Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. pkiexternalca
  6. SecretBackendAcmeAccount
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.pkiexternalca.SecretBackendAcmeAccount

vault logo
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages ACME accounts for external CA integration. This resource allows you to configure an ACME account that can be used to obtain certificates from external ACME-compliant Certificate Authorities.

    Important All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform, and will appear in the console output when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const pki_external_ca = new vault.Mount("pki-external-ca", {
    path: "pki-external-ca",
    type: "pki-external-ca",
});
const example = new vault.pkiexternalca.SecretBackendAcmeAccount("example", {
    mount: pki_external_ca.path,
    name: "my-acme-account",
    directoryUrl: "https://acme-v02.api.letsencrypt.org/directory",
    emailContacts: ["admin@example.com"],
    keyType: "ec-256",
});

    import pulumi
import pulumi_vault as vault

pki_external_ca = vault.Mount("pki-external-ca",
    path="pki-external-ca",
    type="pki-external-ca")
example = vault.pkiexternalca.SecretBackendAcmeAccount("example",
    mount=pki_external_ca.path,
    name="my-acme-account",
    directory_url="https://acme-v02.api.letsencrypt.org/directory",
    email_contacts=["admin@example.com"],
    key_type="ec-256")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki_external_ca, err := vault.NewMount(ctx, "pki-external-ca", &vault.MountArgs{
			Path: pulumi.String("pki-external-ca"),
			Type: pulumi.String("pki-external-ca"),
		})
		if err != nil {
			return err
		}
		_, err = pkiexternalca.NewSecretBackendAcmeAccount(ctx, "example", &pkiexternalca.SecretBackendAcmeAccountArgs{
			Mount:        pki_external_ca.Path,
			Name:         pulumi.String("my-acme-account"),
			DirectoryUrl: pulumi.String("https://acme-v02.api.letsencrypt.org/directory"),
			EmailContacts: pulumi.StringArray{
				pulumi.String("admin@example.com"),
			},
			KeyType: pulumi.String("ec-256"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki_external_ca = new Vault.Mount("pki-external-ca", new()
    {
        Path = "pki-external-ca",
        Type = "pki-external-ca",
    });

    var example = new Vault.PkiExternalCa.SecretBackendAcmeAccount("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "my-acme-account",
        DirectoryUrl = "https://acme-v02.api.letsencrypt.org/directory",
        EmailContacts = new[]
        {
            "admin@example.com",
        },
        KeyType = "ec-256",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki_external_ca = new Mount("pki-external-ca", MountArgs.builder()
            .path("pki-external-ca")
            .type("pki-external-ca")
            .build());

        var example = new SecretBackendAcmeAccount("example", SecretBackendAcmeAccountArgs.builder()
            .mount(pki_external_ca.path())
            .name("my-acme-account")
            .directoryUrl("https://acme-v02.api.letsencrypt.org/directory")
            .emailContacts("admin@example.com")
            .keyType("ec-256")
            .build());

    }
}

    resources:
  pki-external-ca:
    type: vault:Mount
    properties:
      path: pki-external-ca
      type: pki-external-ca
  example:
    type: vault:pkiexternalca:SecretBackendAcmeAccount
    properties:
      mount: ${["pki-external-ca"].path}
      name: my-acme-account
      directoryUrl: https://acme-v02.api.letsencrypt.org/directory
      emailContacts:
        - admin@example.com
      keyType: ec-256

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "pki-external-ca" {
  path = "pki-external-ca"
  type = "pki-external-ca"
}
resource "vault_pkiexternalca_secretbackendacmeaccount" "example" {
  mount          = vault_mount.pki-external-ca.path
  name           = "my-acme-account"
  directory_url  = "https://acme-v02.api.letsencrypt.org/directory"
  email_contacts = ["admin@example.com"]
  key_type       = "ec-256"
}

    With External Account Binding (EAB)

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const withEab = new vault.pkiexternalca.SecretBackendAcmeAccount("with_eab", {
    mount: pki_external_ca.path,
    name: "my-acme-account-eab",
    directoryUrl: "https://acme.example.com/directory",
    emailContacts: ["admin@example.com"],
    keyType: "rsa-2048",
    eabKid: "your-eab-key-id",
    eabKey: "your-eab-hmac-key",
});

    import pulumi
import pulumi_vault as vault

with_eab = vault.pkiexternalca.SecretBackendAcmeAccount("with_eab",
    mount=pki_external_ca["path"],
    name="my-acme-account-eab",
    directory_url="https://acme.example.com/directory",
    email_contacts=["admin@example.com"],
    key_type="rsa-2048",
    eab_kid="your-eab-key-id",
    eab_key="your-eab-hmac-key")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, "with_eab", &pkiexternalca.SecretBackendAcmeAccountArgs{
			Mount:        pulumi.Any(pki_external_ca.Path),
			Name:         pulumi.String("my-acme-account-eab"),
			DirectoryUrl: pulumi.String("https://acme.example.com/directory"),
			EmailContacts: pulumi.StringArray{
				pulumi.String("admin@example.com"),
			},
			KeyType: pulumi.String("rsa-2048"),
			EabKid:  pulumi.String("your-eab-key-id"),
			EabKey:  pulumi.String("your-eab-hmac-key"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var withEab = new Vault.PkiExternalCa.SecretBackendAcmeAccount("with_eab", new()
    {
        Mount = pki_external_ca.Path,
        Name = "my-acme-account-eab",
        DirectoryUrl = "https://acme.example.com/directory",
        EmailContacts = new[]
        {
            "admin@example.com",
        },
        KeyType = "rsa-2048",
        EabKid = "your-eab-key-id",
        EabKey = "your-eab-hmac-key",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var withEab = new SecretBackendAcmeAccount("withEab", SecretBackendAcmeAccountArgs.builder()
            .mount(pki_external_ca.path())
            .name("my-acme-account-eab")
            .directoryUrl("https://acme.example.com/directory")
            .emailContacts("admin@example.com")
            .keyType("rsa-2048")
            .eabKid("your-eab-key-id")
            .eabKey("your-eab-hmac-key")
            .build());

    }
}

    resources:
  withEab:
    type: vault:pkiexternalca:SecretBackendAcmeAccount
    name: with_eab
    properties:
      mount: ${["pki-external-ca"].path}
      name: my-acme-account-eab
      directoryUrl: https://acme.example.com/directory
      emailContacts:
        - admin@example.com
      keyType: rsa-2048
      eabKid: your-eab-key-id
      eabKey: your-eab-hmac-key

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_pkiexternalca_secretbackendacmeaccount" "with_eab" {
  mount          = pki-external-ca.path
  name           = "my-acme-account-eab"
  directory_url  = "https://acme.example.com/directory"
  email_contacts = ["admin@example.com"]
  key_type       = "rsa-2048"
  eab_kid        = "your-eab-key-id"
  eab_key        = "your-eab-hmac-key"
}

    Create SecretBackendAcmeAccount Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendAcmeAccount(name: string, args: SecretBackendAcmeAccountArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendAcmeAccount(resource_name: str,
                             args: SecretBackendAcmeAccountArgs,
                             opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendAcmeAccount(resource_name: str,
                             opts: Optional[ResourceOptions] = None,
                             directory_url: Optional[str] = None,
                             email_contacts: Optional[Sequence[str]] = None,
                             mount: Optional[str] = None,
                             eab_key: Optional[str] = None,
                             eab_kid: Optional[str] = None,
                             key_type: Optional[str] = None,
                             name: Optional[str] = None,
                             namespace: Optional[str] = None,
                             trusted_ca: Optional[str] = None)
    func NewSecretBackendAcmeAccount(ctx *Context, name string, args SecretBackendAcmeAccountArgs, opts ...ResourceOption) (*SecretBackendAcmeAccount, error)
    public SecretBackendAcmeAccount(string name, SecretBackendAcmeAccountArgs args, CustomResourceOptions? opts = null)
    public SecretBackendAcmeAccount(String name, SecretBackendAcmeAccountArgs args)
public SecretBackendAcmeAccount(String name, SecretBackendAcmeAccountArgs args, CustomResourceOptions options)

    type: vault:pkiexternalca:SecretBackendAcmeAccount
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_pkiexternalca_secret_backend_acme_account" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendAcmeAccountArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendAcmeAccountArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendAcmeAccountArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendAcmeAccountArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendAcmeAccountArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretBackendAcmeAccountResource = new Vault.PkiExternalCa.SecretBackendAcmeAccount("secretBackendAcmeAccountResource", new()
{
    DirectoryUrl = "string",
    EmailContacts = new[]
    {
        "string",
    },
    Mount = "string",
    EabKey = "string",
    EabKid = "string",
    KeyType = "string",
    Name = "string",
    Namespace = "string",
    TrustedCa = "string",
});

    example, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, "secretBackendAcmeAccountResource", &pkiexternalca.SecretBackendAcmeAccountArgs{
	DirectoryUrl: pulumi.String("string"),
	EmailContacts: pulumi.StringArray{
		pulumi.String("string"),
	},
	Mount:     pulumi.String("string"),
	EabKey:    pulumi.String("string"),
	EabKid:    pulumi.String("string"),
	KeyType:   pulumi.String("string"),
	Name:      pulumi.String("string"),
	Namespace: pulumi.String("string"),
	TrustedCa: pulumi.String("string"),
})

    resource "vault_pkiexternalca_secret_backend_acme_account" "secretBackendAcmeAccountResource" {
  lifecycle {
    create_before_destroy = true
  }
  directory_url  = "string"
  email_contacts = ["string"]
  mount          = "string"
  eab_key        = "string"
  eab_kid        = "string"
  key_type       = "string"
  name           = "string"
  namespace      = "string"
  trusted_ca     = "string"
}

    var secretBackendAcmeAccountResource = new SecretBackendAcmeAccount("secretBackendAcmeAccountResource", SecretBackendAcmeAccountArgs.builder()
    .directoryUrl("string")
    .emailContacts("string")
    .mount("string")
    .eabKey("string")
    .eabKid("string")
    .keyType("string")
    .name("string")
    .namespace("string")
    .trustedCa("string")
    .build());

    secret_backend_acme_account_resource = vault.pkiexternalca.SecretBackendAcmeAccount("secretBackendAcmeAccountResource",
    directory_url="string",
    email_contacts=["string"],
    mount="string",
    eab_key="string",
    eab_kid="string",
    key_type="string",
    name="string",
    namespace="string",
    trusted_ca="string")

    const secretBackendAcmeAccountResource = new vault.pkiexternalca.SecretBackendAcmeAccount("secretBackendAcmeAccountResource", {
    directoryUrl: "string",
    emailContacts: ["string"],
    mount: "string",
    eabKey: "string",
    eabKid: "string",
    keyType: "string",
    name: "string",
    namespace: "string",
    trustedCa: "string",
});

    type: vault:pkiexternalca:SecretBackendAcmeAccount
properties:
    directoryUrl: string
    eabKey: string
    eabKid: string
    emailContacts:
        - string
    keyType: string
    mount: string
    name: string
    namespace: string
    trustedCa: string

    SecretBackendAcmeAccount Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendAcmeAccount resource accepts the following input properties:

    DirectoryUrl string
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    EmailContacts List<string>
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    Mount string
    The path where the PKI secret backend is mounted.
    EabKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    EabKid string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    KeyType string
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    Name string
    Name of the ACME account. Must be unique within the backend.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    TrustedCa string
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    DirectoryUrl string
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    EmailContacts []string
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    Mount string
    The path where the PKI secret backend is mounted.
    EabKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    EabKid string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    KeyType string
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    Name string
    Name of the ACME account. Must be unique within the backend.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    TrustedCa string
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    directory_url string
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    email_contacts list(string)
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    mount string
    The path where the PKI secret backend is mounted.
    eab_key string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eab_kid string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    key_type string
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    name string
    Name of the ACME account. Must be unique within the backend.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trusted_ca string
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    directoryUrl String
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    emailContacts List<String>
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    mount String
    The path where the PKI secret backend is mounted.
    eabKey String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eabKid String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    keyType String
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    name String
    Name of the ACME account. Must be unique within the backend.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trustedCa String
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    directoryUrl string
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    emailContacts string[]
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    mount string
    The path where the PKI secret backend is mounted.
    eabKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eabKid string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    keyType string
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    name string
    Name of the ACME account. Must be unique within the backend.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trustedCa string
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    directory_url str
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    email_contacts Sequence[str]
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    mount str
    The path where the PKI secret backend is mounted.
    eab_key str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eab_kid str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    key_type str
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    name str
    Name of the ACME account. Must be unique within the backend.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trusted_ca str
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    directoryUrl String
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    emailContacts List<String>
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    mount String
    The path where the PKI secret backend is mounted.
    eabKey String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eabKid String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    keyType String
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    name String
    Name of the ACME account. Must be unique within the backend.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trustedCa String
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendAcmeAccount resource produces the following output properties:

    ActiveKeyVersion int
    Version of the active account key, starts at zero.
    Id string
    The provider-assigned unique ID for this managed resource.
    ActiveKeyVersion int
    Version of the active account key, starts at zero.
    Id string
    The provider-assigned unique ID for this managed resource.
    active_key_version number
    Version of the active account key, starts at zero.
    id string
    The provider-assigned unique ID for this managed resource.
    activeKeyVersion Integer
    Version of the active account key, starts at zero.
    id String
    The provider-assigned unique ID for this managed resource.
    activeKeyVersion number
    Version of the active account key, starts at zero.
    id string
    The provider-assigned unique ID for this managed resource.
    active_key_version int
    Version of the active account key, starts at zero.
    id str
    The provider-assigned unique ID for this managed resource.
    activeKeyVersion Number
    Version of the active account key, starts at zero.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecretBackendAcmeAccount Resource

    Get an existing SecretBackendAcmeAccount resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendAcmeAccountState, opts?: CustomResourceOptions): SecretBackendAcmeAccount
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        active_key_version: Optional[int] = None,
        directory_url: Optional[str] = None,
        eab_key: Optional[str] = None,
        eab_kid: Optional[str] = None,
        email_contacts: Optional[Sequence[str]] = None,
        key_type: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        trusted_ca: Optional[str] = None) -> SecretBackendAcmeAccount
    func GetSecretBackendAcmeAccount(ctx *Context, name string, id IDInput, state *SecretBackendAcmeAccountState, opts ...ResourceOption) (*SecretBackendAcmeAccount, error)
    public static SecretBackendAcmeAccount Get(string name, Input<string> id, SecretBackendAcmeAccountState? state, CustomResourceOptions? opts = null)
    public static SecretBackendAcmeAccount get(String name, Output<String> id, SecretBackendAcmeAccountState state, CustomResourceOptions options)
    resources:  _:    type: vault:pkiexternalca:SecretBackendAcmeAccount    get:      id: ${id}
    import {
  to = vault_pkiexternalca_secret_backend_acme_account.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ActiveKeyVersion int
    Version of the active account key, starts at zero.
    DirectoryUrl string
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    EabKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    EabKid string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    EmailContacts List<string>
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    KeyType string
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    Mount string
    The path where the PKI secret backend is mounted.
    Name string
    Name of the ACME account. Must be unique within the backend.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    TrustedCa string
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    ActiveKeyVersion int
    Version of the active account key, starts at zero.
    DirectoryUrl string
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    EabKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    EabKid string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    EmailContacts []string
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    KeyType string
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    Mount string
    The path where the PKI secret backend is mounted.
    Name string
    Name of the ACME account. Must be unique within the backend.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    TrustedCa string
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    active_key_version number
    Version of the active account key, starts at zero.
    directory_url string
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    eab_key string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eab_kid string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    email_contacts list(string)
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    key_type string
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    mount string
    The path where the PKI secret backend is mounted.
    name string
    Name of the ACME account. Must be unique within the backend.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trusted_ca string
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    activeKeyVersion Integer
    Version of the active account key, starts at zero.
    directoryUrl String
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    eabKey String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eabKid String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    emailContacts List<String>
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    keyType String
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    mount String
    The path where the PKI secret backend is mounted.
    name String
    Name of the ACME account. Must be unique within the backend.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trustedCa String
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    activeKeyVersion number
    Version of the active account key, starts at zero.
    directoryUrl string
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    eabKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eabKid string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    emailContacts string[]
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    keyType string
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    mount string
    The path where the PKI secret backend is mounted.
    name string
    Name of the ACME account. Must be unique within the backend.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trustedCa string
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    active_key_version int
    Version of the active account key, starts at zero.
    directory_url str
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    eab_key str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eab_kid str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    email_contacts Sequence[str]
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    key_type str
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    mount str
    The path where the PKI secret backend is mounted.
    name str
    Name of the ACME account. Must be unique within the backend.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trusted_ca str
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.
    activeKeyVersion Number
    Version of the active account key, starts at zero.
    directoryUrl String
    ACME Directory URL for the Certificate Authority (e.g., https://acme-v02.api.letsencrypt.org/directory for Let's Encrypt production).
    eabKey String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.
    eabKid String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.
    emailContacts List<String>
    List of email addresses for the ACME account. These will be used for important notifications from the CA.
    keyType String
    Key type to generate for the account key. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096, rsa-8192. Defaults to ec-256.
    mount String
    The path where the PKI secret backend is mounted.
    name String
    Name of the ACME account. Must be unique within the backend.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trustedCa String
    PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.

    Import

    PKI ACME accounts can be imported using the format <mount>/config/acme-account/<name>, e.g.

    $ terraform import vault_pki_external_ca_secret_backend_acme_account.example pki-external-ca/config/acme-account/my-acme-account

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo
    Viewing docs for HashiCorp Vault v7.11.0
    published on Wednesday, Jul 22, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial