Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. kmip
  6. SecretListener
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.kmip.SecretListener

vault logo vault logo
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages KMIP Secret listeners in a Vault server. This feature requires Vault Enterprise. See the Vault documentation for more information.

    Listeners define the network configuration for KMIP servers, including the address to listen on, TLS settings, and which CA to use for generating server certificates and verifying client certificates.

    Example Usage

    Basic Listener

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const _default = new vault.kmip.SecretBackend("default", {
    path: "kmip",
    description: "Vault KMIP backend",
});
const example = new vault.index.KmipSecretCa("example", {
    path: _default.path,
    name: "example-ca",
    keyType: "ec",
    keyBits: 256,
});
const exampleSecretListener = new vault.kmip.SecretListener("example", {
    path: _default.path,
    name: "example-listener",
    ca: example.name,
    address: "0.0.0.0:5696",
    serverHostnames: ["kmip.example.com"],
});

    import pulumi
import pulumi_vault as vault

default = vault.kmip.SecretBackend("default",
    path="kmip",
    description="Vault KMIP backend")
example = vault.KmipSecretCa("example",
    path=default.path,
    name=example-ca,
    key_type=ec,
    key_bits=256)
example_secret_listener = vault.kmip.SecretListener("example",
    path=default.path,
    name="example-listener",
    ca=example["name"],
    address="0.0.0.0:5696",
    server_hostnames=["kmip.example.com"])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_default, err := kmip.NewSecretBackend(ctx, "default", &kmip.SecretBackendArgs{
			Path:        pulumi.String("kmip"),
			Description: pulumi.String("Vault KMIP backend"),
		})
		if err != nil {
			return err
		}
		example, err := vault.NewKmipSecretCa(ctx, "example", &vault.KmipSecretCaArgs{
			Path:    _default.Path,
			Name:    "example-ca",
			KeyType: "ec",
			KeyBits: 256,
		})
		if err != nil {
			return err
		}
		_, err = kmip.NewSecretListener(ctx, "example", &kmip.SecretListenerArgs{
			Path:    _default.Path,
			Name:    pulumi.String("example-listener"),
			Ca:      example.Name,
			Address: pulumi.String("0.0.0.0:5696"),
			ServerHostnames: pulumi.StringArray{
				pulumi.String("kmip.example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var @default = new Vault.Kmip.SecretBackend("default", new()
    {
        Path = "kmip",
        Description = "Vault KMIP backend",
    });

    var example = new Vault.KmipSecretCa("example", new()
    {
        Path = @default.Path,
        Name = "example-ca",
        KeyType = "ec",
        KeyBits = 256,
    });

    var exampleSecretListener = new Vault.Kmip.SecretListener("example", new()
    {
        Path = @default.Path,
        Name = "example-listener",
        Ca = example.Name,
        Address = "0.0.0.0:5696",
        ServerHostnames = new[]
        {
            "kmip.example.com",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.kmip.SecretBackend;
import com.pulumi.vault.kmip.SecretBackendArgs;
import com.pulumi.vault.KmipSecretCa;
import com.pulumi.vault.KmipSecretCaArgs;
import com.pulumi.vault.kmip.SecretListener;
import com.pulumi.vault.kmip.SecretListenerArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var default_ = new SecretBackend("default", SecretBackendArgs.builder()
            .path("kmip")
            .description("Vault KMIP backend")
            .build());

        var example = new KmipSecretCa("example", KmipSecretCaArgs.builder()
            .path(default_.path())
            .name("example-ca")
            .keyType("ec")
            .keyBits(256)
            .build());

        var exampleSecretListener = new SecretListener("exampleSecretListener", SecretListenerArgs.builder()
            .path(default_.path())
            .name("example-listener")
            .ca(example.name())
            .address("0.0.0.0:5696")
            .serverHostnames("kmip.example.com")
            .build());

    }
}

    resources:
  default:
    type: vault:kmip:SecretBackend
    properties:
      path: kmip
      description: Vault KMIP backend
  example:
    type: vault:KmipSecretCa
    properties:
      path: ${default.path}
      name: example-ca
      keyType: ec
      keyBits: 256
  exampleSecretListener:
    type: vault:kmip:SecretListener
    name: example
    properties:
      path: ${default.path}
      name: example-listener
      ca: ${example.name}
      address: 0.0.0.0:5696
      serverHostnames:
        - kmip.example.com

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_kmip_secretbackend" "default" {
  path        = "kmip"
  description = "Vault KMIP backend"
}
resource "vault_kmipsecretca" "example" {
  path     = vault_kmip_secretbackend.default.path
  name     = "example-ca"
  key_type = "ec"
  key_bits = 256
}
resource "vault_kmip_secretlistener" "example" {
  path             = vault_kmip_secretbackend.default.path
  name             = "example-listener"
  ca               = vault_kmipsecretca.example.name
  address          = "0.0.0.0:5696"
  server_hostnames = ["kmip.example.com"]
}

    Listener with Advanced TLS Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const _default = new vault.kmip.SecretBackend("default", {
    path: "kmip",
    description: "Vault KMIP backend",
});
const primary = new vault.index.KmipSecretCa("primary", {
    path: _default.path,
    name: "primary-ca",
    keyType: "rsa",
    keyBits: 4096,
});
const secondary = new vault.index.KmipSecretCa("secondary", {
    path: _default.path,
    name: "secondary-ca",
    keyType: "ec",
    keyBits: 256,
});
const advanced = new vault.kmip.SecretListener("advanced", {
    path: _default.path,
    name: "advanced-listener",
    ca: primary.name,
    address: "0.0.0.0:5696",
    additionalClientCas: [secondary.name],
    alsoUseLegacyCa: true,
    serverIps: [
        "192.168.1.100",
        "10.0.0.50",
    ],
    serverHostnames: [
        "kmip.example.com",
        "kmip-backup.example.com",
    ],
    tlsMinVersion: "tls13",
    tlsCipherSuites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
});

    import pulumi
import pulumi_vault as vault

default = vault.kmip.SecretBackend("default",
    path="kmip",
    description="Vault KMIP backend")
primary = vault.KmipSecretCa("primary",
    path=default.path,
    name=primary-ca,
    key_type=rsa,
    key_bits=4096)
secondary = vault.KmipSecretCa("secondary",
    path=default.path,
    name=secondary-ca,
    key_type=ec,
    key_bits=256)
advanced = vault.kmip.SecretListener("advanced",
    path=default.path,
    name="advanced-listener",
    ca=primary["name"],
    address="0.0.0.0:5696",
    additional_client_cas=[secondary["name"]],
    also_use_legacy_ca=True,
    server_ips=[
        "192.168.1.100",
        "10.0.0.50",
    ],
    server_hostnames=[
        "kmip.example.com",
        "kmip-backup.example.com",
    ],
    tls_min_version="tls13",
    tls_cipher_suites="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_default, err := kmip.NewSecretBackend(ctx, "default", &kmip.SecretBackendArgs{
			Path:        pulumi.String("kmip"),
			Description: pulumi.String("Vault KMIP backend"),
		})
		if err != nil {
			return err
		}
		primary, err := vault.NewKmipSecretCa(ctx, "primary", &vault.KmipSecretCaArgs{
			Path:    _default.Path,
			Name:    "primary-ca",
			KeyType: "rsa",
			KeyBits: 4096,
		})
		if err != nil {
			return err
		}
		secondary, err := vault.NewKmipSecretCa(ctx, "secondary", &vault.KmipSecretCaArgs{
			Path:    _default.Path,
			Name:    "secondary-ca",
			KeyType: "ec",
			KeyBits: 256,
		})
		if err != nil {
			return err
		}
		_, err = kmip.NewSecretListener(ctx, "advanced", &kmip.SecretListenerArgs{
			Path:    _default.Path,
			Name:    pulumi.String("advanced-listener"),
			Ca:      primary.Name,
			Address: pulumi.String("0.0.0.0:5696"),
			AdditionalClientCas: pulumi.StringArray{
				secondary.Name,
			},
			AlsoUseLegacyCa: pulumi.Bool(true),
			ServerIps: pulumi.StringArray{
				pulumi.String("192.168.1.100"),
				pulumi.String("10.0.0.50"),
			},
			ServerHostnames: pulumi.StringArray{
				pulumi.String("kmip.example.com"),
				pulumi.String("kmip-backup.example.com"),
			},
			TlsMinVersion:   pulumi.String("tls13"),
			TlsCipherSuites: pulumi.String("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var @default = new Vault.Kmip.SecretBackend("default", new()
    {
        Path = "kmip",
        Description = "Vault KMIP backend",
    });

    var primary = new Vault.KmipSecretCa("primary", new()
    {
        Path = @default.Path,
        Name = "primary-ca",
        KeyType = "rsa",
        KeyBits = 4096,
    });

    var secondary = new Vault.KmipSecretCa("secondary", new()
    {
        Path = @default.Path,
        Name = "secondary-ca",
        KeyType = "ec",
        KeyBits = 256,
    });

    var advanced = new Vault.Kmip.SecretListener("advanced", new()
    {
        Path = @default.Path,
        Name = "advanced-listener",
        Ca = primary.Name,
        Address = "0.0.0.0:5696",
        AdditionalClientCas = new[]
        {
            secondary.Name,
        },
        AlsoUseLegacyCa = true,
        ServerIps = new[]
        {
            "192.168.1.100",
            "10.0.0.50",
        },
        ServerHostnames = new[]
        {
            "kmip.example.com",
            "kmip-backup.example.com",
        },
        TlsMinVersion = "tls13",
        TlsCipherSuites = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.kmip.SecretBackend;
import com.pulumi.vault.kmip.SecretBackendArgs;
import com.pulumi.vault.KmipSecretCa;
import com.pulumi.vault.KmipSecretCaArgs;
import com.pulumi.vault.kmip.SecretListener;
import com.pulumi.vault.kmip.SecretListenerArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var default_ = new SecretBackend("default", SecretBackendArgs.builder()
            .path("kmip")
            .description("Vault KMIP backend")
            .build());

        var primary = new KmipSecretCa("primary", KmipSecretCaArgs.builder()
            .path(default_.path())
            .name("primary-ca")
            .keyType("rsa")
            .keyBits(4096)
            .build());

        var secondary = new KmipSecretCa("secondary", KmipSecretCaArgs.builder()
            .path(default_.path())
            .name("secondary-ca")
            .keyType("ec")
            .keyBits(256)
            .build());

        var advanced = new SecretListener("advanced", SecretListenerArgs.builder()
            .path(default_.path())
            .name("advanced-listener")
            .ca(primary.name())
            .address("0.0.0.0:5696")
            .additionalClientCas(secondary.name())
            .alsoUseLegacyCa(true)
            .serverIps(            
                "192.168.1.100",
                "10.0.0.50")
            .serverHostnames(            
                "kmip.example.com",
                "kmip-backup.example.com")
            .tlsMinVersion("tls13")
            .tlsCipherSuites("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
            .build());

    }
}

    resources:
  default:
    type: vault:kmip:SecretBackend
    properties:
      path: kmip
      description: Vault KMIP backend
  primary:
    type: vault:KmipSecretCa
    properties:
      path: ${default.path}
      name: primary-ca
      keyType: rsa
      keyBits: 4096
  secondary:
    type: vault:KmipSecretCa
    properties:
      path: ${default.path}
      name: secondary-ca
      keyType: ec
      keyBits: 256
  advanced:
    type: vault:kmip:SecretListener
    properties:
      path: ${default.path}
      name: advanced-listener
      ca: ${primary.name}
      address: 0.0.0.0:5696
      additionalClientCas:
        - ${secondary.name}
      alsoUseLegacyCa: true
      serverIps:
        - 192.168.1.100
        - 10.0.0.50
      serverHostnames:
        - kmip.example.com
        - kmip-backup.example.com
      tlsMinVersion: tls13
      tlsCipherSuites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_kmip_secretbackend" "default" {
  path        = "kmip"
  description = "Vault KMIP backend"
}
resource "vault_kmipsecretca" "primary" {
  path     = vault_kmip_secretbackend.default.path
  name     = "primary-ca"
  key_type = "rsa"
  key_bits = 4096
}
resource "vault_kmipsecretca" "secondary" {
  path     = vault_kmip_secretbackend.default.path
  name     = "secondary-ca"
  key_type = "ec"
  key_bits = 256
}
resource "vault_kmip_secretlistener" "advanced" {
  path                  = vault_kmip_secretbackend.default.path
  name                  = "advanced-listener"
  ca                    = vault_kmipsecretca.primary.name
  address               = "0.0.0.0:5696"
  additional_client_cas = [vault_kmipsecretca.secondary.name]
  also_use_legacy_ca    = true
  server_ips            = ["192.168.1.100", "10.0.0.50"]
  server_hostnames      = ["kmip.example.com", "kmip-backup.example.com"]
  tls_min_version       = "tls13"
  tls_cipher_suites     = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
}

    Notes

    • The listener requires a CA to be configured first using vaultKmipSecretCa.
    • The address must be a valid host:port combination.
    • When serverIps or serverHostnames are specified, they will be included in the server certificate as Subject Alternative Names (SANs).
    • The additionalClientCas parameter allows you to accept client certificates from multiple CAs, useful for certificate rotation scenarios.
    • TLS cipher suites configuration only applies to TLS 1.2 and earlier versions.

    Create SecretListener Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretListener(name: string, args: SecretListenerArgs, opts?: CustomResourceOptions);
    @overload
def SecretListener(resource_name: str,
                   args: SecretListenerArgs,
                   opts: Optional[ResourceOptions] = None)

@overload
def SecretListener(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   address: Optional[str] = None,
                   ca: Optional[str] = None,
                   path: Optional[str] = None,
                   additional_client_cas: Optional[Sequence[str]] = None,
                   also_use_legacy_ca: Optional[bool] = None,
                   name: Optional[str] = None,
                   namespace: Optional[str] = None,
                   server_hostnames: Optional[Sequence[str]] = None,
                   server_ips: Optional[Sequence[str]] = None,
                   tls_cipher_suites: Optional[str] = None,
                   tls_max_version: Optional[str] = None,
                   tls_min_version: Optional[str] = None)
    func NewSecretListener(ctx *Context, name string, args SecretListenerArgs, opts ...ResourceOption) (*SecretListener, error)
    public SecretListener(string name, SecretListenerArgs args, CustomResourceOptions? opts = null)
    public SecretListener(String name, SecretListenerArgs args)
public SecretListener(String name, SecretListenerArgs args, CustomResourceOptions options)

    type: vault:kmip:SecretListener
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_kmip_secret_listener" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretListenerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretListenerArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretListenerArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretListenerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretListenerArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretListenerResource = new Vault.Kmip.SecretListener("secretListenerResource", new()
{
    Address = "string",
    Ca = "string",
    Path = "string",
    AdditionalClientCas = new[]
    {
        "string",
    },
    AlsoUseLegacyCa = false,
    Name = "string",
    Namespace = "string",
    ServerHostnames = new[]
    {
        "string",
    },
    ServerIps = new[]
    {
        "string",
    },
    TlsCipherSuites = "string",
    TlsMaxVersion = "string",
    TlsMinVersion = "string",
});

    example, err := kmip.NewSecretListener(ctx, "secretListenerResource", &kmip.SecretListenerArgs{
	Address: pulumi.String("string"),
	Ca:      pulumi.String("string"),
	Path:    pulumi.String("string"),
	AdditionalClientCas: pulumi.StringArray{
		pulumi.String("string"),
	},
	AlsoUseLegacyCa: pulumi.Bool(false),
	Name:            pulumi.String("string"),
	Namespace:       pulumi.String("string"),
	ServerHostnames: pulumi.StringArray{
		pulumi.String("string"),
	},
	ServerIps: pulumi.StringArray{
		pulumi.String("string"),
	},
	TlsCipherSuites: pulumi.String("string"),
	TlsMaxVersion:   pulumi.String("string"),
	TlsMinVersion:   pulumi.String("string"),
})

    resource "vault_kmip_secret_listener" "secretListenerResource" {
  lifecycle {
    create_before_destroy = true
  }
  address               = "string"
  ca                    = "string"
  path                  = "string"
  additional_client_cas = ["string"]
  also_use_legacy_ca    = false
  name                  = "string"
  namespace             = "string"
  server_hostnames      = ["string"]
  server_ips            = ["string"]
  tls_cipher_suites     = "string"
  tls_max_version       = "string"
  tls_min_version       = "string"
}

    var secretListenerResource = new SecretListener("secretListenerResource", SecretListenerArgs.builder()
    .address("string")
    .ca("string")
    .path("string")
    .additionalClientCas("string")
    .alsoUseLegacyCa(false)
    .name("string")
    .namespace("string")
    .serverHostnames("string")
    .serverIps("string")
    .tlsCipherSuites("string")
    .tlsMaxVersion("string")
    .tlsMinVersion("string")
    .build());

    secret_listener_resource = vault.kmip.SecretListener("secretListenerResource",
    address="string",
    ca="string",
    path="string",
    additional_client_cas=["string"],
    also_use_legacy_ca=False,
    name="string",
    namespace="string",
    server_hostnames=["string"],
    server_ips=["string"],
    tls_cipher_suites="string",
    tls_max_version="string",
    tls_min_version="string")

    const secretListenerResource = new vault.kmip.SecretListener("secretListenerResource", {
    address: "string",
    ca: "string",
    path: "string",
    additionalClientCas: ["string"],
    alsoUseLegacyCa: false,
    name: "string",
    namespace: "string",
    serverHostnames: ["string"],
    serverIps: ["string"],
    tlsCipherSuites: "string",
    tlsMaxVersion: "string",
    tlsMinVersion: "string",
});

    type: vault:kmip:SecretListener
properties:
    additionalClientCas:
        - string
    address: string
    alsoUseLegacyCa: false
    ca: string
    name: string
    namespace: string
    path: string
    serverHostnames:
        - string
    serverIps:
        - string
    tlsCipherSuites: string
    tlsMaxVersion: string
    tlsMinVersion: string

    SecretListener Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretListener resource accepts the following input properties:

    Address string
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    Ca string
    Name of the CA to use to generate the server certificate and verify client certificates.
    Path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    AdditionalClientCas List<string>
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    AlsoUseLegacyCa bool
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    Name string
    Unique name for the listener.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ServerHostnames List<string>
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    ServerIps List<string>
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    TlsCipherSuites string
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    TlsMaxVersion string
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    TlsMinVersion string
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    Address string
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    Ca string
    Name of the CA to use to generate the server certificate and verify client certificates.
    Path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    AdditionalClientCas []string
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    AlsoUseLegacyCa bool
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    Name string
    Unique name for the listener.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ServerHostnames []string
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    ServerIps []string
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    TlsCipherSuites string
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    TlsMaxVersion string
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    TlsMinVersion string
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    address string
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    ca string
    Name of the CA to use to generate the server certificate and verify client certificates.
    path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    additional_client_cas list(string)
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    also_use_legacy_ca bool
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    name string
    Unique name for the listener.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    server_hostnames list(string)
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    server_ips list(string)
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tls_cipher_suites string
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tls_max_version string
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tls_min_version string
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    address String
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    ca String
    Name of the CA to use to generate the server certificate and verify client certificates.
    path String
    Path where KMIP backend is mounted. Must not begin or end with a /.
    additionalClientCas List<String>
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    alsoUseLegacyCa Boolean
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    name String
    Unique name for the listener.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    serverHostnames List<String>
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    serverIps List<String>
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tlsCipherSuites String
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tlsMaxVersion String
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tlsMinVersion String
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    address string
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    ca string
    Name of the CA to use to generate the server certificate and verify client certificates.
    path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    additionalClientCas string[]
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    alsoUseLegacyCa boolean
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    name string
    Unique name for the listener.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    serverHostnames string[]
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    serverIps string[]
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tlsCipherSuites string
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tlsMaxVersion string
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tlsMinVersion string
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    address str
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    ca str
    Name of the CA to use to generate the server certificate and verify client certificates.
    path str
    Path where KMIP backend is mounted. Must not begin or end with a /.
    additional_client_cas Sequence[str]
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    also_use_legacy_ca bool
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    name str
    Unique name for the listener.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    server_hostnames Sequence[str]
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    server_ips Sequence[str]
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tls_cipher_suites str
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tls_max_version str
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tls_min_version str
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    address String
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    ca String
    Name of the CA to use to generate the server certificate and verify client certificates.
    path String
    Path where KMIP backend is mounted. Must not begin or end with a /.
    additionalClientCas List<String>
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    alsoUseLegacyCa Boolean
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    name String
    Unique name for the listener.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    serverHostnames List<String>
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    serverIps List<String>
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tlsCipherSuites String
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tlsMaxVersion String
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tlsMinVersion String
    Minimum TLS version to accept. Valid values are tls12 or tls13.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretListener resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecretListener Resource

    Get an existing SecretListener resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretListenerState, opts?: CustomResourceOptions): SecretListener
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        additional_client_cas: Optional[Sequence[str]] = None,
        address: Optional[str] = None,
        also_use_legacy_ca: Optional[bool] = None,
        ca: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        path: Optional[str] = None,
        server_hostnames: Optional[Sequence[str]] = None,
        server_ips: Optional[Sequence[str]] = None,
        tls_cipher_suites: Optional[str] = None,
        tls_max_version: Optional[str] = None,
        tls_min_version: Optional[str] = None) -> SecretListener
    func GetSecretListener(ctx *Context, name string, id IDInput, state *SecretListenerState, opts ...ResourceOption) (*SecretListener, error)
    public static SecretListener Get(string name, Input<string> id, SecretListenerState? state, CustomResourceOptions? opts = null)
    public static SecretListener get(String name, Output<String> id, SecretListenerState state, CustomResourceOptions options)
    resources:  _:    type: vault:kmip:SecretListener    get:      id: ${id}
    import {
  to = vault_kmip_secret_listener.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AdditionalClientCas List<string>
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    Address string
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    AlsoUseLegacyCa bool
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    Ca string
    Name of the CA to use to generate the server certificate and verify client certificates.
    Name string
    Unique name for the listener.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    ServerHostnames List<string>
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    ServerIps List<string>
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    TlsCipherSuites string
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    TlsMaxVersion string
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    TlsMinVersion string
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    AdditionalClientCas []string
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    Address string
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    AlsoUseLegacyCa bool
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    Ca string
    Name of the CA to use to generate the server certificate and verify client certificates.
    Name string
    Unique name for the listener.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    ServerHostnames []string
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    ServerIps []string
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    TlsCipherSuites string
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    TlsMaxVersion string
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    TlsMinVersion string
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    additional_client_cas list(string)
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    address string
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    also_use_legacy_ca bool
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    ca string
    Name of the CA to use to generate the server certificate and verify client certificates.
    name string
    Unique name for the listener.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    server_hostnames list(string)
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    server_ips list(string)
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tls_cipher_suites string
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tls_max_version string
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tls_min_version string
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    additionalClientCas List<String>
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    address String
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    alsoUseLegacyCa Boolean
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    ca String
    Name of the CA to use to generate the server certificate and verify client certificates.
    name String
    Unique name for the listener.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    path String
    Path where KMIP backend is mounted. Must not begin or end with a /.
    serverHostnames List<String>
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    serverIps List<String>
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tlsCipherSuites String
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tlsMaxVersion String
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tlsMinVersion String
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    additionalClientCas string[]
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    address string
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    alsoUseLegacyCa boolean
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    ca string
    Name of the CA to use to generate the server certificate and verify client certificates.
    name string
    Unique name for the listener.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    path string
    Path where KMIP backend is mounted. Must not begin or end with a /.
    serverHostnames string[]
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    serverIps string[]
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tlsCipherSuites string
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tlsMaxVersion string
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tlsMinVersion string
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    additional_client_cas Sequence[str]
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    address str
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    also_use_legacy_ca bool
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    ca str
    Name of the CA to use to generate the server certificate and verify client certificates.
    name str
    Unique name for the listener.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    path str
    Path where KMIP backend is mounted. Must not begin or end with a /.
    server_hostnames Sequence[str]
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    server_ips Sequence[str]
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tls_cipher_suites str
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tls_max_version str
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tls_min_version str
    Minimum TLS version to accept. Valid values are tls12 or tls13.
    additionalClientCas List<String>
    Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.
    address String
    Host:port address to listen on (e.g., 0.0.0.0:5696 or 127.0.0.1:8080).
    alsoUseLegacyCa Boolean
    Use the legacy unnamed CA for verifying client certificates as well. Defaults to false.
    ca String
    Name of the CA to use to generate the server certificate and verify client certificates.
    name String
    Unique name for the listener.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    path String
    Path where KMIP backend is mounted. Must not begin or end with a /.
    serverHostnames List<String>
    DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.
    serverIps List<String>
    IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.
    tlsCipherSuites String
    Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
    tlsMaxVersion String
    Maximum TLS version to accept. Valid values are tls12 or tls13.
    tlsMinVersion String
    Minimum TLS version to accept. Valid values are tls12 or tls13.

    Import

    KMIP Secret listener can be imported using the format <path>/listener/<name>, e.g.

    $ pulumi import vault:kmip/secretListener:SecretListener example kmip/listener/example-listener

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.11.1
    published on Tuesday, Aug 11, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial