder()
            .path("keymgmt")
            .type("keymgmt")
            .build());

        var aesKey = new Key("aesKey", KeyArgs.builder()
            .mount(keymgmt.path())
            .name("aes-encryption-key")
            .type("aes256-gcm96")
            .build());

    }
}

    resources:
  keymgmt:
    type: vault:Mount
    properties:
      path: keymgmt
      type: keymgmt
  aesKey:
    type: vault:keymgmt:Key
    name: aes_key
    properties:
      mount: ${keymgmt.path}
      name: aes-encryption-key
      type: aes256-gcm96

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "keymgmt" {
  path = "keymgmt"
  type = "keymgmt"
}
resource "vault_keymgmt_key" "aes_key" {
  mount = vault_mount.keymgmt.path
  name  = "aes-encryption-key"
  type  = "aes256-gcm96"
}

    Default RSA Key (type omitted)

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const defaultKey = new vault.keymgmt.Key("default_key", {
    mount: keymgmt.path,
    name: "my-key",
});

    import pulumi
import pulumi_vault as vault

default_key = vault.keymgmt.Key("default_key",
    mount=keymgmt["path"],
    name="my-key")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keymgmt.NewKey(ctx, "default_key", &keymgmt.KeyArgs{
			Mount: pulumi.Any(keymgmt.Path),
			Name:  pulumi.String("my-key"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var defaultKey = new Vault.KeyMgmt.Key("default_key", new()
    {
        Mount = keymgmt.Path,
        Name = "my-key",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.keymgmt.Key;
import com.pulumi.vault.keymgmt.KeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var defaultKey = new Key("defaultKey", KeyArgs.builder()
            .mount(keymgmt.path())
            .name("my-key")
            .build());

    }
}

    resources:
  defaultKey:
    type: vault:keymgmt:Key
    name: default_key
    properties:
      mount: ${keymgmt.path}
      name: my-key

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_keymgmt_key" "default_key" {
  mount = keymgmt.path
  name  = "my-key"
}

    RSA Key with Deletion Protection

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const rsaKey = new vault.keymgmt.Key("rsa_key", {
    mount: keymgmt.path,
    name: "rsa-signing-key",
    deletionAllowed: false,
});

    import pulumi
import pulumi_vault as vault

rsa_key = vault.keymgmt.Key("rsa_key",
    mount=keymgmt["path"],
    name="rsa-signing-key",
    deletion_allowed=False)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keymgmt.NewKey(ctx, "rsa_key", &keymgmt.KeyArgs{
			Mount:           pulumi.Any(keymgmt.Path),
			Name:            pulumi.String("rsa-signing-key"),
			DeletionAllowed: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var rsaKey = new Vault.KeyMgmt.Key("rsa_key", new()
    {
        Mount = keymgmt.Path,
        Name = "rsa-signing-key",
        DeletionAllowed = false,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.keymgmt.Key;
import com.pulumi.vault.keymgmt.KeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var rsaKey = new Key("rsaKey", KeyArgs.builder()
            .mount(keymgmt.path())
            .name("rsa-signing-key")
            .deletionAllowed(false)
            .build());

    }
}

    resources:
  rsaKey:
    type: vault:keymgmt:Key
    name: rsa_key
    properties:
      mount: ${keymgmt.path}
      name: rsa-signing-key
      deletionAllowed: false

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_keymgmt_key" "rsa_key" {
  mount            = keymgmt.path
  name             = "rsa-signing-key"
  deletion_allowed = false
}

    Key with Minimum Enabled Version

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const versionedKey = new vault.keymgmt.Key("versioned_key", {
    mount: keymgmt.path,
    name: "versioned-key",
    type: "aes256-gcm96",
    minEnabledVersion: 2,
});

    import pulumi
import pulumi_vault as vault

versioned_key = vault.keymgmt.Key("versioned_key",
    mount=keymgmt["path"],
    name="versioned-key",
    type="aes256-gcm96",
    min_enabled_version=2)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keymgmt.NewKey(ctx, "versioned_key", &keymgmt.KeyArgs{
			Mount:             pulumi.Any(keymgmt.Path),
			Name:              pulumi.String("versioned-key"),
			Type:              pulumi.String("aes256-gcm96"),
			MinEnabledVersion: pulumi.Int(2),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var versionedKey = new Vault.KeyMgmt.Key("versioned_key", new()
    {
        Mount = keymgmt.Path,
        Name = "versioned-key",
        Type = "aes256-gcm96",
        MinEnabledVersion = 2,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.keymgmt.Key;
import com.pulumi.vault.keymgmt.KeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var versionedKey = new Key("versionedKey", KeyArgs.builder()
            .mount(keymgmt.path())
            .name("versioned-key")
            .type("aes256-gcm96")
            .minEnabledVersion(2)
            .build());

    }
}

    resources:
  versionedKey:
    type: vault:keymgmt:Key
    name: versioned_key
    properties:
      mount: ${keymgmt.path}
      name: versioned-key
      type: aes256-gcm96
      minEnabledVersion: 2

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_keymgmt_key" "versioned_key" {
  mount               = keymgmt.path
  name                = "versioned-key"
  type                = "aes256-gcm96"
  min_enabled_version = 2
}

    Key with Replication to Multiple Regions

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const replicatedKey = new vault.keymgmt.Key("replicated_key", {
    mount: keymgmt.path,
    name: "multi-region-key",
    type: "aes256-gcm96",
    replicaRegions: [
        "us-west-1",
        "us-east-1",
        "eu-west-1",
    ],
});

    import pulumi
import pulumi_vault as vault

replicated_key = vault.keymgmt.Key("replicated_key",
    mount=keymgmt["path"],
    name="multi-region-key",
    type="aes256-gcm96",
    replica_regions=[
        "us-west-1",
        "us-east-1",
        "eu-west-1",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keymgmt.NewKey(ctx, "replicated_key", &keymgmt.KeyArgs{
			Mount: pulumi.Any(keymgmt.Path),
			Name:  pulumi.String("multi-region-key"),
			Type:  pulumi.String("aes256-gcm96"),
			ReplicaRegions: pulumi.StringArray{
				pulumi.String("us-west-1"),
				pulumi.String("us-east-1"),
				pulumi.String("eu-west-1"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var replicatedKey = new Vault.KeyMgmt.Key("replicated_key", new()
    {
        Mount = keymgmt.Path,
        Name = "multi-region-key",
        Type = "aes256-gcm96",
        ReplicaRegions = new[]
        {
            "us-west-1",
            "us-east-1",
            "eu-west-1",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.keymgmt.Key;
import com.pulumi.vault.keymgmt.KeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var replicatedKey = new Key("replicatedKey", KeyArgs.builder()
            .mount(keymgmt.path())
            .name("multi-region-key")
            .type("aes256-gcm96")
            .replicaRegions(            
                "us-west-1",
                "us-east-1",
                "eu-west-1")
            .build());

    }
}

    resources:
  replicatedKey:
    type: vault:keymgmt:Key
    name: replicated_key
    properties:
      mount: ${keymgmt.path}
      name: multi-region-key
      type: aes256-gcm96
      replicaRegions:
        - us-west-1
        - us-east-1
        - eu-west-1

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_keymgmt_key" "replicated_key" {
  mount           = keymgmt.path
  name            = "multi-region-key"
  type            = "aes256-gcm96"
  replica_regions = ["us-west-1", "us-east-1", "eu-west-1"]
}

    Create Key Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Key(name: string, args: KeyArgs, opts?: CustomResourceOptions);
    @overload
def Key(resource_name: str,
        args: KeyArgs,
        opts: Optional[ResourceOptions] = None)

@overload
def Key(resource_name: str,
        opts: Optional[ResourceOptions] = None,
        mount: Optional[str] = None,
        deletion_allowed: Optional[bool] = None,
        min_enabled_version: Optional[int] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        replica_regions: Optional[Sequence[str]] = None,
        type: Optional[str] = None)
    func NewKey(ctx *Context, name string, args KeyArgs, opts ...ResourceOption) (*Key, error)
    public Key(string name, KeyArgs args, CustomResourceOptions? opts = null)
    public Key(String name, KeyArgs args)
public Key(String name, KeyArgs args, CustomResourceOptions options)

    type: vault:keymgmt:Key
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_keymgmt_key" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KeyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KeyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KeyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var keyResource = new Vault.KeyMgmt.Key("keyResource", new()
{
    Mount = "string",
    DeletionAllowed = false,
    MinEnabledVersion = 0,
    Name = "string",
    Namespace = "string",
    ReplicaRegions = new[]
    {
        "string",
    },
    Type = "string",
});

    example, err := keymgmt.NewKey(ctx, "keyResource", &keymgmt.KeyArgs{
	Mount:             pulumi.String("string"),
	DeletionAllowed:   pulumi.Bool(false),
	MinEnabledVersion: pulumi.Int(0),
	Name:              pulumi.String("string"),
	Namespace:         pulumi.String("string"),
	ReplicaRegions: pulumi.StringArray{
		pulumi.String("string"),
	},
	Type: pulumi.String("string"),
})

    resource "vault_keymgmt_key" "keyResource" {
  lifecycle {
    create_before_destroy = true
  }
  mount               = "string"
  deletion_allowed    = false
  min_enabled_version = 0
  name                = "string"
  namespace           = "string"
  replica_regions     = ["string"]
  type                = "string"
}

    var keyResource = new Key("keyResource", KeyArgs.builder()
    .mount("string")
    .deletionAllowed(false)
    .minEnabledVersion(0)
    .name("string")
    .namespace("string")
    .replicaRegions("string")
    .type("string")
    .build());

    key_resource = vault.keymgmt.Key("keyResource",
    mount="string",
    deletion_allowed=False,
    min_enabled_version=0,
    name="string",
    namespace="string",
    replica_regions=["string"],
    type="string")

    const keyResource = new vault.keymgmt.Key("keyResource", {
    mount: "string",
    deletionAllowed: false,
    minEnabledVersion: 0,
    name: "string",
    namespace: "string",
    replicaRegions: ["string"],
    type: "string",
});

    type: vault:keymgmt:Key
properties:
    deletionAllowed: false
    minEnabledVersion: 0
    mount: string
    name: string
    namespace: string
    replicaRegions:
        - string
    type: string

    Key Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Key resource accepts the following input properties:

    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    DeletionAllowed bool
    Specifies if the key is allowed to be deleted.
    MinEnabledVersion int
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    Name string
    Specifies the name of the key to create.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ReplicaRegions List<string>
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    Type string
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    DeletionAllowed bool
    Specifies if the key is allowed to be deleted.
    MinEnabledVersion int
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    Name string
    Specifies the name of the key to create.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ReplicaRegions []string
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    Type string
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    deletion_allowed bool
    Specifies if the key is allowed to be deleted.
    min_enabled_version number
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    name string
    Specifies the name of the key to create.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replica_regions list(string)
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type string
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    deletionAllowed Boolean
    Specifies if the key is allowed to be deleted.
    minEnabledVersion Integer
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    name String
    Specifies the name of the key to create.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replicaRegions List<String>
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type String
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    deletionAllowed boolean
    Specifies if the key is allowed to be deleted.
    minEnabledVersion number
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    name string
    Specifies the name of the key to create.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replicaRegions string[]
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type string
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    deletion_allowed bool
    Specifies if the key is allowed to be deleted.
    min_enabled_version int
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    name str
    Specifies the name of the key to create.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replica_regions Sequence[str]
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type str
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    deletionAllowed Boolean
    Specifies if the key is allowed to be deleted.
    minEnabledVersion Number
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    name String
    Specifies the name of the key to create.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replicaRegions List<String>
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type String
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Key resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    LatestVersion int
    Specifies the latest version of the key.
    Id string
    The provider-assigned unique ID for this managed resource.
    LatestVersion int
    Specifies the latest version of the key.
    id string
    The provider-assigned unique ID for this managed resource.
    latest_version number
    Specifies the latest version of the key.
    id String
    The provider-assigned unique ID for this managed resource.
    latestVersion Integer
    Specifies the latest version of the key.
    id string
    The provider-assigned unique ID for this managed resource.
    latestVersion number
    Specifies the latest version of the key.
    id str
    The provider-assigned unique ID for this managed resource.
    latest_version int
    Specifies the latest version of the key.
    id String
    The provider-assigned unique ID for this managed resource.
    latestVersion Number
    Specifies the latest version of the key.

    Look up Existing Key Resource

    Get an existing Key resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KeyState, opts?: CustomResourceOptions): Key
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        deletion_allowed: Optional[bool] = None,
        latest_version: Optional[int] = None,
        min_enabled_version: Optional[int] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        replica_regions: Optional[Sequence[str]] = None,
        type: Optional[str] = None) -> Key
    func GetKey(ctx *Context, name string, id IDInput, state *KeyState, opts ...ResourceOption) (*Key, error)
    public static Key Get(string name, Input<string> id, KeyState? state, CustomResourceOptions? opts = null)
    public static Key get(String name, Output<String> id, KeyState state, CustomResourceOptions options)
    resources:  _:    type: vault:keymgmt:Key    get:      id: ${id}
    import {
  to = vault_keymgmt_key.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    DeletionAllowed bool
    Specifies if the key is allowed to be deleted.
    LatestVersion int
    Specifies the latest version of the key.
    MinEnabledVersion int
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Name string
    Specifies the name of the key to create.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ReplicaRegions List<string>
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    Type string
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    DeletionAllowed bool
    Specifies if the key is allowed to be deleted.
    LatestVersion int
    Specifies the latest version of the key.
    MinEnabledVersion int
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Name string
    Specifies the name of the key to create.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ReplicaRegions []string
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    Type string
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    deletion_allowed bool
    Specifies if the key is allowed to be deleted.
    latest_version number
    Specifies the latest version of the key.
    min_enabled_version number
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name string
    Specifies the name of the key to create.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replica_regions list(string)
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type string
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    deletionAllowed Boolean
    Specifies if the key is allowed to be deleted.
    latestVersion Integer
    Specifies the latest version of the key.
    minEnabledVersion Integer
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name String
    Specifies the name of the key to create.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replicaRegions List<String>
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type String
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    deletionAllowed boolean
    Specifies if the key is allowed to be deleted.
    latestVersion number
    Specifies the latest version of the key.
    minEnabledVersion number
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name string
    Specifies the name of the key to create.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replicaRegions string[]
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type string
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    deletion_allowed bool
    Specifies if the key is allowed to be deleted.
    latest_version int
    Specifies the latest version of the key.
    min_enabled_version int
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name str
    Specifies the name of the key to create.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replica_regions Sequence[str]
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type str
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)
    deletionAllowed Boolean
    Specifies if the key is allowed to be deleted.
    latestVersion Number
    Specifies the latest version of the key.
    minEnabledVersion Number
    Specifies the minimum enabled version of the key. All versions of the key less than the specified version will be disabled for cryptographic operations in the KMS provider that the key has been distributed to. Setting this value to 0 means that all versions will be enabled.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name String
    Specifies the name of the key to create.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    replicaRegions List<String>
    Specifies the regions in which the key should be replicated. Supported only for AWS KMS.
    type String
    Specifies the type of cryptographic key to create. Defaults to rsa-2048. The following key types are supported:

    • aes256-gcm96 - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
    • rsa-2048 - RSA with bit size of 2048 (asymmetric) (default)
    • rsa-3072 - RSA with bit size of 3072 (asymmetric)
    • rsa-4096 - RSA with bit size of 4096 (asymmetric)
    • ecdsa-p256 - ECDSA using the P-256 elliptic curve (asymmetric)
    • ecdsa-p384 - ECDSA using the P-384 elliptic curve (asymmetric)
    • ecdsa-p521 - ECDSA using the P-521 elliptic curve (asymmetric)

    Import

    Key Management keys can be imported using the format {path}/key/{name}, e.g.

    $ pulumi import vault:keymgmt/key:Key aes_key keymgmt/key/aes-encryption-key

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial