Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. os
  6. SecretBackendAccount
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.os.SecretBackendAccount

vault logo vault logo
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages account configurations in the OS Secrets Engine. Accounts represent operating system user accounts on remote hosts that Vault will manage, including automatic password rotation. This resource requires Vault 2.0.0 or later.

    Important The passwordWo field is write-only, create-only, and will not be read back from Vault. It can only be set during resource creation. To update the password after creation, use the Vault CLI or API to call the reset endpoint directly (see “Password Management” section below). All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform. Protect these artifacts accordingly. See the main provider documentation for more details.

    See the Vault documentation for more information.

    The OS Secrets Engine mount itself is managed separately, typically with vault.Mount. This resource manages accounts beneath an existing OS mount and host.

    Before mounting the OS Secrets Engine, the external OS plugin must already be registered in Vault’s plugin catalog. You can register it with the vault.Plugin resource.

    The examples below use the canonical plugin name vault-plugin-secrets-os. If your Vault cluster registers the OS plugin under a different catalog name, use that name in vault_mount.type instead.

    Example Usage

    Register Plugin And Configure Account

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Plugin("os", {
    type: "secret",
    name: "vault-plugin-secrets-os",
    version: "v0.1.0+ent",
});
const osMount = new vault.Mount("os", {
    path: "os",
    type: os.name,
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: osMount.path});
const server = new vault.os.SecretBackendHost("server", {
    mount: osSecretBackend.mount,
    name: "web-server",
    address: "192.168.1.100",
    port: 22,
});
const admin = new vault.os.SecretBackendAccount("admin", {
    mount: osSecretBackend.mount,
    host: server.name,
    name: "admin-account",
    username: "admin",
    passwordWo: "initial-secure-password-123",
});

    import pulumi
import pulumi_vault as vault

os = vault.Plugin("os",
    type="secret",
    name="vault-plugin-secrets-os",
    version="v0.1.0+ent")
os_mount = vault.Mount("os",
    path="os",
    type=os.name)
os_secret_backend = vault.os.SecretBackend("os", mount=os_mount.path)
server = vault.os.SecretBackendHost("server",
    mount=os_secret_backend.mount,
    name="web-server",
    address="192.168.1.100",
    port=22)
admin = vault.os.SecretBackendAccount("admin",
    mount=os_secret_backend.mount,
    host=server.name,
    name="admin-account",
    username="admin",
    password_wo="initial-secure-password-123")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewPlugin(ctx, "os", &vault.PluginArgs{
			Type:    pulumi.String("secret"),
			Name:    pulumi.String("vault-plugin-secrets-os"),
			Version: pulumi.String("v0.1.0+ent"),
		})
		if err != nil {
			return err
		}
		osMount, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: os2.Name,
		})
		if err != nil {
			return err
		}
		osSecretBackend, err := os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: osMount.Path,
		})
		if err != nil {
			return err
		}
		server, err := os.NewSecretBackendHost(ctx, "server", &os.SecretBackendHostArgs{
			Mount:   osSecretBackend.Mount,
			Name:    pulumi.String("web-server"),
			Address: pulumi.String("192.168.1.100"),
			Port:    pulumi.Int(22),
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackendAccount(ctx, "admin", &os.SecretBackendAccountArgs{
			Mount:      osSecretBackend.Mount,
			Host:       server.Name,
			Name:       pulumi.String("admin-account"),
			Username:   pulumi.String("admin"),
			PasswordWo: pulumi.String("initial-secure-password-123"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Plugin("os", new()
    {
        Type = "secret",
        Name = "vault-plugin-secrets-os",
        Version = "v0.1.0+ent",
    });

    var osMount = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = os.Name,
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = osMount.Path,
    });

    var server = new Vault.Os.SecretBackendHost("server", new()
    {
        Mount = osSecretBackend.Mount,
        Name = "web-server",
        Address = "192.168.1.100",
        Port = 22,
    });

    var admin = new Vault.Os.SecretBackendAccount("admin", new()
    {
        Mount = osSecretBackend.Mount,
        Host = server.Name,
        Name = "admin-account",
        Username = "admin",
        PasswordWo = "initial-secure-password-123",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Plugin;
import com.pulumi.vault.PluginArgs;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import com.pulumi.vault.os.SecretBackendHost;
import com.pulumi.vault.os.SecretBackendHostArgs;
import com.pulumi.vault.os.SecretBackendAccount;
import com.pulumi.vault.os.SecretBackendAccountArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Plugin("os", PluginArgs.builder()
            .type("secret")
            .name("vault-plugin-secrets-os")
            .version("v0.1.0+ent")
            .build());

        var osMount = new Mount("osMount", MountArgs.builder()
            .path("os")
            .type(os.name())
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(osMount.path())
            .build());

        var server = new SecretBackendHost("server", SecretBackendHostArgs.builder()
            .mount(osSecretBackend.mount())
            .name("web-server")
            .address("192.168.1.100")
            .port(22)
            .build());

        var admin = new SecretBackendAccount("admin", SecretBackendAccountArgs.builder()
            .mount(osSecretBackend.mount())
            .host(server.name())
            .name("admin-account")
            .username("admin")
            .passwordWo("initial-secure-password-123")
            .build());

    }
}

    resources:
  os:
    type: vault:Plugin
    properties:
      type: secret
      name: vault-plugin-secrets-os
      version: v0.1.0+ent
  osMount:
    type: vault:Mount
    name: os
    properties:
      path: os
      type: ${os.name}
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${osMount.path}
  server:
    type: vault:os:SecretBackendHost
    properties:
      mount: ${osSecretBackend.mount}
      name: web-server
      address: 192.168.1.100
      port: 22
  admin:
    type: vault:os:SecretBackendAccount
    properties:
      mount: ${osSecretBackend.mount}
      host: ${server.name}
      name: admin-account
      username: admin
      passwordWo: initial-secure-password-123

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_plugin" "os" {
  type    = "secret"
  name    = "vault-plugin-secrets-os"
  version = "v0.1.0+ent"
}
resource "vault_mount" "os" {
  path = "os"
  type = vault_plugin.os.name
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}
resource "vault_os_secretbackendhost" "server" {
  mount   = vault_os_secretbackend.os.mount
  name    = "web-server"
  address = "192.168.1.100"
  port    = 22
}
resource "vault_os_secretbackendaccount" "admin" {
  mount       = vault_os_secretbackend.os.mount
  host        = vault_os_secretbackendhost.server.name
  name        = "admin-account"
  username    = "admin"
  password_wo = "initial-secure-password-123"
}

    Basic Account Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Mount("os", {
    path: "os",
    type: "vault-plugin-secrets-os",
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: os.path});
const server = new vault.os.SecretBackendHost("server", {
    mount: osSecretBackend.mount,
    name: "web-server",
    address: "192.168.1.100",
    port: 22,
});
const admin = new vault.os.SecretBackendAccount("admin", {
    mount: osSecretBackend.mount,
    host: server.name,
    name: "admin-account",
    username: "admin",
    passwordWo: "initial-secure-password-123",
});

    import pulumi
import pulumi_vault as vault

os = vault.Mount("os",
    path="os",
    type="vault-plugin-secrets-os")
os_secret_backend = vault.os.SecretBackend("os", mount=os.path)
server = vault.os.SecretBackendHost("server",
    mount=os_secret_backend.mount,
    name="web-server",
    address="192.168.1.100",
    port=22)
admin = vault.os.SecretBackendAccount("admin",
    mount=os_secret_backend.mount,
    host=server.name,
    name="admin-account",
    username="admin",
    password_wo="initial-secure-password-123")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: pulumi.String("vault-plugin-secrets-os"),
		})
		if err != nil {
			return err
		}
		osSecretBackend, err := os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: os2.Path,
		})
		if err != nil {
			return err
		}
		server, err := os.NewSecretBackendHost(ctx, "server", &os.SecretBackendHostArgs{
			Mount:   osSecretBackend.Mount,
			Name:    pulumi.String("web-server"),
			Address: pulumi.String("192.168.1.100"),
			Port:    pulumi.Int(22),
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackendAccount(ctx, "admin", &os.SecretBackendAccountArgs{
			Mount:      osSecretBackend.Mount,
			Host:       server.Name,
			Name:       pulumi.String("admin-account"),
			Username:   pulumi.String("admin"),
			PasswordWo: pulumi.String("initial-secure-password-123"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = "vault-plugin-secrets-os",
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = os.Path,
    });

    var server = new Vault.Os.SecretBackendHost("server", new()
    {
        Mount = osSecretBackend.Mount,
        Name = "web-server",
        Address = "192.168.1.100",
        Port = 22,
    });

    var admin = new Vault.Os.SecretBackendAccount("admin", new()
    {
        Mount = osSecretBackend.Mount,
        Host = server.Name,
        Name = "admin-account",
        Username = "admin",
        PasswordWo = "initial-secure-password-123",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import com.pulumi.vault.os.SecretBackendHost;
import com.pulumi.vault.os.SecretBackendHostArgs;
import com.pulumi.vault.os.SecretBackendAccount;
import com.pulumi.vault.os.SecretBackendAccountArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Mount("os", MountArgs.builder()
            .path("os")
            .type("vault-plugin-secrets-os")
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(os.path())
            .build());

        var server = new SecretBackendHost("server", SecretBackendHostArgs.builder()
            .mount(osSecretBackend.mount())
            .name("web-server")
            .address("192.168.1.100")
            .port(22)
            .build());

        var admin = new SecretBackendAccount("admin", SecretBackendAccountArgs.builder()
            .mount(osSecretBackend.mount())
            .host(server.name())
            .name("admin-account")
            .username("admin")
            .passwordWo("initial-secure-password-123")
            .build());

    }
}

    resources:
  os:
    type: vault:Mount
    properties:
      path: os
      type: vault-plugin-secrets-os
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${os.path}
  server:
    type: vault:os:SecretBackendHost
    properties:
      mount: ${osSecretBackend.mount}
      name: web-server
      address: 192.168.1.100
      port: 22
  admin:
    type: vault:os:SecretBackendAccount
    properties:
      mount: ${osSecretBackend.mount}
      host: ${server.name}
      name: admin-account
      username: admin
      passwordWo: initial-secure-password-123

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "os" {
  path = "os"
  type = "vault-plugin-secrets-os"
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}
resource "vault_os_secretbackendhost" "server" {
  mount   = vault_os_secretbackend.os.mount
  name    = "web-server"
  address = "192.168.1.100"
  port    = 22
}
resource "vault_os_secretbackendaccount" "admin" {
  mount       = vault_os_secretbackend.os.mount
  host        = vault_os_secretbackendhost.server.name
  name        = "admin-account"
  username    = "admin"
  password_wo = "initial-secure-password-123"
}

    Account with Rotation Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Mount("os", {
    path: "os",
    type: "vault-plugin-secrets-os",
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: os.path});
const database = new vault.os.SecretBackendHost("database", {
    mount: osSecretBackend.mount,
    name: "db-server",
    address: "10.0.1.50",
    port: 22,
});
const dbadmin = new vault.os.SecretBackendAccount("dbadmin", {
    mount: osSecretBackend.mount,
    host: database.name,
    name: "dbadmin",
    username: "postgres",
    passwordWo: "initial-password-456",
    rotationPeriod: 86400,
    verifyConnection: false,
});

    import pulumi
import pulumi_vault as vault

os = vault.Mount("os",
    path="os",
    type="vault-plugin-secrets-os")
os_secret_backend = vault.os.SecretBackend("os", mount=os.path)
database = vault.os.SecretBackendHost("database",
    mount=os_secret_backend.mount,
    name="db-server",
    address="10.0.1.50",
    port=22)
dbadmin = vault.os.SecretBackendAccount("dbadmin",
    mount=os_secret_backend.mount,
    host=database.name,
    name="dbadmin",
    username="postgres",
    password_wo="initial-password-456",
    rotation_period=86400,
    verify_connection=False)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: pulumi.String("vault-plugin-secrets-os"),
		})
		if err != nil {
			return err
		}
		osSecretBackend, err := os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: os2.Path,
		})
		if err != nil {
			return err
		}
		database, err := os.NewSecretBackendHost(ctx, "database", &os.SecretBackendHostArgs{
			Mount:   osSecretBackend.Mount,
			Name:    pulumi.String("db-server"),
			Address: pulumi.String("10.0.1.50"),
			Port:    pulumi.Int(22),
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackendAccount(ctx, "dbadmin", &os.SecretBackendAccountArgs{
			Mount:            osSecretBackend.Mount,
			Host:             database.Name,
			Name:             pulumi.String("dbadmin"),
			Username:         pulumi.String("postgres"),
			PasswordWo:       pulumi.String("initial-password-456"),
			RotationPeriod:   pulumi.Int(86400),
			VerifyConnection: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = "vault-plugin-secrets-os",
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = os.Path,
    });

    var database = new Vault.Os.SecretBackendHost("database", new()
    {
        Mount = osSecretBackend.Mount,
        Name = "db-server",
        Address = "10.0.1.50",
        Port = 22,
    });

    var dbadmin = new Vault.Os.SecretBackendAccount("dbadmin", new()
    {
        Mount = osSecretBackend.Mount,
        Host = database.Name,
        Name = "dbadmin",
        Username = "postgres",
        PasswordWo = "initial-password-456",
        RotationPeriod = 86400,
        VerifyConnection = false,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import com.pulumi.vault.os.SecretBackendHost;
import com.pulumi.vault.os.SecretBackendHostArgs;
import com.pulumi.vault.os.SecretBackendAccount;
import com.pulumi.vault.os.SecretBackendAccountArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Mount("os", MountArgs.builder()
            .path("os")
            .type("vault-plugin-secrets-os")
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(os.path())
            .build());

        var database = new SecretBackendHost("database", SecretBackendHostArgs.builder()
            .mount(osSecretBackend.mount())
            .name("db-server")
            .address("10.0.1.50")
            .port(22)
            .build());

        var dbadmin = new SecretBackendAccount("dbadmin", SecretBackendAccountArgs.builder()
            .mount(osSecretBackend.mount())
            .host(database.name())
            .name("dbadmin")
            .username("postgres")
            .passwordWo("initial-password-456")
            .rotationPeriod(86400)
            .verifyConnection(false)
            .build());

    }
}

    resources:
  os:
    type: vault:Mount
    properties:
      path: os
      type: vault-plugin-secrets-os
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${os.path}
  database:
    type: vault:os:SecretBackendHost
    properties:
      mount: ${osSecretBackend.mount}
      name: db-server
      address: 10.0.1.50
      port: 22
  dbadmin:
    type: vault:os:SecretBackendAccount
    properties:
      mount: ${osSecretBackend.mount}
      host: ${database.name}
      name: dbadmin
      username: postgres
      passwordWo: initial-password-456
      rotationPeriod: 86400
      verifyConnection: false

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "os" {
  path = "os"
  type = "vault-plugin-secrets-os"
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}
resource "vault_os_secretbackendhost" "database" {
  mount   = vault_os_secretbackend.os.mount
  name    = "db-server"
  address = "10.0.1.50"
  port    = 22
}
resource "vault_os_secretbackendaccount" "dbadmin" {
  mount             = vault_os_secretbackend.os.mount
  host              = vault_os_secretbackendhost.database.name
  name              = "dbadmin"
  username          = "postgres"
  password_wo       = "initial-password-456"
  rotation_period   = 86400
  verify_connection = false
}

    Account with Scheduled Rotation

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Mount("os", {
    path: "os",
    type: "vault-plugin-secrets-os",
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: os.path});
const appServer = new vault.os.SecretBackendHost("app_server", {
    mount: osSecretBackend.mount,
    name: "app-01",
    address: "192.168.1.200",
    port: 22,
});
const service = new vault.os.SecretBackendAccount("service", {
    mount: osSecretBackend.mount,
    host: appServer.name,
    name: "service-account",
    username: "appuser",
    passwordWo: initialPassword,
    rotationSchedule: "0 3 * * 0",
    rotationWindow: 3600,
});

    import pulumi
import pulumi_vault as vault

os = vault.Mount("os",
    path="os",
    type="vault-plugin-secrets-os")
os_secret_backend = vault.os.SecretBackend("os", mount=os.path)
app_server = vault.os.SecretBackendHost("app_server",
    mount=os_secret_backend.mount,
    name="app-01",
    address="192.168.1.200",
    port=22)
service = vault.os.SecretBackendAccount("service",
    mount=os_secret_backend.mount,
    host=app_server.name,
    name="service-account",
    username="appuser",
    password_wo=initial_password,
    rotation_schedule="0 3 * * 0",
    rotation_window=3600)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: pulumi.String("vault-plugin-secrets-os"),
		})
		if err != nil {
			return err
		}
		osSecretBackend, err := os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: os2.Path,
		})
		if err != nil {
			return err
		}
		appServer, err := os.NewSecretBackendHost(ctx, "app_server", &os.SecretBackendHostArgs{
			Mount:   osSecretBackend.Mount,
			Name:    pulumi.String("app-01"),
			Address: pulumi.String("192.168.1.200"),
			Port:    pulumi.Int(22),
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackendAccount(ctx, "service", &os.SecretBackendAccountArgs{
			Mount:            osSecretBackend.Mount,
			Host:             appServer.Name,
			Name:             pulumi.String("service-account"),
			Username:         pulumi.String("appuser"),
			PasswordWo:       pulumi.Any(initialPassword),
			RotationSchedule: pulumi.String("0 3 * * 0"),
			RotationWindow:   pulumi.Int(3600),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = "vault-plugin-secrets-os",
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = os.Path,
    });

    var appServer = new Vault.Os.SecretBackendHost("app_server", new()
    {
        Mount = osSecretBackend.Mount,
        Name = "app-01",
        Address = "192.168.1.200",
        Port = 22,
    });

    var service = new Vault.Os.SecretBackendAccount("service", new()
    {
        Mount = osSecretBackend.Mount,
        Host = appServer.Name,
        Name = "service-account",
        Username = "appuser",
        PasswordWo = initialPassword,
        RotationSchedule = "0 3 * * 0",
        RotationWindow = 3600,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import com.pulumi.vault.os.SecretBackendHost;
import com.pulumi.vault.os.SecretBackendHostArgs;
import com.pulumi.vault.os.SecretBackendAccount;
import com.pulumi.vault.os.SecretBackendAccountArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Mount("os", MountArgs.builder()
            .path("os")
            .type("vault-plugin-secrets-os")
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(os.path())
            .build());

        var appServer = new SecretBackendHost("appServer", SecretBackendHostArgs.builder()
            .mount(osSecretBackend.mount())
            .name("app-01")
            .address("192.168.1.200")
            .port(22)
            .build());

        var service = new SecretBackendAccount("service", SecretBackendAccountArgs.builder()
            .mount(osSecretBackend.mount())
            .host(appServer.name())
            .name("service-account")
            .username("appuser")
            .passwordWo(initialPassword)
            .rotationSchedule("0 3 * * 0")
            .rotationWindow(3600)
            .build());

    }
}

    resources:
  os:
    type: vault:Mount
    properties:
      path: os
      type: vault-plugin-secrets-os
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${os.path}
  appServer:
    type: vault:os:SecretBackendHost
    name: app_server
    properties:
      mount: ${osSecretBackend.mount}
      name: app-01
      address: 192.168.1.200
      port: 22
  service:
    type: vault:os:SecretBackendAccount
    properties:
      mount: ${osSecretBackend.mount}
      host: ${appServer.name}
      name: service-account
      username: appuser
      passwordWo: ${initialPassword}
      rotationSchedule: 0 3 * * 0
      rotationWindow: 3600

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "os" {
  path = "os"
  type = "vault-plugin-secrets-os"
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}
resource "vault_os_secretbackendhost" "app_server" {
  mount   = vault_os_secretbackend.os.mount
  name    = "app-01"
  address = "192.168.1.200"
  port    = 22
}
resource "vault_os_secretbackendaccount" "service" {
  mount             = vault_os_secretbackend.os.mount
  host              = vault_os_secretbackendhost.app_server.name
  name              = "service-account"
  username          = "appuser"
  password_wo       = initialPassword
  rotation_schedule = "0 3 * * 0"
  rotation_window   = 3600
}

    Password Management

    The passwordWo field is create-only by design. This aligns with Vault’s security model where password updates should be performed through dedicated reset operations rather than general configuration updates.

    Updating Passwords After Creation

    To update an account password after the resource has been created, use the Vault CLI or API directly:

    Using Vault CLI:

    vault write os/hosts/<host>/accounts/<name>/reset password="new-password"

    Using Vault API:

    curl -X POST \
  -H "X-Vault-Token: $VAULT_TOKEN" \
  -d '{"password":"new-password"}' \
  https://vault.example.com/v1/os/hosts/<host>/accounts/<name>/reset

    Example:

    # Reset password for the admin account on web-server host
vault write os/hosts/web-server/accounts/admin-account/reset password="new-secure-password"

    This approach ensures that password updates are explicit operations separate from other configuration changes, providing better audit trails and security controls.

    Notes

    • This resource requires Vault 2.0.0 or later.
    • The OS Secrets Engine plugin must be registered before the mount is enabled. Use vault.Plugin to manage catalog registration when appropriate.
    • Use vault.Mount to create, tune, or remove the OS Secrets Engine mount before managing accounts with this resource.
    • The account must reference an existing host configuration.
    • The passwordWo field is write-only and create-only for security reasons. Once set, Vault will manage the password through rotation, but the current password cannot be retrieved through the API.
    • To manually update a password after creation, use the Vault CLI or API reset endpoint (see “Password Management” section above).
    • verifyConnection defaults to true. In environments where SSH connectivity is intentionally unavailable during creation, set it explicitly to false.
    • Use either rotationPeriod or rotationSchedule.
    • After the initial password is set, Vault will rotate it according to the configured schedule. Applications should retrieve the current password from Vault rather than storing it.
    • Changing mount, host, name, or passwordWo will cause the resource to be recreated.
    • The computed fields lastVaultRotation and nextVaultRotation are populated by Vault when rotation metadata is available.

    Security Considerations

    • Store the initial passwordWo value in a secure location such as Terraform variables or a secrets management system.
    • Use sensitive = true in variable definitions for passwords.
    • The passwordWo field is create-only and cannot be updated through Terraform after resource creation. This is intentional to enforce proper password management practices.
    • For password updates after creation, use the Vault CLI or API reset endpoint, which provides proper audit logging.
    • Ensure Terraform state files are properly secured as they will contain the initial password in cleartext.
    • Applications should retrieve credentials from Vault dynamically rather than storing them.
    • When importing existing accounts, use lifecycle { ignoreChanges = [passwordWo] } to prevent resource recreation.

    Create SecretBackendAccount Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendAccount(name: string, args: SecretBackendAccountArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendAccount(resource_name: str,
                         args: SecretBackendAccountArgs,
                         opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendAccount(resource_name: str,
                         opts: Optional[ResourceOptions] = None,
                         password_wo: Optional[str] = None,
                         username: Optional[str] = None,
                         host: Optional[str] = None,
                         mount: Optional[str] = None,
                         parent_account_ref: Optional[str] = None,
                         namespace: Optional[str] = None,
                         custom_metadata: Optional[Mapping[str, str]] = None,
                         password_policy: Optional[str] = None,
                         name: Optional[str] = None,
                         rotation_period: Optional[int] = None,
                         rotation_schedule: Optional[str] = None,
                         rotation_window: Optional[int] = None,
                         disable_automated_rotation: Optional[bool] = None,
                         verify_connection: Optional[bool] = None)
    func NewSecretBackendAccount(ctx *Context, name string, args SecretBackendAccountArgs, opts ...ResourceOption) (*SecretBackendAccount, error)
    public SecretBackendAccount(string name, SecretBackendAccountArgs args, CustomResourceOptions? opts = null)
    public SecretBackendAccount(String name, SecretBackendAccountArgs args)
public SecretBackendAccount(String name, SecretBackendAccountArgs args, CustomResourceOptions options)

    type: vault:os:SecretBackendAccount
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_os_secret_backend_account" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendAccountArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendAccountArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendAccountArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendAccountArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendAccountArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretBackendAccountResource = new Vault.Os.SecretBackendAccount("secretBackendAccountResource", new()
{
    PasswordWo = "string",
    Username = "string",
    Host = "string",
    Mount = "string",
    ParentAccountRef = "string",
    Namespace = "string",
    CustomMetadata = 
    {
        { "string", "string" },
    },
    PasswordPolicy = "string",
    Name = "string",
    RotationPeriod = 0,
    RotationSchedule = "string",
    RotationWindow = 0,
    DisableAutomatedRotation = false,
    VerifyConnection = false,
});

    example, err := os.NewSecretBackendAccount(ctx, "secretBackendAccountResource", &os.SecretBackendAccountArgs{
	PasswordWo:       pulumi.String("string"),
	Username:         pulumi.String("string"),
	Host:             pulumi.String("string"),
	Mount:            pulumi.String("string"),
	ParentAccountRef: pulumi.String("string"),
	Namespace:        pulumi.String("string"),
	CustomMetadata: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	PasswordPolicy:           pulumi.String("string"),
	Name:                     pulumi.String("string"),
	RotationPeriod:           pulumi.Int(0),
	RotationSchedule:         pulumi.String("string"),
	RotationWindow:           pulumi.Int(0),
	DisableAutomatedRotation: pulumi.Bool(false),
	VerifyConnection:         pulumi.Bool(false),
})

    resource "vault_os_secret_backend_account" "secretBackendAccountResource" {
  lifecycle {
    create_before_destroy = true
  }
  password_wo        = "string"
  username           = "string"
  host               = "string"
  mount              = "string"
  parent_account_ref = "string"
  namespace          = "string"
  custom_metadata = {
    "string" = "string"
  }
  password_policy            = "string"
  name                       = "string"
  rotation_period            = 0
  rotation_schedule          = "string"
  rotation_window            = 0
  disable_automated_rotation = false
  verify_connection          = false
}

    var secretBackendAccountResource = new SecretBackendAccount("secretBackendAccountResource", SecretBackendAccountArgs.builder()
    .passwordWo("string")
    .username("string")
    .host("string")
    .mount("string")
    .parentAccountRef("string")
    .namespace("string")
    .customMetadata(Map.of("string", "string"))
    .passwordPolicy("string")
    .name("string")
    .rotationPeriod(0)
    .rotationSchedule("string")
    .rotationWindow(0)
    .disableAutomatedRotation(false)
    .verifyConnection(false)
    .build());

    secret_backend_account_resource = vault.os.SecretBackendAccount("secretBackendAccountResource",
    password_wo="string",
    username="string",
    host="string",
    mount="string",
    parent_account_ref="string",
    namespace="string",
    custom_metadata={
        "string": "string",
    },
    password_policy="string",
    name="string",
    rotation_period=0,
    rotation_schedule="string",
    rotation_window=0,
    disable_automated_rotation=False,
    verify_connection=False)

    const secretBackendAccountResource = new vault.os.SecretBackendAccount("secretBackendAccountResource", {
    passwordWo: "string",
    username: "string",
    host: "string",
    mount: "string",
    parentAccountRef: "string",
    namespace: "string",
    customMetadata: {
        string: "string",
    },
    passwordPolicy: "string",
    name: "string",
    rotationPeriod: 0,
    rotationSchedule: "string",
    rotationWindow: 0,
    disableAutomatedRotation: false,
    verifyConnection: false,
});

    type: vault:os:SecretBackendAccount
properties:
    customMetadata:
        string: string
    disableAutomatedRotation: false
    host: string
    mount: string
    name: string
    namespace: string
    parentAccountRef: string
    passwordPolicy: string
    passwordWo: string
    rotationPeriod: 0
    rotationSchedule: string
    rotationWindow: 0
    username: string
    verifyConnection: false

    SecretBackendAccount Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendAccount resource accepts the following input properties:

    Host string
    The name of the host where this account exists.
    Mount string
    The path where the OS secrets engine is mounted.
    PasswordWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    Username string
    The username of the operating system account on the remote host.
    CustomMetadata Dictionary<string, string>
    Custom metadata associated with the account.
    DisableAutomatedRotation bool
    Disables automated rotation for the account.
    Name string
    Unique name for the account within the host.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ParentAccountRef string
    Reference to a parent account that manages rotation for this account.
    PasswordPolicy string
    Password policy to use for generated passwords.
    RotationPeriod int
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    RotationSchedule string
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    RotationWindow int
    The rotation window, in seconds.
    VerifyConnection bool
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    Host string
    The name of the host where this account exists.
    Mount string
    The path where the OS secrets engine is mounted.
    PasswordWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    Username string
    The username of the operating system account on the remote host.
    CustomMetadata map[string]string
    Custom metadata associated with the account.
    DisableAutomatedRotation bool
    Disables automated rotation for the account.
    Name string
    Unique name for the account within the host.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ParentAccountRef string
    Reference to a parent account that manages rotation for this account.
    PasswordPolicy string
    Password policy to use for generated passwords.
    RotationPeriod int
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    RotationSchedule string
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    RotationWindow int
    The rotation window, in seconds.
    VerifyConnection bool
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    host string
    The name of the host where this account exists.
    mount string
    The path where the OS secrets engine is mounted.
    password_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    username string
    The username of the operating system account on the remote host.
    custom_metadata map(string)
    Custom metadata associated with the account.
    disable_automated_rotation bool
    Disables automated rotation for the account.
    name string
    Unique name for the account within the host.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    parent_account_ref string
    Reference to a parent account that manages rotation for this account.
    password_policy string
    Password policy to use for generated passwords.
    rotation_period number
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotation_schedule string
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotation_window number
    The rotation window, in seconds.
    verify_connection bool
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    host String
    The name of the host where this account exists.
    mount String
    The path where the OS secrets engine is mounted.
    passwordWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    username String
    The username of the operating system account on the remote host.
    customMetadata Map<String,String>
    Custom metadata associated with the account.
    disableAutomatedRotation Boolean
    Disables automated rotation for the account.
    name String
    Unique name for the account within the host.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    parentAccountRef String
    Reference to a parent account that manages rotation for this account.
    passwordPolicy String
    Password policy to use for generated passwords.
    rotationPeriod Integer
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule String
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotationWindow Integer
    The rotation window, in seconds.
    verifyConnection Boolean
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    host string
    The name of the host where this account exists.
    mount string
    The path where the OS secrets engine is mounted.
    passwordWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    username string
    The username of the operating system account on the remote host.
    customMetadata {[key: string]: string}
    Custom metadata associated with the account.
    disableAutomatedRotation boolean
    Disables automated rotation for the account.
    name string
    Unique name for the account within the host.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    parentAccountRef string
    Reference to a parent account that manages rotation for this account.
    passwordPolicy string
    Password policy to use for generated passwords.
    rotationPeriod number
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule string
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotationWindow number
    The rotation window, in seconds.
    verifyConnection boolean
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    host str
    The name of the host where this account exists.
    mount str
    The path where the OS secrets engine is mounted.
    password_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    username str
    The username of the operating system account on the remote host.
    custom_metadata Mapping[str, str]
    Custom metadata associated with the account.
    disable_automated_rotation bool
    Disables automated rotation for the account.
    name str
    Unique name for the account within the host.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    parent_account_ref str
    Reference to a parent account that manages rotation for this account.
    password_policy str
    Password policy to use for generated passwords.
    rotation_period int
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotation_schedule str
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotation_window int
    The rotation window, in seconds.
    verify_connection bool
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    host String
    The name of the host where this account exists.
    mount String
    The path where the OS secrets engine is mounted.
    passwordWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    username String
    The username of the operating system account on the remote host.
    customMetadata Map<String>
    Custom metadata associated with the account.
    disableAutomatedRotation Boolean
    Disables automated rotation for the account.
    name String
    Unique name for the account within the host.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    parentAccountRef String
    Reference to a parent account that manages rotation for this account.
    passwordPolicy String
    Password policy to use for generated passwords.
    rotationPeriod Number
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule String
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotationWindow Number
    The rotation window, in seconds.
    verifyConnection Boolean
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendAccount resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    LastVaultRotation string
    (Computed) The timestamp of the last password rotation performed by Vault.
    NextVaultRotation string
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastVaultRotation string
    (Computed) The timestamp of the last password rotation performed by Vault.
    NextVaultRotation string
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    id string
    The provider-assigned unique ID for this managed resource.
    last_vault_rotation string
    (Computed) The timestamp of the last password rotation performed by Vault.
    next_vault_rotation string
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    id String
    The provider-assigned unique ID for this managed resource.
    lastVaultRotation String
    (Computed) The timestamp of the last password rotation performed by Vault.
    nextVaultRotation String
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    id string
    The provider-assigned unique ID for this managed resource.
    lastVaultRotation string
    (Computed) The timestamp of the last password rotation performed by Vault.
    nextVaultRotation string
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    id str
    The provider-assigned unique ID for this managed resource.
    last_vault_rotation str
    (Computed) The timestamp of the last password rotation performed by Vault.
    next_vault_rotation str
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    id String
    The provider-assigned unique ID for this managed resource.
    lastVaultRotation String
    (Computed) The timestamp of the last password rotation performed by Vault.
    nextVaultRotation String
    (Computed) The timestamp when the next password rotation is scheduled to occur.

    Look up Existing SecretBackendAccount Resource

    Get an existing SecretBackendAccount resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendAccountState, opts?: CustomResourceOptions): SecretBackendAccount
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        custom_metadata: Optional[Mapping[str, str]] = None,
        disable_automated_rotation: Optional[bool] = None,
        host: Optional[str] = None,
        last_vault_rotation: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        next_vault_rotation: Optional[str] = None,
        parent_account_ref: Optional[str] = None,
        password_policy: Optional[str] = None,
        password_wo: Optional[str] = None,
        rotation_period: Optional[int] = None,
        rotation_schedule: Optional[str] = None,
        rotation_window: Optional[int] = None,
        username: Optional[str] = None,
        verify_connection: Optional[bool] = None) -> SecretBackendAccount
    func GetSecretBackendAccount(ctx *Context, name string, id IDInput, state *SecretBackendAccountState, opts ...ResourceOption) (*SecretBackendAccount, error)
    public static SecretBackendAccount Get(string name, Input<string> id, SecretBackendAccountState? state, CustomResourceOptions? opts = null)
    public static SecretBackendAccount get(String name, Output<String> id, SecretBackendAccountState state, CustomResourceOptions options)
    resources:  _:    type: vault:os:SecretBackendAccount    get:      id: ${id}
    import {
  to = vault_os_secret_backend_account.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CustomMetadata Dictionary<string, string>
    Custom metadata associated with the account.
    DisableAutomatedRotation bool
    Disables automated rotation for the account.
    Host string
    The name of the host where this account exists.
    LastVaultRotation string
    (Computed) The timestamp of the last password rotation performed by Vault.
    Mount string
    The path where the OS secrets engine is mounted.
    Name string
    Unique name for the account within the host.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NextVaultRotation string
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    ParentAccountRef string
    Reference to a parent account that manages rotation for this account.
    PasswordPolicy string
    Password policy to use for generated passwords.
    PasswordWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    RotationPeriod int
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    RotationSchedule string
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    RotationWindow int
    The rotation window, in seconds.
    Username string
    The username of the operating system account on the remote host.
    VerifyConnection bool
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    CustomMetadata map[string]string
    Custom metadata associated with the account.
    DisableAutomatedRotation bool
    Disables automated rotation for the account.
    Host string
    The name of the host where this account exists.
    LastVaultRotation string
    (Computed) The timestamp of the last password rotation performed by Vault.
    Mount string
    The path where the OS secrets engine is mounted.
    Name string
    Unique name for the account within the host.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NextVaultRotation string
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    ParentAccountRef string
    Reference to a parent account that manages rotation for this account.
    PasswordPolicy string
    Password policy to use for generated passwords.
    PasswordWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    RotationPeriod int
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    RotationSchedule string
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    RotationWindow int
    The rotation window, in seconds.
    Username string
    The username of the operating system account on the remote host.
    VerifyConnection bool
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    custom_metadata map(string)
    Custom metadata associated with the account.
    disable_automated_rotation bool
    Disables automated rotation for the account.
    host string
    The name of the host where this account exists.
    last_vault_rotation string
    (Computed) The timestamp of the last password rotation performed by Vault.
    mount string
    The path where the OS secrets engine is mounted.
    name string
    Unique name for the account within the host.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    next_vault_rotation string
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    parent_account_ref string
    Reference to a parent account that manages rotation for this account.
    password_policy string
    Password policy to use for generated passwords.
    password_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    rotation_period number
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotation_schedule string
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotation_window number
    The rotation window, in seconds.
    username string
    The username of the operating system account on the remote host.
    verify_connection bool
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    customMetadata Map<String,String>
    Custom metadata associated with the account.
    disableAutomatedRotation Boolean
    Disables automated rotation for the account.
    host String
    The name of the host where this account exists.
    lastVaultRotation String
    (Computed) The timestamp of the last password rotation performed by Vault.
    mount String
    The path where the OS secrets engine is mounted.
    name String
    Unique name for the account within the host.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    nextVaultRotation String
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    parentAccountRef String
    Reference to a parent account that manages rotation for this account.
    passwordPolicy String
    Password policy to use for generated passwords.
    passwordWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    rotationPeriod Integer
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule String
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotationWindow Integer
    The rotation window, in seconds.
    username String
    The username of the operating system account on the remote host.
    verifyConnection Boolean
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    customMetadata {[key: string]: string}
    Custom metadata associated with the account.
    disableAutomatedRotation boolean
    Disables automated rotation for the account.
    host string
    The name of the host where this account exists.
    lastVaultRotation string
    (Computed) The timestamp of the last password rotation performed by Vault.
    mount string
    The path where the OS secrets engine is mounted.
    name string
    Unique name for the account within the host.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    nextVaultRotation string
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    parentAccountRef string
    Reference to a parent account that manages rotation for this account.
    passwordPolicy string
    Password policy to use for generated passwords.
    passwordWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    rotationPeriod number
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule string
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotationWindow number
    The rotation window, in seconds.
    username string
    The username of the operating system account on the remote host.
    verifyConnection boolean
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    custom_metadata Mapping[str, str]
    Custom metadata associated with the account.
    disable_automated_rotation bool
    Disables automated rotation for the account.
    host str
    The name of the host where this account exists.
    last_vault_rotation str
    (Computed) The timestamp of the last password rotation performed by Vault.
    mount str
    The path where the OS secrets engine is mounted.
    name str
    Unique name for the account within the host.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    next_vault_rotation str
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    parent_account_ref str
    Reference to a parent account that manages rotation for this account.
    password_policy str
    Password policy to use for generated passwords.
    password_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    rotation_period int
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotation_schedule str
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotation_window int
    The rotation window, in seconds.
    username str
    The username of the operating system account on the remote host.
    verify_connection bool
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.
    customMetadata Map<String>
    Custom metadata associated with the account.
    disableAutomatedRotation Boolean
    Disables automated rotation for the account.
    host String
    The name of the host where this account exists.
    lastVaultRotation String
    (Computed) The timestamp of the last password rotation performed by Vault.
    mount String
    The path where the OS secrets engine is mounted.
    name String
    Unique name for the account within the host.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    nextVaultRotation String
    (Computed) The timestamp when the next password rotation is scheduled to occur.
    parentAccountRef String
    Reference to a parent account that manages rotation for this account.
    passwordPolicy String
    Password policy to use for generated passwords.
    passwordWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see "Password Management" section below). Changing this value will force resource recreation.
    rotationPeriod Number
    The period between automatic password rotations, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule String
    A cron-style schedule for password rotation (for example, "0 3 * * 0"). Mutually exclusive with rotationPeriod.
    rotationWindow Number
    The rotation window, in seconds.
    username String
    The username of the operating system account on the remote host.
    verifyConnection Boolean
    Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to true.

    Import

    OS Secret backend account can be imported using the format <mount>/hosts/<host>/accounts/<name>, e.g.

    $ pulumi import vault:os/secretBackendAccount:SecretBackendAccount admin os/hosts/web-server/accounts/admin-account

    Note: When importing, the passwordWo field will not be populated since it is write-only. You must provide a placeholder value in your configuration (e.g., passwordWo = "PLACEHOLDER"). After import, use lifecycle { ignoreChanges = [passwordWo] } to prevent Terraform from trying to recreate the resource.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.11.1
    published on Tuesday, Aug 11, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial