Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. os
  6. SecretBackend
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.os.SecretBackend

vault logo vault logo
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages OS Secrets Engine backend configuration in a Vault server. The OS Secrets Engine manages credentials for operating system accounts on remote hosts via SSH. This resource requires Vault 2.0.0 or later.

    The OS Secrets Engine mount itself is managed separately, typically with vault.Mount. This resource only manages backend configuration for an existing OS mount.

    Before mounting the OS Secrets Engine, the external OS plugin must already be registered in Vault’s plugin catalog. You can register it with the vault.Plugin resource.

    The examples below use the canonical plugin name vault-plugin-secrets-os. If your Vault cluster registers the OS plugin under a different catalog name, use that name in vault_mount.type instead.

    See the Vault documentation for more information.

    Example Usage

    Register Plugin And Configure Backend

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Plugin("os", {
    type: "secret",
    name: "vault-plugin-secrets-os",
    version: "v0.1.0+ent",
});
const osMount = new vault.Mount("os", {
    path: "os",
    type: os.name,
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: osMount.path});

    import pulumi
import pulumi_vault as vault

os = vault.Plugin("os",
    type="secret",
    name="vault-plugin-secrets-os",
    version="v0.1.0+ent")
os_mount = vault.Mount("os",
    path="os",
    type=os.name)
os_secret_backend = vault.os.SecretBackend("os", mount=os_mount.path)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewPlugin(ctx, "os", &vault.PluginArgs{
			Type:    pulumi.String("secret"),
			Name:    pulumi.String("vault-plugin-secrets-os"),
			Version: pulumi.String("v0.1.0+ent"),
		})
		if err != nil {
			return err
		}
		osMount, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: os2.Name,
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: osMount.Path,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Plugin("os", new()
    {
        Type = "secret",
        Name = "vault-plugin-secrets-os",
        Version = "v0.1.0+ent",
    });

    var osMount = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = os.Name,
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = osMount.Path,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Plugin;
import com.pulumi.vault.PluginArgs;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Plugin("os", PluginArgs.builder()
            .type("secret")
            .name("vault-plugin-secrets-os")
            .version("v0.1.0+ent")
            .build());

        var osMount = new Mount("osMount", MountArgs.builder()
            .path("os")
            .type(os.name())
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(osMount.path())
            .build());

    }
}

    resources:
  os:
    type: vault:Plugin
    properties:
      type: secret
      name: vault-plugin-secrets-os
      version: v0.1.0+ent
  osMount:
    type: vault:Mount
    name: os
    properties:
      path: os
      type: ${os.name}
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${osMount.path}

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_plugin" "os" {
  type    = "secret"
  name    = "vault-plugin-secrets-os"
  version = "v0.1.0+ent"
}
resource "vault_mount" "os" {
  path = "os"
  type = vault_plugin.os.name
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}

    Basic Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Mount("os", {
    path: "os",
    type: "vault-plugin-secrets-os",
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: os.path});

    import pulumi
import pulumi_vault as vault

os = vault.Mount("os",
    path="os",
    type="vault-plugin-secrets-os")
os_secret_backend = vault.os.SecretBackend("os", mount=os.path)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: pulumi.String("vault-plugin-secrets-os"),
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: os2.Path,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = "vault-plugin-secrets-os",
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = os.Path,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Mount("os", MountArgs.builder()
            .path("os")
            .type("vault-plugin-secrets-os")
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(os.path())
            .build());

    }
}

    resources:
  os:
    type: vault:Mount
    properties:
      path: os
      type: vault-plugin-secrets-os
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${os.path}

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "os" {
  path = "os"
  type = "vault-plugin-secrets-os"
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}

    Advanced Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Mount("os", {
    path: "os-prod",
    type: "vault-plugin-secrets-os",
});
const osSecretBackend = new vault.os.SecretBackend("os", {
    mount: os.path,
    maxVersions: 10,
    sshHostKeyTrustOnFirstUse: true,
});

    import pulumi
import pulumi_vault as vault

os = vault.Mount("os",
    path="os-prod",
    type="vault-plugin-secrets-os")
os_secret_backend = vault.os.SecretBackend("os",
    mount=os.path,
    max_versions=10,
    ssh_host_key_trust_on_first_use=True)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os-prod"),
			Type: pulumi.String("vault-plugin-secrets-os"),
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount:                     os2.Path,
			MaxVersions:               pulumi.Int(10),
			SshHostKeyTrustOnFirstUse: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Mount("os", new()
    {
        Path = "os-prod",
        Type = "vault-plugin-secrets-os",
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = os.Path,
        MaxVersions = 10,
        SshHostKeyTrustOnFirstUse = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Mount("os", MountArgs.builder()
            .path("os-prod")
            .type("vault-plugin-secrets-os")
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(os.path())
            .maxVersions(10)
            .sshHostKeyTrustOnFirstUse(true)
            .build());

    }
}

    resources:
  os:
    type: vault:Mount
    properties:
      path: os-prod
      type: vault-plugin-secrets-os
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${os.path}
      maxVersions: 10
      sshHostKeyTrustOnFirstUse: true

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "os" {
  path = "os-prod"
  type = "vault-plugin-secrets-os"
}
resource "vault_os_secretbackend" "os" {
  mount                           = vault_mount.os.path
  max_versions                    = 10
  ssh_host_key_trust_on_first_use = true
}

    Notes

    • This resource requires Vault 2.0.0 or later.
    • The OS Secrets Engine plugin must be registered before the mount is enabled. Use vault.Plugin to manage catalog registration when appropriate.
    • Use vault.Mount to create, tune, or remove the OS Secrets Engine mount.
    • When sshHostKeyTrustOnFirstUse is enabled, the first connection to a host will automatically trust and store its SSH host key.

    Create SecretBackend Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackend(name: string, args: SecretBackendArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackend(resource_name: str,
                  args: SecretBackendArgs,
                  opts: Optional[ResourceOptions] = None)

@overload
def SecretBackend(resource_name: str,
                  opts: Optional[ResourceOptions] = None,
                  mount: Optional[str] = None,
                  max_versions: Optional[int] = None,
                  namespace: Optional[str] = None,
                  ssh_host_key_trust_on_first_use: Optional[bool] = None)
    func NewSecretBackend(ctx *Context, name string, args SecretBackendArgs, opts ...ResourceOption) (*SecretBackend, error)
    public SecretBackend(string name, SecretBackendArgs args, CustomResourceOptions? opts = null)
    public SecretBackend(String name, SecretBackendArgs args)
public SecretBackend(String name, SecretBackendArgs args, CustomResourceOptions options)

    type: vault:os:SecretBackend
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_os_secret_backend" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var examplesecretBackendResourceResourceFromOssecretBackend = new Vault.Os.SecretBackend("examplesecretBackendResourceResourceFromOssecretBackend", new()
{
    Mount = "string",
    MaxVersions = 0,
    Namespace = "string",
    SshHostKeyTrustOnFirstUse = false,
});

    example, err := os.NewSecretBackend(ctx, "examplesecretBackendResourceResourceFromOssecretBackend", &os.SecretBackendArgs{
	Mount:                     pulumi.String("string"),
	MaxVersions:               pulumi.Int(0),
	Namespace:                 pulumi.String("string"),
	SshHostKeyTrustOnFirstUse: pulumi.Bool(false),
})

    resource "vault_os_secret_backend" "examplesecretBackendResourceResourceFromOssecretBackend" {
  lifecycle {
    create_before_destroy = true
  }
  mount                           = "string"
  max_versions                    = 0
  namespace                       = "string"
  ssh_host_key_trust_on_first_use = false
}

    var examplesecretBackendResourceResourceFromOssecretBackend = new com.pulumi.vault.os.SecretBackend("examplesecretBackendResourceResourceFromOssecretBackend", com.pulumi.vault.os.SecretBackendArgs.builder()
    .mount("string")
    .maxVersions(0)
    .namespace("string")
    .sshHostKeyTrustOnFirstUse(false)
    .build());

    examplesecret_backend_resource_resource_from_ossecret_backend = vault.os.SecretBackend("examplesecretBackendResourceResourceFromOssecretBackend",
    mount="string",
    max_versions=0,
    namespace="string",
    ssh_host_key_trust_on_first_use=False)

    const examplesecretBackendResourceResourceFromOssecretBackend = new vault.os.SecretBackend("examplesecretBackendResourceResourceFromOssecretBackend", {
    mount: "string",
    maxVersions: 0,
    namespace: "string",
    sshHostKeyTrustOnFirstUse: false,
});

    type: vault:os:SecretBackend
properties:
    maxVersions: 0
    mount: string
    namespace: string
    sshHostKeyTrustOnFirstUse: false

    SecretBackend Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackend resource accepts the following input properties:

    Mount string
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    MaxVersions int
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SshHostKeyTrustOnFirstUse bool
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    Mount string
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    MaxVersions int
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SshHostKeyTrustOnFirstUse bool
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    mount string
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    max_versions number
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ssh_host_key_trust_on_first_use bool
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    mount String
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    maxVersions Integer
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    sshHostKeyTrustOnFirstUse Boolean
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    mount string
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    maxVersions number
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    sshHostKeyTrustOnFirstUse boolean
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    mount str
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    max_versions int
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ssh_host_key_trust_on_first_use bool
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    mount String
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    maxVersions Number
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    sshHostKeyTrustOnFirstUse Boolean
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackend resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecretBackend Resource

    Get an existing SecretBackend resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendState, opts?: CustomResourceOptions): SecretBackend
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        max_versions: Optional[int] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        ssh_host_key_trust_on_first_use: Optional[bool] = None) -> SecretBackend
    func GetSecretBackend(ctx *Context, name string, id IDInput, state *SecretBackendState, opts ...ResourceOption) (*SecretBackend, error)
    public static SecretBackend Get(string name, Input<string> id, SecretBackendState? state, CustomResourceOptions? opts = null)
    public static SecretBackend get(String name, Output<String> id, SecretBackendState state, CustomResourceOptions options)
    resources:  _:    type: vault:os:SecretBackend    get:      id: ${id}
    import {
  to = vault_os_secret_backend.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    MaxVersions int
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    Mount string
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SshHostKeyTrustOnFirstUse bool
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    MaxVersions int
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    Mount string
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    SshHostKeyTrustOnFirstUse bool
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    max_versions number
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    mount string
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ssh_host_key_trust_on_first_use bool
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    maxVersions Integer
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    mount String
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    sshHostKeyTrustOnFirstUse Boolean
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    maxVersions number
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    mount string
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    sshHostKeyTrustOnFirstUse boolean
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    max_versions int
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    mount str
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ssh_host_key_trust_on_first_use bool
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.
    maxVersions Number
    The maximum number of versions to keep. When omitted, Vault applies its server-side default of 10. If you later remove the field from configuration, Vault retains the current value. Set to 0 to explicitly store zero in Vault.
    mount String
    The path where the OS secrets engine is already mounted. Must not begin or end with a /.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    sshHostKeyTrustOnFirstUse Boolean
    If true, SSH host keys will be trusted on first use (TOFU). If false, host keys must be explicitly configured. Defaults to false.

    Import

    OS Secret backend can be imported using the mount, e.g.

    $ pulumi import vault:os/secretBackend:SecretBackend os os

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.11.1
    published on Tuesday, Aug 11, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial