Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. kmip
  6. SecretCaImported
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.kmip.SecretCaImported

vault logo vault logo
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages imported KMIP Secret CAs in a Vault server. This resource imports an existing CA certificate. This feature requires Vault Enterprise. See the Vault documentation for more information.

    Example Usage

    Import CA with Named Scope and Role

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const _default = new vault.kmip.SecretBackend("default", {
    path: "kmip",
    description: "Vault KMIP backend",
});
const named = new vault.kmip.SecretCaImported("named", {
    path: _default.path,
    name: "imported-ca",
    caPem: std.file({
        input: "path/to/ca-certificate.pem",
    }).then(invoke => invoke.result),
    scopeName: "production",
    roleName: "admin",
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

default = vault.kmip.SecretBackend("default",
    path="kmip",
    description="Vault KMIP backend")
named = vault.kmip.SecretCaImported("named",
    path=default.path,
    name="imported-ca",
    ca_pem=std.file(input="path/to/ca-certificate.pem").result,
    scope_name="production",
    role_name="admin")

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_default, err := kmip.NewSecretBackend(ctx, "default", &kmip.SecretBackendArgs{
			Path:        pulumi.String("kmip"),
			Description: pulumi.String("Vault KMIP backend"),
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "path/to/ca-certificate.pem",
		}, nil)
		if err != nil {
			return err
		}
		_, err = kmip.NewSecretCaImported(ctx, "named", &kmip.SecretCaImportedArgs{
			Path:      _default.Path,
			Name:      pulumi.String("imported-ca"),
			CaPem:     pulumi.String(invokeFile.Result),
			ScopeName: pulumi.String("production"),
			RoleName:  pulumi.String("admin"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var @default = new Vault.Kmip.SecretBackend("default", new()
    {
        Path = "kmip",
        Description = "Vault KMIP backend",
    });

    var named = new Vault.Kmip.SecretCaImported("named", new()
    {
        Path = @default.Path,
        Name = "imported-ca",
        CaPem = Std.File.Invoke(new()
        {
            Input = "path/to/ca-certificate.pem",
        }).Apply(invoke => invoke.Result),
        ScopeName = "production",
        RoleName = "admin",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.kmip.SecretBackend;
import com.pulumi.vault.kmip.SecretBackendArgs;
import com.pulumi.vault.kmip.SecretCaImported;
import com.pulumi.vault.kmip.SecretCaImportedArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var default_ = new SecretBackend("default", SecretBackendArgs.builder()
            .path("kmip")
            .description("Vault KMIP backend")
            .build());

        var named = new SecretCaImported("named", SecretCaImportedArgs.builder()
            .path(default_.path())
            .name("imported-ca")
            .caPem(StdFunctions.file(FileArgs.builder()
                .input("path/to/ca-certificate.pem")
                .build()).result())
            .scopeName("production")
            .roleName("admin")
            .build());

    }
}

    resources:
  default:
    type: vault:kmip:SecretBackend
    properties:
      path: kmip
      description: Vault KMIP backend
  named:
    type: vault:kmip:SecretCaImported
    properties:
      path: ${default.path}
      name: imported-ca
      caPem:
        fn::invoke:
          function: std:file
          arguments:
            input: path/to/ca-certificate.pem
          return: result
      scopeName: production
      roleName: admin

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_kmip_secretbackend" "default" {
  path        = "kmip"
  description = "Vault KMIP backend"
}
resource "vault_kmip_secretcaimported" "named" {
  path       = vault_kmip_secretbackend.default.path
  name       = "imported-ca"
  ca_pem     = file("path/to/ca-certificate.pem")
  scope_name = "production"
  role_name  = "admin"
}

    Import CA with Field-Based Mapping

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const _default = new vault.kmip.SecretBackend("default", {
    path: "kmip",
    description: "Vault KMIP backend",
});
const fieldBased = new vault.kmip.SecretCaImported("field_based", {
    path: _default.path,
    name: "imported-ca-fields",
    caPem: std.file({
        input: "path/to/ca-certificate.pem",
    }).then(invoke => invoke.result),
    scopeField: "O",
    roleField: "OU",
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

default = vault.kmip.SecretBackend("default",
    path="kmip",
    description="Vault KMIP backend")
field_based = vault.kmip.SecretCaImported("field_based",
    path=default.path,
    name="imported-ca-fields",
    ca_pem=std.file(input="path/to/ca-certificate.pem").result,
    scope_field="O",
    role_field="OU")

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_default, err := kmip.NewSecretBackend(ctx, "default", &kmip.SecretBackendArgs{
			Path:        pulumi.String("kmip"),
			Description: pulumi.String("Vault KMIP backend"),
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "path/to/ca-certificate.pem",
		}, nil)
		if err != nil {
			return err
		}
		_, err = kmip.NewSecretCaImported(ctx, "field_based", &kmip.SecretCaImportedArgs{
			Path:       _default.Path,
			Name:       pulumi.String("imported-ca-fields"),
			CaPem:      pulumi.String(invokeFile.Result),
			ScopeField: pulumi.String("O"),
			RoleField:  pulumi.String("OU"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var @default = new Vault.Kmip.SecretBackend("default", new()
    {
        Path = "kmip",
        Description = "Vault KMIP backend",
    });

    var fieldBased = new Vault.Kmip.SecretCaImported("field_based", new()
    {
        Path = @default.Path,
        Name = "imported-ca-fields",
        CaPem = Std.File.Invoke(new()
        {
            Input = "path/to/ca-certificate.pem",
        }).Apply(invoke => invoke.Result),
        ScopeField = "O",
        RoleField = "OU",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.kmip.SecretBackend;
import com.pulumi.vault.kmip.SecretBackendArgs;
import com.pulumi.vault.kmip.SecretCaImported;
import com.pulumi.vault.kmip.SecretCaImportedArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var default_ = new SecretBackend("default", SecretBackendArgs.builder()
            .path("kmip")
            .description("Vault KMIP backend")
            .build());

        var fieldBased = new SecretCaImported("fieldBased", SecretCaImportedArgs.builder()
            .path(default_.path())
            .name("imported-ca-fields")
            .caPem(StdFunctions.file(FileArgs.builder()
                .input("path/to/ca-certificate.pem")
                .build()).result())
            .scopeField("O")
            .roleField("OU")
            .build());

    }
}

    resources:
  default:
    type: vault:kmip:SecretBackend
    properties:
      path: kmip
      description: Vault KMIP backend
  fieldBased:
    type: vault:kmip:SecretCaImported
    name: field_based
    properties:
      path: ${default.path}
      name: imported-ca-fields
      caPem:
        fn::invoke:
          function: std:file
          arguments:
            input: path/to/ca-certificate.pem
          return: result
      scopeField: O
      roleField: OU

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_kmip_secretbackend" "default" {
  path        = "kmip"
  description = "Vault KMIP backend"
}
resource "vault_kmip_secretcaimported" "field_based" {
  path        = vault_kmip_secretbackend.default.path
  name        = "imported-ca-fields"
  ca_pem      = file("path/to/ca-certificate.pem")
  scope_field = "O"
  role_field  = "OU"
}

    Import CA with Mixed Mapping

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const _default = new vault.kmip.SecretBackend("default", {
    path: "kmip",
    description: "Vault KMIP backend",
});
const mixed = new vault.kmip.SecretCaImported("mixed", {
    path: _default.path,
    name: "imported-ca-mixed",
    caPem: std.file({
        input: "path/to/ca-certificate.pem",
    }).then(invoke => invoke.result),
    scopeName: "production",
    roleField: "CN",
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

default = vault.kmip.SecretBackend("default",
    path="kmip",
    description="Vault KMIP backend")
mixed = vault.kmip.SecretCaImported("mixed",
    path=default.path,
    name="imported-ca-mixed",
    ca_pem=std.file(input="path/to/ca-certificate.pem").result,
    scope_name="production",
    role_field="CN")

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_default, err := kmip.NewSecretBackend(ctx, "default", &kmip.SecretBackendArgs{
			Path:        pulumi.String("kmip"),
			Description: pulumi.String("Vault KMIP backend"),
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "path/to/ca-certificate.pem",
		}, nil)
		if err != nil {
			return err
		}
		_, err = kmip.NewSecretCaImported(ctx, "mixed", &kmip.SecretCaImportedArgs{
			Path:      _default.Path,
			Name:      pulumi.String("imported-ca-mixed"),
			CaPem:     pulumi.String(invokeFile.Result),
			ScopeName: pulumi.String("production"),
			RoleField: pulumi.String("CN"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var @default = new Vault.Kmip.SecretBackend("default", new()
    {
        Path = "kmip",
        Description = "Vault KMIP backend",
    });

    var mixed = new Vault.Kmip.SecretCaImported("mixed", new()
    {
        Path = @default.Path,
        Name = "imported-ca-mixed",
        CaPem = Std.File.Invoke(new()
        {
            Input = "path/to/ca-certificate.pem",
        }).Apply(invoke => invoke.Result),
        ScopeName = "production",
        RoleField = "CN",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.kmip.SecretBackend;
import com.pulumi.vault.kmip.SecretBackendArgs;
import com.pulumi.vault.kmip.SecretCaImported;
import com.pulumi.vault.kmip.SecretCaImportedArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var default_ = new SecretBackend("default", SecretBackendArgs.builder()
            .path("kmip")
            .description("Vault KMIP backend")
            .build());

        var mixed = new SecretCaImported("mixed", SecretCaImportedArgs.builder()
            .path(default_.path())
            .name("imported-ca-mixed")
            .caPem(StdFunctions.file(FileArgs.builder()
                .input("path/to/ca-certificate.pem")
                .build()).result())
            .scopeName("production")
            .roleField("CN")
            .build());

    }
}

    resources:
  default:
    type: vault:kmip:SecretBackend
    properties:
      path: kmip
      description: Vault KMIP backend
  mixed:
    type: vault:kmip:SecretCaImported
    properties:
      path: ${default.path}
      name: imported-ca-mixed
      caPem:
        fn::invoke:
          function: std:file
          arguments:
            input: path/to/ca-certificate.pem
          return: result
      scopeName: production
      roleField: CN

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_kmip_secretbackend" "default" {
  path        = "kmip"
  description = "Vault KMIP backend"
}
resource "vault_kmip_secretcaimported" "mixed" {
  path       = vault_kmip_secretbackend.default.path
  name       = "imported-ca-mixed"
  ca_pem     = file("path/to/ca-certificate.pem")
  scope_name = "production"
  role_field = "CN"
}

    Configuration Requirements

    When configuring an imported CA, you must specify:

    • Exactly one of scopeName or scopeField
    • Exactly one of roleName or roleField

    You can mix and match name-based and field-based configurations. For example, you can use scopeName with roleField.

    Updating

    The scopeName, scopeField, roleName, and roleField parameters can be updated after creation. All other parameters require replacement if changed.

    Create SecretCaImported Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretCaImported(name: string, args: SecretCaImportedArgs, opts?: CustomResourceOptions);
    @overload
def SecretCaImported(resource_name: str,
                     args: SecretCaImportedArgs,
                     opts: Optional[ResourceOptions] = None)

@overload
def SecretCaImported(resource_name: str,
                     opts: Optional[ResourceOptions] = None,
                     ca_pem: Optional[str] = None,
                     path: Optional[str] = None,
                     name: Optional[str] = None,
                     namespace: Optional[str] = None,
                     role_field: Optional[str] = None,
                     role_name: Optional[str] = None,
                     scope_field: Optional[str] = None,
                     scope_name: Optional[str] = None)
    func NewSecretCaImported(ctx *Context, name string, args SecretCaImportedArgs, opts ...ResourceOption) (*SecretCaImported, error)
    public SecretCaImported(string name, SecretCaImportedArgs args, CustomResourceOptions? opts = null)
    public SecretCaImported(String name, SecretCaImportedArgs args)
public SecretCaImported(String name, SecretCaImportedArgs args, CustomResourceOptions options)

    type: vault:kmip:SecretCaImported
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_kmip_secret_ca_imported" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretCaImportedArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretCaImportedArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretCaImportedArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretCaImportedArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretCaImportedArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretCaImportedResource = new Vault.Kmip.SecretCaImported("secretCaImportedResource", new()
{
    CaPem = "string",
    Path = "string",
    Name = "string",
    Namespace = "string",
    RoleField = "string",
    RoleName = "string",
    ScopeField = "string",
    ScopeName = "string",
});

    example, err := kmip.NewSecretCaImported(ctx, "secretCaImportedResource", &kmip.SecretCaImportedArgs{
	CaPem:      pulumi.String("string"),
	Path:       pulumi.String("string"),
	Name:       pulumi.String("string"),
	Namespace:  pulumi.String("string"),
	RoleField:  pulumi.String("string"),
	RoleName:   pulumi.String("string"),
	ScopeField: pulumi.String("string"),
	ScopeName:  pulumi.String("string"),
})

    resource "vault_kmip_secret_ca_imported" "secretCaImportedResource" {
  lifecycle {
    create_before_destroy = true
  }
  ca_pem      = "string"
  path        = "string"
  name        = "string"
  namespace   = "string"
  role_field  = "string"
  role_name   = "string"
  scope_field = "string"
  scope_name  = "string"
}

    var secretCaImportedResource = new SecretCaImported("secretCaImportedResource", SecretCaImportedArgs.builder()
    .caPem("string")
    .path("string")
    .name("string")
    .namespace("string")
    .roleField("string")
    .roleName("string")
    .scopeField("string")
    .scopeName("string")
    .build());

    secret_ca_imported_resource = vault.kmip.SecretCaImported("secretCaImportedResource",
    ca_pem="string",
    path="string",
    name="string",
    namespace="string",
    role_field="string",
    role_name="string",
    scope_field="string",
    scope_name="string")

    const secretCaImportedResource = new vault.kmip.SecretCaImported("secretCaImportedResource", {
    caPem: "string",
    path: "string",
    name: "string",
    namespace: "string",
    roleField: "string",
    roleName: "string",
    scopeField: "string",
    scopeName: "string",
});

    type: vault:kmip:SecretCaImported
properties:
    caPem: string
    name: string
    namespace: string
    path: string
    roleField: string
    roleName: string
    scopeField: string
    scopeName: string

    SecretCaImported Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretCaImported resource accepts the following input properties:

    CaPem string
    CA certificate in PEM format.
    Path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    Name string
    Name to identify the CA. This will be used in the CA's path.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    RoleField string
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    RoleName string
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    ScopeField string
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    ScopeName string
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    CaPem string
    CA certificate in PEM format.
    Path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    Name string
    Name to identify the CA. This will be used in the CA's path.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    RoleField string
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    RoleName string
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    ScopeField string
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    ScopeName string
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    ca_pem string
    CA certificate in PEM format.
    path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    name string
    Name to identify the CA. This will be used in the CA's path.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    role_field string
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    role_name string
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scope_field string
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scope_name string
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    caPem String
    CA certificate in PEM format.
    path String
    Path where KMIP backend is mounted. Must not begin or end with a /.
    name String
    Name to identify the CA. This will be used in the CA's path.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    roleField String
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    roleName String
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scopeField String
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scopeName String
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    caPem string
    CA certificate in PEM format.
    path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    name string
    Name to identify the CA. This will be used in the CA's path.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    roleField string
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    roleName string
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scopeField string
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scopeName string
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    ca_pem str
    CA certificate in PEM format.
    path str
    Path where KMIP backend is mounted. Must not begin or end with a /.
    name str
    Name to identify the CA. This will be used in the CA's path.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    role_field str
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    role_name str
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scope_field str
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scope_name str
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    caPem String
    CA certificate in PEM format.
    path String
    Path where KMIP backend is mounted. Must not begin or end with a /.
    name String
    Name to identify the CA. This will be used in the CA's path.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    roleField String
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    roleName String
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scopeField String
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scopeName String
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretCaImported resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecretCaImported Resource

    Get an existing SecretCaImported resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretCaImportedState, opts?: CustomResourceOptions): SecretCaImported
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        ca_pem: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        path: Optional[str] = None,
        role_field: Optional[str] = None,
        role_name: Optional[str] = None,
        scope_field: Optional[str] = None,
        scope_name: Optional[str] = None) -> SecretCaImported
    func GetSecretCaImported(ctx *Context, name string, id IDInput, state *SecretCaImportedState, opts ...ResourceOption) (*SecretCaImported, error)
    public static SecretCaImported Get(string name, Input<string> id, SecretCaImportedState? state, CustomResourceOptions? opts = null)
    public static SecretCaImported get(String name, Output<String> id, SecretCaImportedState state, CustomResourceOptions options)
    resources:  _:    type: vault:kmip:SecretCaImported    get:      id: ${id}
    import {
  to = vault_kmip_secret_ca_imported.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CaPem string
    CA certificate in PEM format.
    Name string
    Name to identify the CA. This will be used in the CA's path.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    Path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    RoleField string
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    RoleName string
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    ScopeField string
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    ScopeName string
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    CaPem string
    CA certificate in PEM format.
    Name string
    Name to identify the CA. This will be used in the CA's path.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    Path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    RoleField string
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    RoleName string
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    ScopeField string
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    ScopeName string
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    ca_pem string
    CA certificate in PEM format.
    name string
    Name to identify the CA. This will be used in the CA's path.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    role_field string
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    role_name string
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scope_field string
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scope_name string
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    caPem String
    CA certificate in PEM format.
    name String
    Name to identify the CA. This will be used in the CA's path.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    path String
    Path where KMIP backend is mounted. Must not begin or end with a /.
    roleField String
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    roleName String
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scopeField String
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scopeName String
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    caPem string
    CA certificate in PEM format.
    name string
    Name to identify the CA. This will be used in the CA's path.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    roleField string
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    roleName string
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scopeField string
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scopeName string
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    ca_pem str
    CA certificate in PEM format.
    name str
    Name to identify the CA. This will be used in the CA's path.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    path str
    Path where KMIP backend is mounted. Must not begin or end with a /.
    role_field str
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    role_name str
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scope_field str
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scope_name str
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.
    caPem String
    CA certificate in PEM format.
    name String
    Name to identify the CA. This will be used in the CA's path.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    path String
    Path where KMIP backend is mounted. Must not begin or end with a /.
    roleField String
    The field in the certificate to use for the role. Valid values are CN, O, OU, or UID. Must specify exactly one of roleName or roleField.
    roleName String
    The role name to associate with this CA. Must specify exactly one of roleName or roleField.
    scopeField String
    The field in the certificate to use for the scope. Valid values are CN, O, OU, or UID. Must specify exactly one of scopeName or scopeField.
    scopeName String
    The scope name to associate with this CA. Must specify exactly one of scopeName or scopeField.

    Import

    KMIP Secret CA Imported can be imported using the format <path>/ca/<name>, e.g.

    $ pulumi import vault:kmip/secretCaImported:SecretCaImported example kmip/ca/my-ca

    Note: When importing, the caPem value cannot be retrieved from Vault and will need to be set in your configuration. This value will be ignored during import verification.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.11.1
    published on Tuesday, Aug 11, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial