Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. os
  6. SecretBackendHost
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.os.SecretBackendHost

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages host configurations in the OS Secrets Engine. Hosts represent remote systems where Vault will manage operating system account credentials via SSH. This resource requires Vault 2.0.0 or later.

    The OS Secrets Engine mount itself is managed separately, typically with vault.Mount. This resource manages hosts beneath an existing OS mount.

    Before mounting the OS Secrets Engine, the external OS plugin must already be registered in Vault’s plugin catalog. You can register it with the vault.Plugin resource.

    The examples below use the canonical plugin name vault-plugin-secrets-os. If your Vault cluster registers the OS plugin under a different catalog name, use that name in vault_mount.type instead.

    See the Vault documentation for more information.

    Example Usage

    Register Plugin And Configure Host

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Plugin("os", {
    type: "secret",
    name: "vault-plugin-secrets-os",
    version: "v0.1.0+ent",
});
const osMount = new vault.Mount("os", {
    path: "os",
    type: os.name,
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: osMount.path});
const example = new vault.os.SecretBackendHost("example", {
    mount: osSecretBackend.mount,
    name: "web-server-01",
    address: "192.168.1.100",
    port: 22,
});

    import pulumi
import pulumi_vault as vault

os = vault.Plugin("os",
    type="secret",
    name="vault-plugin-secrets-os",
    version="v0.1.0+ent")
os_mount = vault.Mount("os",
    path="os",
    type=os.name)
os_secret_backend = vault.os.SecretBackend("os", mount=os_mount.path)
example = vault.os.SecretBackendHost("example",
    mount=os_secret_backend.mount,
    name="web-server-01",
    address="192.168.1.100",
    port=22)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewPlugin(ctx, "os", &vault.PluginArgs{
			Type:    pulumi.String("secret"),
			Name:    pulumi.String("vault-plugin-secrets-os"),
			Version: pulumi.String("v0.1.0+ent"),
		})
		if err != nil {
			return err
		}
		osMount, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: os2.Name,
		})
		if err != nil {
			return err
		}
		osSecretBackend, err := os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: osMount.Path,
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackendHost(ctx, "example", &os.SecretBackendHostArgs{
			Mount:   osSecretBackend.Mount,
			Name:    pulumi.String("web-server-01"),
			Address: pulumi.String("192.168.1.100"),
			Port:    pulumi.Int(22),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Plugin("os", new()
    {
        Type = "secret",
        Name = "vault-plugin-secrets-os",
        Version = "v0.1.0+ent",
    });

    var osMount = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = os.Name,
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = osMount.Path,
    });

    var example = new Vault.Os.SecretBackendHost("example", new()
    {
        Mount = osSecretBackend.Mount,
        Name = "web-server-01",
        Address = "192.168.1.100",
        Port = 22,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Plugin;
import com.pulumi.vault.PluginArgs;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import com.pulumi.vault.os.SecretBackendHost;
import com.pulumi.vault.os.SecretBackendHostArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Plugin("os", PluginArgs.builder()
            .type("secret")
            .name("vault-plugin-secrets-os")
            .version("v0.1.0+ent")
            .build());

        var osMount = new Mount("osMount", MountArgs.builder()
            .path("os")
            .type(os.name())
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(osMount.path())
            .build());

        var example = new SecretBackendHost("example", SecretBackendHostArgs.builder()
            .mount(osSecretBackend.mount())
            .name("web-server-01")
            .address("192.168.1.100")
            .port(22)
            .build());

    }
}

    resources:
  os:
    type: vault:Plugin
    properties:
      type: secret
      name: vault-plugin-secrets-os
      version: v0.1.0+ent
  osMount:
    type: vault:Mount
    name: os
    properties:
      path: os
      type: ${os.name}
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${osMount.path}
  example:
    type: vault:os:SecretBackendHost
    properties:
      mount: ${osSecretBackend.mount}
      name: web-server-01
      address: 192.168.1.100
      port: 22

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_plugin" "os" {
  type    = "secret"
  name    = "vault-plugin-secrets-os"
  version = "v0.1.0+ent"
}
resource "vault_mount" "os" {
  path = "os"
  type = vault_plugin.os.name
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}
resource "vault_os_secretbackendhost" "example" {
  mount   = vault_os_secretbackend.os.mount
  name    = "web-server-01"
  address = "192.168.1.100"
  port    = 22
}

    Basic Host Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Mount("os", {
    path: "os",
    type: "vault-plugin-secrets-os",
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: os.path});
const example = new vault.os.SecretBackendHost("example", {
    mount: osSecretBackend.mount,
    name: "web-server-01",
    address: "192.168.1.100",
    port: 22,
});

    import pulumi
import pulumi_vault as vault

os = vault.Mount("os",
    path="os",
    type="vault-plugin-secrets-os")
os_secret_backend = vault.os.SecretBackend("os", mount=os.path)
example = vault.os.SecretBackendHost("example",
    mount=os_secret_backend.mount,
    name="web-server-01",
    address="192.168.1.100",
    port=22)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: pulumi.String("vault-plugin-secrets-os"),
		})
		if err != nil {
			return err
		}
		osSecretBackend, err := os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: os2.Path,
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackendHost(ctx, "example", &os.SecretBackendHostArgs{
			Mount:   osSecretBackend.Mount,
			Name:    pulumi.String("web-server-01"),
			Address: pulumi.String("192.168.1.100"),
			Port:    pulumi.Int(22),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = "vault-plugin-secrets-os",
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = os.Path,
    });

    var example = new Vault.Os.SecretBackendHost("example", new()
    {
        Mount = osSecretBackend.Mount,
        Name = "web-server-01",
        Address = "192.168.1.100",
        Port = 22,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import com.pulumi.vault.os.SecretBackendHost;
import com.pulumi.vault.os.SecretBackendHostArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Mount("os", MountArgs.builder()
            .path("os")
            .type("vault-plugin-secrets-os")
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(os.path())
            .build());

        var example = new SecretBackendHost("example", SecretBackendHostArgs.builder()
            .mount(osSecretBackend.mount())
            .name("web-server-01")
            .address("192.168.1.100")
            .port(22)
            .build());

    }
}

    resources:
  os:
    type: vault:Mount
    properties:
      path: os
      type: vault-plugin-secrets-os
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${os.path}
  example:
    type: vault:os:SecretBackendHost
    properties:
      mount: ${osSecretBackend.mount}
      name: web-server-01
      address: 192.168.1.100
      port: 22

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "os" {
  path = "os"
  type = "vault-plugin-secrets-os"
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}
resource "vault_os_secretbackendhost" "example" {
  mount   = vault_os_secretbackend.os.mount
  name    = "web-server-01"
  address = "192.168.1.100"
  port    = 22
}

    Advanced Host Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Mount("os", {
    path: "os",
    type: "vault-plugin-secrets-os",
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: os.path});
const production = new vault.os.SecretBackendHost("production", {
    mount: osSecretBackend.mount,
    name: "prod-db-01",
    address: "10.0.1.50",
    port: 2222,
    rotationSchedule: "0 2 * * *",
    rotationWindow: 3600,
    customMetadata: {
        environment: "production",
        team: "database",
        criticality: "high",
    },
});

    import pulumi
import pulumi_vault as vault

os = vault.Mount("os",
    path="os",
    type="vault-plugin-secrets-os")
os_secret_backend = vault.os.SecretBackend("os", mount=os.path)
production = vault.os.SecretBackendHost("production",
    mount=os_secret_backend.mount,
    name="prod-db-01",
    address="10.0.1.50",
    port=2222,
    rotation_schedule="0 2 * * *",
    rotation_window=3600,
    custom_metadata={
        "environment": "production",
        "team": "database",
        "criticality": "high",
    })

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: pulumi.String("vault-plugin-secrets-os"),
		})
		if err != nil {
			return err
		}
		osSecretBackend, err := os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: os2.Path,
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackendHost(ctx, "production", &os.SecretBackendHostArgs{
			Mount:            osSecretBackend.Mount,
			Name:             pulumi.String("prod-db-01"),
			Address:          pulumi.String("10.0.1.50"),
			Port:             pulumi.Int(2222),
			RotationSchedule: pulumi.String("0 2 * * *"),
			RotationWindow:   pulumi.Int(3600),
			CustomMetadata: pulumi.StringMap{
				"environment": pulumi.String("production"),
				"team":        pulumi.String("database"),
				"criticality": pulumi.String("high"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = "vault-plugin-secrets-os",
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = os.Path,
    });

    var production = new Vault.Os.SecretBackendHost("production", new()
    {
        Mount = osSecretBackend.Mount,
        Name = "prod-db-01",
        Address = "10.0.1.50",
        Port = 2222,
        RotationSchedule = "0 2 * * *",
        RotationWindow = 3600,
        CustomMetadata = 
        {
            { "environment", "production" },
            { "team", "database" },
            { "criticality", "high" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import com.pulumi.vault.os.SecretBackendHost;
import com.pulumi.vault.os.SecretBackendHostArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Mount("os", MountArgs.builder()
            .path("os")
            .type("vault-plugin-secrets-os")
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(os.path())
            .build());

        var production = new SecretBackendHost("production", SecretBackendHostArgs.builder()
            .mount(osSecretBackend.mount())
            .name("prod-db-01")
            .address("10.0.1.50")
            .port(2222)
            .rotationSchedule("0 2 * * *")
            .rotationWindow(3600)
            .customMetadata(Map.ofEntries(
                Map.entry("environment", "production"),
                Map.entry("team", "database"),
                Map.entry("criticality", "high")
            ))
            .build());

    }
}

    resources:
  os:
    type: vault:Mount
    properties:
      path: os
      type: vault-plugin-secrets-os
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${os.path}
  production:
    type: vault:os:SecretBackendHost
    properties:
      mount: ${osSecretBackend.mount}
      name: prod-db-01
      address: 10.0.1.50
      port: 2222
      rotationSchedule: 0 2 * * *
      rotationWindow: 3600
      customMetadata:
        environment: production
        team: database
        criticality: high

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "os" {
  path = "os"
  type = "vault-plugin-secrets-os"
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}
resource "vault_os_secretbackendhost" "production" {
  mount             = vault_os_secretbackend.os.mount
  name              = "prod-db-01"
  address           = "10.0.1.50"
  port              = 2222
  rotation_schedule = "0 2 * * *"
  rotation_window   = 3600
  custom_metadata = {
    "environment" = "production"
    "team"        = "database"
    "criticality" = "high"
  }
}

    Host with SSH Host Key

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const os = new vault.Mount("os", {
    path: "os",
    type: "vault-plugin-secrets-os",
});
const osSecretBackend = new vault.os.SecretBackend("os", {mount: os.path});
const secure = new vault.os.SecretBackendHost("secure", {
    mount: osSecretBackend.mount,
    name: "secure-host",
    address: "192.168.1.200",
    port: 22,
    sshHostKey: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
});

    import pulumi
import pulumi_vault as vault

os = vault.Mount("os",
    path="os",
    type="vault-plugin-secrets-os")
os_secret_backend = vault.os.SecretBackend("os", mount=os.path)
secure = vault.os.SecretBackendHost("secure",
    mount=os_secret_backend.mount,
    name="secure-host",
    address="192.168.1.200",
    port=22,
    ssh_host_key="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		os2, err := vault.NewMount(ctx, "os", &vault.MountArgs{
			Path: pulumi.String("os"),
			Type: pulumi.String("vault-plugin-secrets-os"),
		})
		if err != nil {
			return err
		}
		osSecretBackend, err := os.NewSecretBackend(ctx, "os", &os.SecretBackendArgs{
			Mount: os2.Path,
		})
		if err != nil {
			return err
		}
		_, err = os.NewSecretBackendHost(ctx, "secure", &os.SecretBackendHostArgs{
			Mount:      osSecretBackend.Mount,
			Name:       pulumi.String("secure-host"),
			Address:    pulumi.String("192.168.1.200"),
			Port:       pulumi.Int(22),
			SshHostKey: pulumi.String("ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC..."),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var os = new Vault.Mount("os", new()
    {
        Path = "os",
        Type = "vault-plugin-secrets-os",
    });

    var osSecretBackend = new Vault.Os.SecretBackend("os", new()
    {
        Mount = os.Path,
    });

    var secure = new Vault.Os.SecretBackendHost("secure", new()
    {
        Mount = osSecretBackend.Mount,
        Name = "secure-host",
        Address = "192.168.1.200",
        Port = 22,
        SshHostKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.os.SecretBackend;
import com.pulumi.vault.os.SecretBackendArgs;
import com.pulumi.vault.os.SecretBackendHost;
import com.pulumi.vault.os.SecretBackendHostArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var os = new Mount("os", MountArgs.builder()
            .path("os")
            .type("vault-plugin-secrets-os")
            .build());

        var osSecretBackend = new SecretBackend("osSecretBackend", SecretBackendArgs.builder()
            .mount(os.path())
            .build());

        var secure = new SecretBackendHost("secure", SecretBackendHostArgs.builder()
            .mount(osSecretBackend.mount())
            .name("secure-host")
            .address("192.168.1.200")
            .port(22)
            .sshHostKey("ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...")
            .build());

    }
}

    resources:
  os:
    type: vault:Mount
    properties:
      path: os
      type: vault-plugin-secrets-os
  osSecretBackend:
    type: vault:os:SecretBackend
    name: os
    properties:
      mount: ${os.path}
  secure:
    type: vault:os:SecretBackendHost
    properties:
      mount: ${osSecretBackend.mount}
      name: secure-host
      address: 192.168.1.200
      port: 22
      sshHostKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "os" {
  path = "os"
  type = "vault-plugin-secrets-os"
}
resource "vault_os_secretbackend" "os" {
  mount = vault_mount.os.path
}
resource "vault_os_secretbackendhost" "secure" {
  mount        = vault_os_secretbackend.os.mount
  name         = "secure-host"
  address      = "192.168.1.200"
  port         = 22
  ssh_host_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC..."
}

    Notes

    • This resource requires Vault 2.0.0 or later.
    • The OS Secrets Engine plugin must be registered before the mount is enabled. Use vault.Plugin to manage catalog registration when appropriate.
    • Use vault.Mount to create, tune, or remove the OS Secrets Engine mount before managing hosts with this resource.
    • The host must be configured before accounts can be created on it.
    • When sshHostKey is not provided, the backend’s sshHostKeyTrustOnFirstUse setting determines whether the host key will be automatically trusted on first connection.
    • Use either rotationPeriod or rotationSchedule.
    • Custom metadata is stored alongside the host configuration and can be used for organizational purposes, but does not affect host behavior.
    • Changing mount or name will cause the resource to be recreated.

    Create SecretBackendHost Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendHost(name: string, args: SecretBackendHostArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendHost(resource_name: str,
                      args: SecretBackendHostArgs,
                      opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendHost(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      address: Optional[str] = None,
                      mount: Optional[str] = None,
                      custom_metadata: Optional[Mapping[str, str]] = None,
                      disable_automated_rotation: Optional[bool] = None,
                      name: Optional[str] = None,
                      namespace: Optional[str] = None,
                      password_policy: Optional[str] = None,
                      port: Optional[int] = None,
                      rotation_period: Optional[int] = None,
                      rotation_schedule: Optional[str] = None,
                      rotation_window: Optional[int] = None,
                      ssh_host_key: Optional[str] = None)
    func NewSecretBackendHost(ctx *Context, name string, args SecretBackendHostArgs, opts ...ResourceOption) (*SecretBackendHost, error)
    public SecretBackendHost(string name, SecretBackendHostArgs args, CustomResourceOptions? opts = null)
    public SecretBackendHost(String name, SecretBackendHostArgs args)
public SecretBackendHost(String name, SecretBackendHostArgs args, CustomResourceOptions options)

    type: vault:os:SecretBackendHost
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_os_secret_backend_host" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendHostArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendHostArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendHostArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendHostArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendHostArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretBackendHostResource = new Vault.Os.SecretBackendHost("secretBackendHostResource", new()
{
    Address = "string",
    Mount = "string",
    CustomMetadata = 
    {
        { "string", "string" },
    },
    DisableAutomatedRotation = false,
    Name = "string",
    Namespace = "string",
    PasswordPolicy = "string",
    Port = 0,
    RotationPeriod = 0,
    RotationSchedule = "string",
    RotationWindow = 0,
    SshHostKey = "string",
});

    example, err := os.NewSecretBackendHost(ctx, "secretBackendHostResource", &os.SecretBackendHostArgs{
	Address: pulumi.String("string"),
	Mount:   pulumi.String("string"),
	CustomMetadata: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	DisableAutomatedRotation: pulumi.Bool(false),
	Name:                     pulumi.String("string"),
	Namespace:                pulumi.String("string"),
	PasswordPolicy:           pulumi.String("string"),
	Port:                     pulumi.Int(0),
	RotationPeriod:           pulumi.Int(0),
	RotationSchedule:         pulumi.String("string"),
	RotationWindow:           pulumi.Int(0),
	SshHostKey:               pulumi.String("string"),
})

    resource "vault_os_secret_backend_host" "secretBackendHostResource" {
  lifecycle {
    create_before_destroy = true
  }
  address = "string"
  mount   = "string"
  custom_metadata = {
    "string" = "string"
  }
  disable_automated_rotation = false
  name                       = "string"
  namespace                  = "string"
  password_policy            = "string"
  port                       = 0
  rotation_period            = 0
  rotation_schedule          = "string"
  rotation_window            = 0
  ssh_host_key               = "string"
}

    var secretBackendHostResource = new SecretBackendHost("secretBackendHostResource", SecretBackendHostArgs.builder()
    .address("string")
    .mount("string")
    .customMetadata(Map.of("string", "string"))
    .disableAutomatedRotation(false)
    .name("string")
    .namespace("string")
    .passwordPolicy("string")
    .port(0)
    .rotationPeriod(0)
    .rotationSchedule("string")
    .rotationWindow(0)
    .sshHostKey("string")
    .build());

    secret_backend_host_resource = vault.os.SecretBackendHost("secretBackendHostResource",
    address="string",
    mount="string",
    custom_metadata={
        "string": "string",
    },
    disable_automated_rotation=False,
    name="string",
    namespace="string",
    password_policy="string",
    port=0,
    rotation_period=0,
    rotation_schedule="string",
    rotation_window=0,
    ssh_host_key="string")

    const secretBackendHostResource = new vault.os.SecretBackendHost("secretBackendHostResource", {
    address: "string",
    mount: "string",
    customMetadata: {
        string: "string",
    },
    disableAutomatedRotation: false,
    name: "string",
    namespace: "string",
    passwordPolicy: "string",
    port: 0,
    rotationPeriod: 0,
    rotationSchedule: "string",
    rotationWindow: 0,
    sshHostKey: "string",
});

    type: vault:os:SecretBackendHost
properties:
    address: string
    customMetadata:
        string: string
    disableAutomatedRotation: false
    mount: string
    name: string
    namespace: string
    passwordPolicy: string
    port: 0
    rotationPeriod: 0
    rotationSchedule: string
    rotationWindow: 0
    sshHostKey: string

    SecretBackendHost Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendHost resource accepts the following input properties:

    Address string
    The address of the host (IP address or hostname).
    Mount string
    The path where the OS secrets engine is mounted.
    CustomMetadata Dictionary<string, string>
    A map of string key-value pairs for storing custom metadata about the host.
    DisableAutomatedRotation bool
    Disables automated rotation for the host.
    Name string
    Unique name for the host within the mount.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PasswordPolicy string
    The password policy inherited by accounts on this host unless overridden at the account level.
    Port int
    The port to connect to on the host. Defaults to 22.
    RotationPeriod int
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    RotationSchedule string
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    RotationWindow int
    The rotation window, in seconds. This is typically used with rotationSchedule.
    SshHostKey string
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    Address string
    The address of the host (IP address or hostname).
    Mount string
    The path where the OS secrets engine is mounted.
    CustomMetadata map[string]string
    A map of string key-value pairs for storing custom metadata about the host.
    DisableAutomatedRotation bool
    Disables automated rotation for the host.
    Name string
    Unique name for the host within the mount.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PasswordPolicy string
    The password policy inherited by accounts on this host unless overridden at the account level.
    Port int
    The port to connect to on the host. Defaults to 22.
    RotationPeriod int
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    RotationSchedule string
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    RotationWindow int
    The rotation window, in seconds. This is typically used with rotationSchedule.
    SshHostKey string
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address string
    The address of the host (IP address or hostname).
    mount string
    The path where the OS secrets engine is mounted.
    custom_metadata map(string)
    A map of string key-value pairs for storing custom metadata about the host.
    disable_automated_rotation bool
    Disables automated rotation for the host.
    name string
    Unique name for the host within the mount.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    password_policy string
    The password policy inherited by accounts on this host unless overridden at the account level.
    port number
    The port to connect to on the host. Defaults to 22.
    rotation_period number
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotation_schedule string
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotation_window number
    The rotation window, in seconds. This is typically used with rotationSchedule.
    ssh_host_key string
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address String
    The address of the host (IP address or hostname).
    mount String
    The path where the OS secrets engine is mounted.
    customMetadata Map<String,String>
    A map of string key-value pairs for storing custom metadata about the host.
    disableAutomatedRotation Boolean
    Disables automated rotation for the host.
    name String
    Unique name for the host within the mount.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    passwordPolicy String
    The password policy inherited by accounts on this host unless overridden at the account level.
    port Integer
    The port to connect to on the host. Defaults to 22.
    rotationPeriod Integer
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule String
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotationWindow Integer
    The rotation window, in seconds. This is typically used with rotationSchedule.
    sshHostKey String
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address string
    The address of the host (IP address or hostname).
    mount string
    The path where the OS secrets engine is mounted.
    customMetadata {[key: string]: string}
    A map of string key-value pairs for storing custom metadata about the host.
    disableAutomatedRotation boolean
    Disables automated rotation for the host.
    name string
    Unique name for the host within the mount.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    passwordPolicy string
    The password policy inherited by accounts on this host unless overridden at the account level.
    port number
    The port to connect to on the host. Defaults to 22.
    rotationPeriod number
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule string
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotationWindow number
    The rotation window, in seconds. This is typically used with rotationSchedule.
    sshHostKey string
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address str
    The address of the host (IP address or hostname).
    mount str
    The path where the OS secrets engine is mounted.
    custom_metadata Mapping[str, str]
    A map of string key-value pairs for storing custom metadata about the host.
    disable_automated_rotation bool
    Disables automated rotation for the host.
    name str
    Unique name for the host within the mount.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    password_policy str
    The password policy inherited by accounts on this host unless overridden at the account level.
    port int
    The port to connect to on the host. Defaults to 22.
    rotation_period int
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotation_schedule str
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotation_window int
    The rotation window, in seconds. This is typically used with rotationSchedule.
    ssh_host_key str
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address String
    The address of the host (IP address or hostname).
    mount String
    The path where the OS secrets engine is mounted.
    customMetadata Map<String>
    A map of string key-value pairs for storing custom metadata about the host.
    disableAutomatedRotation Boolean
    Disables automated rotation for the host.
    name String
    Unique name for the host within the mount.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    passwordPolicy String
    The password policy inherited by accounts on this host unless overridden at the account level.
    port Number
    The port to connect to on the host. Defaults to 22.
    rotationPeriod Number
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule String
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotationWindow Number
    The rotation window, in seconds. This is typically used with rotationSchedule.
    sshHostKey String
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendHost resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecretBackendHost Resource

    Get an existing SecretBackendHost resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendHostState, opts?: CustomResourceOptions): SecretBackendHost
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        address: Optional[str] = None,
        custom_metadata: Optional[Mapping[str, str]] = None,
        disable_automated_rotation: Optional[bool] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        password_policy: Optional[str] = None,
        port: Optional[int] = None,
        rotation_period: Optional[int] = None,
        rotation_schedule: Optional[str] = None,
        rotation_window: Optional[int] = None,
        ssh_host_key: Optional[str] = None) -> SecretBackendHost
    func GetSecretBackendHost(ctx *Context, name string, id IDInput, state *SecretBackendHostState, opts ...ResourceOption) (*SecretBackendHost, error)
    public static SecretBackendHost Get(string name, Input<string> id, SecretBackendHostState? state, CustomResourceOptions? opts = null)
    public static SecretBackendHost get(String name, Output<String> id, SecretBackendHostState state, CustomResourceOptions options)
    resources:  _:    type: vault:os:SecretBackendHost    get:      id: ${id}
    import {
  to = vault_os_secret_backend_host.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Address string
    The address of the host (IP address or hostname).
    CustomMetadata Dictionary<string, string>
    A map of string key-value pairs for storing custom metadata about the host.
    DisableAutomatedRotation bool
    Disables automated rotation for the host.
    Mount string
    The path where the OS secrets engine is mounted.
    Name string
    Unique name for the host within the mount.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PasswordPolicy string
    The password policy inherited by accounts on this host unless overridden at the account level.
    Port int
    The port to connect to on the host. Defaults to 22.
    RotationPeriod int
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    RotationSchedule string
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    RotationWindow int
    The rotation window, in seconds. This is typically used with rotationSchedule.
    SshHostKey string
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    Address string
    The address of the host (IP address or hostname).
    CustomMetadata map[string]string
    A map of string key-value pairs for storing custom metadata about the host.
    DisableAutomatedRotation bool
    Disables automated rotation for the host.
    Mount string
    The path where the OS secrets engine is mounted.
    Name string
    Unique name for the host within the mount.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PasswordPolicy string
    The password policy inherited by accounts on this host unless overridden at the account level.
    Port int
    The port to connect to on the host. Defaults to 22.
    RotationPeriod int
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    RotationSchedule string
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    RotationWindow int
    The rotation window, in seconds. This is typically used with rotationSchedule.
    SshHostKey string
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address string
    The address of the host (IP address or hostname).
    custom_metadata map(string)
    A map of string key-value pairs for storing custom metadata about the host.
    disable_automated_rotation bool
    Disables automated rotation for the host.
    mount string
    The path where the OS secrets engine is mounted.
    name string
    Unique name for the host within the mount.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    password_policy string
    The password policy inherited by accounts on this host unless overridden at the account level.
    port number
    The port to connect to on the host. Defaults to 22.
    rotation_period number
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotation_schedule string
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotation_window number
    The rotation window, in seconds. This is typically used with rotationSchedule.
    ssh_host_key string
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address String
    The address of the host (IP address or hostname).
    customMetadata Map<String,String>
    A map of string key-value pairs for storing custom metadata about the host.
    disableAutomatedRotation Boolean
    Disables automated rotation for the host.
    mount String
    The path where the OS secrets engine is mounted.
    name String
    Unique name for the host within the mount.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    passwordPolicy String
    The password policy inherited by accounts on this host unless overridden at the account level.
    port Integer
    The port to connect to on the host. Defaults to 22.
    rotationPeriod Integer
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule String
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotationWindow Integer
    The rotation window, in seconds. This is typically used with rotationSchedule.
    sshHostKey String
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address string
    The address of the host (IP address or hostname).
    customMetadata {[key: string]: string}
    A map of string key-value pairs for storing custom metadata about the host.
    disableAutomatedRotation boolean
    Disables automated rotation for the host.
    mount string
    The path where the OS secrets engine is mounted.
    name string
    Unique name for the host within the mount.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    passwordPolicy string
    The password policy inherited by accounts on this host unless overridden at the account level.
    port number
    The port to connect to on the host. Defaults to 22.
    rotationPeriod number
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule string
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotationWindow number
    The rotation window, in seconds. This is typically used with rotationSchedule.
    sshHostKey string
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address str
    The address of the host (IP address or hostname).
    custom_metadata Mapping[str, str]
    A map of string key-value pairs for storing custom metadata about the host.
    disable_automated_rotation bool
    Disables automated rotation for the host.
    mount str
    The path where the OS secrets engine is mounted.
    name str
    Unique name for the host within the mount.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    password_policy str
    The password policy inherited by accounts on this host unless overridden at the account level.
    port int
    The port to connect to on the host. Defaults to 22.
    rotation_period int
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotation_schedule str
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotation_window int
    The rotation window, in seconds. This is typically used with rotationSchedule.
    ssh_host_key str
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.
    address String
    The address of the host (IP address or hostname).
    customMetadata Map<String>
    A map of string key-value pairs for storing custom metadata about the host.
    disableAutomatedRotation Boolean
    Disables automated rotation for the host.
    mount String
    The path where the OS secrets engine is mounted.
    name String
    Unique name for the host within the mount.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    passwordPolicy String
    The password policy inherited by accounts on this host unless overridden at the account level.
    port Number
    The port to connect to on the host. Defaults to 22.
    rotationPeriod Number
    How often to rotate credentials, in seconds. Mutually exclusive with rotationSchedule.
    rotationSchedule String
    A cron-style schedule for credential rotation (for example, "0 2 * * *"). Mutually exclusive with rotationPeriod.
    rotationWindow Number
    The rotation window, in seconds. This is typically used with rotationSchedule.
    sshHostKey String
    The SSH host key for the remote host. If not provided and sshHostKeyTrustOnFirstUse is enabled on the backend, Vault can learn and persist the key on first connection.

    Import

    OS Secret backend host can be imported using the format <mount>/hosts/<name>, e.g.

    $ pulumi import vault:os/secretBackendHost:SecretBackendHost example os/hosts/web-server-01

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial