Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. pkiexternalca
  6. SecretBackendDnsProviderAwsRoute53
Viewing docs for HashiCorp Vault v7.13.0
published on Friday, Sep 18, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.pkiexternalca.SecretBackendDnsProviderAwsRoute53

vault logo vault logo
Viewing docs for HashiCorp Vault v7.13.0
published on Friday, Sep 18, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages an AWS Route53 DNS provider configuration for PKI External CA DNS-01 ACME challenges.

    Important All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform, and will appear in the console output when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.

    This resource requires Vault 2.1.0 or later.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const pki_external_ca = new vault.Mount("pki-external-ca", {
    path: "pki-external-ca",
    type: "pki-external-ca",
});
const example = new vault.pkiexternalca.SecretBackendDnsProviderAwsRoute53("example", {
    mount: pki_external_ca.path,
    name: "my-route53-provider",
    identifiers: [
        "example.com",
        "*.example.com",
    ],
    region: "us-east-1",
    hostedZoneId: "Z1234567890ABC",
    assumeRoleArn: "arn:aws:iam::123456789012:role/vault-dns-role",
});

    import pulumi
import pulumi_vault as vault

pki_external_ca = vault.Mount("pki-external-ca",
    path="pki-external-ca",
    type="pki-external-ca")
example = vault.pkiexternalca.SecretBackendDnsProviderAwsRoute53("example",
    mount=pki_external_ca.path,
    name="my-route53-provider",
    identifiers=[
        "example.com",
        "*.example.com",
    ],
    region="us-east-1",
    hosted_zone_id="Z1234567890ABC",
    assume_role_arn="arn:aws:iam::123456789012:role/vault-dns-role")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki_external_ca, err := vault.NewMount(ctx, "pki-external-ca", &vault.MountArgs{
			Path: pulumi.String("pki-external-ca"),
			Type: pulumi.String("pki-external-ca"),
		})
		if err != nil {
			return err
		}
		_, err = pkiexternalca.NewSecretBackendDnsProviderAwsRoute53(ctx, "example", &pkiexternalca.SecretBackendDnsProviderAwsRoute53Args{
			Mount: pki_external_ca.Path,
			Name:  pulumi.String("my-route53-provider"),
			Identifiers: pulumi.StringArray{
				pulumi.String("example.com"),
				pulumi.String("*.example.com"),
			},
			Region:        pulumi.String("us-east-1"),
			HostedZoneId:  pulumi.String("Z1234567890ABC"),
			AssumeRoleArn: pulumi.String("arn:aws:iam::123456789012:role/vault-dns-role"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki_external_ca = new Vault.Mount("pki-external-ca", new()
    {
        Path = "pki-external-ca",
        Type = "pki-external-ca",
    });

    var example = new Vault.PkiExternalCa.SecretBackendDnsProviderAwsRoute53("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "my-route53-provider",
        Identifiers = new[]
        {
            "example.com",
            "*.example.com",
        },
        Region = "us-east-1",
        HostedZoneId = "Z1234567890ABC",
        AssumeRoleArn = "arn:aws:iam::123456789012:role/vault-dns-role",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendDnsProviderAwsRoute53;
import com.pulumi.vault.pkiexternalca.SecretBackendDnsProviderAwsRoute53Args;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki_external_ca = new Mount("pki-external-ca", MountArgs.builder()
            .path("pki-external-ca")
            .type("pki-external-ca")
            .build());

        var example = new SecretBackendDnsProviderAwsRoute53("example", SecretBackendDnsProviderAwsRoute53Args.builder()
            .mount(pki_external_ca.path())
            .name("my-route53-provider")
            .identifiers(            
                "example.com",
                "*.example.com")
            .region("us-east-1")
            .hostedZoneId("Z1234567890ABC")
            .assumeRoleArn("arn:aws:iam::123456789012:role/vault-dns-role")
            .build());

    }
}

    resources:
  pki-external-ca:
    type: vault:Mount
    properties:
      path: pki-external-ca
      type: pki-external-ca
  example:
    type: vault:pkiexternalca:SecretBackendDnsProviderAwsRoute53
    properties:
      mount: ${["pki-external-ca"].path}
      name: my-route53-provider
      identifiers:
        - example.com
        - '*.example.com'
      region: us-east-1
      hostedZoneId: Z1234567890ABC
      assumeRoleArn: arn:aws:iam::123456789012:role/vault-dns-role

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "pki-external-ca" {
  path = "pki-external-ca"
  type = "pki-external-ca"
}
resource "vault_pkiexternalca_secretbackenddnsproviderawsroute53" "example" {
  mount           = vault_mount.pki-external-ca.path
  name            = "my-route53-provider"
  identifiers     = ["example.com", "*.example.com"]
  region          = "us-east-1"
  hosted_zone_id  = "Z1234567890ABC"
  assume_role_arn = "arn:aws:iam::123456789012:role/vault-dns-role"
}

    Create SecretBackendDnsProviderAwsRoute53 Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendDnsProviderAwsRoute53(name: string, args: SecretBackendDnsProviderAwsRoute53Args, opts?: CustomResourceOptions);
    @overload
def SecretBackendDnsProviderAwsRoute53(resource_name: str,
                                       args: SecretBackendDnsProviderAwsRoute53Args,
                                       opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendDnsProviderAwsRoute53(resource_name: str,
                                       opts: Optional[ResourceOptions] = None,
                                       identifiers: Optional[Sequence[str]] = None,
                                       mount: Optional[str] = None,
                                       name: Optional[str] = None,
                                       hosted_zone_id: Optional[str] = None,
                                       external_id: Optional[str] = None,
                                       assume_role_arn: Optional[str] = None,
                                       access_key_id: Optional[str] = None,
                                       nameserver: Optional[str] = None,
                                       namespace: Optional[str] = None,
                                       region: Optional[str] = None,
                                       secret_access_key_wo: Optional[str] = None,
                                       secret_access_key_wo_version: Optional[int] = None,
                                       ttl: Optional[int] = None)
    func NewSecretBackendDnsProviderAwsRoute53(ctx *Context, name string, args SecretBackendDnsProviderAwsRoute53Args, opts ...ResourceOption) (*SecretBackendDnsProviderAwsRoute53, error)
    public SecretBackendDnsProviderAwsRoute53(string name, SecretBackendDnsProviderAwsRoute53Args args, CustomResourceOptions? opts = null)
    public SecretBackendDnsProviderAwsRoute53(String name, SecretBackendDnsProviderAwsRoute53Args args)
public SecretBackendDnsProviderAwsRoute53(String name, SecretBackendDnsProviderAwsRoute53Args args, CustomResourceOptions options)

    type: vault:pkiexternalca:SecretBackendDnsProviderAwsRoute53
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_pkiexternalca_secret_backend_dns_provider_aws_route53" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendDnsProviderAwsRoute53Args
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendDnsProviderAwsRoute53Args
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendDnsProviderAwsRoute53Args
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendDnsProviderAwsRoute53Args
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendDnsProviderAwsRoute53Args
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretBackendDnsProviderAwsRoute53Resource = new Vault.PkiExternalCa.SecretBackendDnsProviderAwsRoute53("secretBackendDnsProviderAwsRoute53Resource", new()
{
    Identifiers = new[]
    {
        "string",
    },
    Mount = "string",
    Name = "string",
    HostedZoneId = "string",
    ExternalId = "string",
    AssumeRoleArn = "string",
    AccessKeyId = "string",
    Nameserver = "string",
    Namespace = "string",
    Region = "string",
    SecretAccessKeyWo = "string",
    SecretAccessKeyWoVersion = 0,
    Ttl = 0,
});

    example, err := pkiexternalca.NewSecretBackendDnsProviderAwsRoute53(ctx, "secretBackendDnsProviderAwsRoute53Resource", &pkiexternalca.SecretBackendDnsProviderAwsRoute53Args{
	Identifiers: pulumi.StringArray{
		pulumi.String("string"),
	},
	Mount:                    pulumi.String("string"),
	Name:                     pulumi.String("string"),
	HostedZoneId:             pulumi.String("string"),
	ExternalId:               pulumi.String("string"),
	AssumeRoleArn:            pulumi.String("string"),
	AccessKeyId:              pulumi.String("string"),
	Nameserver:               pulumi.String("string"),
	Namespace:                pulumi.String("string"),
	Region:                   pulumi.String("string"),
	SecretAccessKeyWo:        pulumi.String("string"),
	SecretAccessKeyWoVersion: pulumi.Int(0),
	Ttl:                      pulumi.Int(0),
})

    resource "vault_pkiexternalca_secret_backend_dns_provider_aws_route53" "secretBackendDnsProviderAwsRoute53Resource" {
  lifecycle {
    create_before_destroy = true
  }
  identifiers                  = ["string"]
  mount                        = "string"
  name                         = "string"
  hosted_zone_id               = "string"
  external_id                  = "string"
  assume_role_arn              = "string"
  access_key_id                = "string"
  nameserver                   = "string"
  namespace                    = "string"
  region                       = "string"
  secret_access_key_wo         = "string"
  secret_access_key_wo_version = 0
  ttl                          = 0
}

    var secretBackendDnsProviderAwsRoute53Resource = new SecretBackendDnsProviderAwsRoute53("secretBackendDnsProviderAwsRoute53Resource", SecretBackendDnsProviderAwsRoute53Args.builder()
    .identifiers("string")
    .mount("string")
    .name("string")
    .hostedZoneId("string")
    .externalId("string")
    .assumeRoleArn("string")
    .accessKeyId("string")
    .nameserver("string")
    .namespace("string")
    .region("string")
    .secretAccessKeyWo("string")
    .secretAccessKeyWoVersion(0)
    .ttl(0)
    .build());

    secret_backend_dns_provider_aws_route53_resource = vault.pkiexternalca.SecretBackendDnsProviderAwsRoute53("secretBackendDnsProviderAwsRoute53Resource",
    identifiers=["string"],
    mount="string",
    name="string",
    hosted_zone_id="string",
    external_id="string",
    assume_role_arn="string",
    access_key_id="string",
    nameserver="string",
    namespace="string",
    region="string",
    secret_access_key_wo="string",
    secret_access_key_wo_version=0,
    ttl=0)

    const secretBackendDnsProviderAwsRoute53Resource = new vault.pkiexternalca.SecretBackendDnsProviderAwsRoute53("secretBackendDnsProviderAwsRoute53Resource", {
    identifiers: ["string"],
    mount: "string",
    name: "string",
    hostedZoneId: "string",
    externalId: "string",
    assumeRoleArn: "string",
    accessKeyId: "string",
    nameserver: "string",
    namespace: "string",
    region: "string",
    secretAccessKeyWo: "string",
    secretAccessKeyWoVersion: 0,
    ttl: 0,
});

    type: vault:pkiexternalca:SecretBackendDnsProviderAwsRoute53
properties:
    accessKeyId: string
    assumeRoleArn: string
    externalId: string
    hostedZoneId: string
    identifiers:
        - string
    mount: string
    name: string
    nameserver: string
    namespace: string
    region: string
    secretAccessKeyWo: string
    secretAccessKeyWoVersion: 0
    ttl: 0

    SecretBackendDnsProviderAwsRoute53 Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendDnsProviderAwsRoute53 resource accepts the following input properties:

    Identifiers List<string>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    Mount string
    The path where the PKI External CA secret backend is mounted.
    AccessKeyId string
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    AssumeRoleArn string
    AWS IAM role ARN to assume for Route53 operations.
    ExternalId string
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    HostedZoneId string
    AWS Route53 hosted zone ID.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Region string
    AWS region for Route53 operations. Defaults to us-east-1.
    SecretAccessKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    SecretAccessKeyWoVersion int
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    Identifiers []string
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    Mount string
    The path where the PKI External CA secret backend is mounted.
    AccessKeyId string
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    AssumeRoleArn string
    AWS IAM role ARN to assume for Route53 operations.
    ExternalId string
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    HostedZoneId string
    AWS Route53 hosted zone ID.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Region string
    AWS region for Route53 operations. Defaults to us-east-1.
    SecretAccessKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    SecretAccessKeyWoVersion int
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    identifiers list(string)
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount string
    The path where the PKI External CA secret backend is mounted.
    access_key_id string
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assume_role_arn string
    AWS IAM role ARN to assume for Route53 operations.
    external_id string
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hosted_zone_id string
    AWS Route53 hosted zone ID.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region string
    AWS region for Route53 operations. Defaults to us-east-1.
    secret_access_key_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secret_access_key_wo_version number
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount String
    The path where the PKI External CA secret backend is mounted.
    accessKeyId String
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assumeRoleArn String
    AWS IAM role ARN to assume for Route53 operations.
    externalId String
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hostedZoneId String
    AWS Route53 hosted zone ID.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region String
    AWS region for Route53 operations. Defaults to us-east-1.
    secretAccessKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secretAccessKeyWoVersion Integer
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl Integer
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    identifiers string[]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount string
    The path where the PKI External CA secret backend is mounted.
    accessKeyId string
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assumeRoleArn string
    AWS IAM role ARN to assume for Route53 operations.
    externalId string
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hostedZoneId string
    AWS Route53 hosted zone ID.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region string
    AWS region for Route53 operations. Defaults to us-east-1.
    secretAccessKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secretAccessKeyWoVersion number
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    identifiers Sequence[str]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount str
    The path where the PKI External CA secret backend is mounted.
    access_key_id str
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assume_role_arn str
    AWS IAM role ARN to assume for Route53 operations.
    external_id str
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hosted_zone_id str
    AWS Route53 hosted zone ID.
    name str
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver str
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region str
    AWS region for Route53 operations. Defaults to us-east-1.
    secret_access_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secret_access_key_wo_version int
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount String
    The path where the PKI External CA secret backend is mounted.
    accessKeyId String
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assumeRoleArn String
    AWS IAM role ARN to assume for Route53 operations.
    externalId String
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hostedZoneId String
    AWS Route53 hosted zone ID.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region String
    AWS region for Route53 operations. Defaults to us-east-1.
    secretAccessKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secretAccessKeyWoVersion Number
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl Number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendDnsProviderAwsRoute53 resource produces the following output properties:

    CreationDate string
    The date and time the provider was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUpdatedDate string
    The date and time the provider was last updated.
    CreationDate string
    The date and time the provider was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUpdatedDate string
    The date and time the provider was last updated.
    creation_date string
    The date and time the provider was created.
    id string
    The provider-assigned unique ID for this managed resource.
    last_updated_date string
    The date and time the provider was last updated.
    creationDate String
    The date and time the provider was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUpdatedDate String
    The date and time the provider was last updated.
    creationDate string
    The date and time the provider was created.
    id string
    The provider-assigned unique ID for this managed resource.
    lastUpdatedDate string
    The date and time the provider was last updated.
    creation_date str
    The date and time the provider was created.
    id str
    The provider-assigned unique ID for this managed resource.
    last_updated_date str
    The date and time the provider was last updated.
    creationDate String
    The date and time the provider was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUpdatedDate String
    The date and time the provider was last updated.

    Look up Existing SecretBackendDnsProviderAwsRoute53 Resource

    Get an existing SecretBackendDnsProviderAwsRoute53 resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendDnsProviderAwsRoute53State, opts?: CustomResourceOptions): SecretBackendDnsProviderAwsRoute53
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access_key_id: Optional[str] = None,
        assume_role_arn: Optional[str] = None,
        creation_date: Optional[str] = None,
        external_id: Optional[str] = None,
        hosted_zone_id: Optional[str] = None,
        identifiers: Optional[Sequence[str]] = None,
        last_updated_date: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        nameserver: Optional[str] = None,
        namespace: Optional[str] = None,
        region: Optional[str] = None,
        secret_access_key_wo: Optional[str] = None,
        secret_access_key_wo_version: Optional[int] = None,
        ttl: Optional[int] = None) -> SecretBackendDnsProviderAwsRoute53
    func GetSecretBackendDnsProviderAwsRoute53(ctx *Context, name string, id IDInput, state *SecretBackendDnsProviderAwsRoute53State, opts ...ResourceOption) (*SecretBackendDnsProviderAwsRoute53, error)
    public static SecretBackendDnsProviderAwsRoute53 Get(string name, Input<string> id, SecretBackendDnsProviderAwsRoute53State? state, CustomResourceOptions? opts = null)
    public static SecretBackendDnsProviderAwsRoute53 get(String name, Output<String> id, SecretBackendDnsProviderAwsRoute53State state, CustomResourceOptions options)
    resources:  _:    type: vault:pkiexternalca:SecretBackendDnsProviderAwsRoute53    get:      id: ${id}
    import {
  to = vault_pkiexternalca_secret_backend_dns_provider_aws_route53.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccessKeyId string
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    AssumeRoleArn string
    AWS IAM role ARN to assume for Route53 operations.
    CreationDate string
    The date and time the provider was created.
    ExternalId string
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    HostedZoneId string
    AWS Route53 hosted zone ID.
    Identifiers List<string>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    LastUpdatedDate string
    The date and time the provider was last updated.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Region string
    AWS region for Route53 operations. Defaults to us-east-1.
    SecretAccessKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    SecretAccessKeyWoVersion int
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    AccessKeyId string
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    AssumeRoleArn string
    AWS IAM role ARN to assume for Route53 operations.
    CreationDate string
    The date and time the provider was created.
    ExternalId string
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    HostedZoneId string
    AWS Route53 hosted zone ID.
    Identifiers []string
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    LastUpdatedDate string
    The date and time the provider was last updated.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Region string
    AWS region for Route53 operations. Defaults to us-east-1.
    SecretAccessKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    SecretAccessKeyWoVersion int
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    access_key_id string
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assume_role_arn string
    AWS IAM role ARN to assume for Route53 operations.
    creation_date string
    The date and time the provider was created.
    external_id string
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hosted_zone_id string
    AWS Route53 hosted zone ID.
    identifiers list(string)
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    last_updated_date string
    The date and time the provider was last updated.
    mount string
    The path where the PKI External CA secret backend is mounted.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region string
    AWS region for Route53 operations. Defaults to us-east-1.
    secret_access_key_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secret_access_key_wo_version number
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    accessKeyId String
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assumeRoleArn String
    AWS IAM role ARN to assume for Route53 operations.
    creationDate String
    The date and time the provider was created.
    externalId String
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hostedZoneId String
    AWS Route53 hosted zone ID.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    lastUpdatedDate String
    The date and time the provider was last updated.
    mount String
    The path where the PKI External CA secret backend is mounted.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region String
    AWS region for Route53 operations. Defaults to us-east-1.
    secretAccessKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secretAccessKeyWoVersion Integer
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl Integer
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    accessKeyId string
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assumeRoleArn string
    AWS IAM role ARN to assume for Route53 operations.
    creationDate string
    The date and time the provider was created.
    externalId string
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hostedZoneId string
    AWS Route53 hosted zone ID.
    identifiers string[]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    lastUpdatedDate string
    The date and time the provider was last updated.
    mount string
    The path where the PKI External CA secret backend is mounted.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region string
    AWS region for Route53 operations. Defaults to us-east-1.
    secretAccessKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secretAccessKeyWoVersion number
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    access_key_id str
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assume_role_arn str
    AWS IAM role ARN to assume for Route53 operations.
    creation_date str
    The date and time the provider was created.
    external_id str
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hosted_zone_id str
    AWS Route53 hosted zone ID.
    identifiers Sequence[str]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    last_updated_date str
    The date and time the provider was last updated.
    mount str
    The path where the PKI External CA secret backend is mounted.
    name str
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver str
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region str
    AWS region for Route53 operations. Defaults to us-east-1.
    secret_access_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secret_access_key_wo_version int
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    accessKeyId String
    AWS access key ID for Route53 API access. Optional when using IAM role assumption or instance profiles.
    assumeRoleArn String
    AWS IAM role ARN to assume for Route53 operations.
    creationDate String
    The date and time the provider was created.
    externalId String
    External ID to pass when assuming the IAM role via AWS STS AssumeRole.
    hostedZoneId String
    AWS Route53 hosted zone ID.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    lastUpdatedDate String
    The date and time the provider was last updated.
    mount String
    The path where the PKI External CA secret backend is mounted.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 8.8.8.8:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    region String
    AWS region for Route53 operations. Defaults to us-east-1.
    secretAccessKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. AWS secret access key for Route53 API access. Optional when using IAM role assumption or instance profiles. Write-only — never stored in Terraform state.
    secretAccessKeyWoVersion Number
    Version counter for secretAccessKeyWo. Increment this to trigger an update to the secret access key in Vault without changing any other field.
    ttl Number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.

    Import

    AWS Route53 DNS provider configurations can be imported using the format <mount>/config/dns/aws-route53/<name>, e.g.

    $ pulumi import vault:pkiexternalca/secretBackendDnsProviderAwsRoute53:SecretBackendDnsProviderAwsRoute53 example pki-external-ca/config/dns/aws-route53/my-route53-provider

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.13.0
    published on Friday, Sep 18, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial