Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. pkiexternalca
  6. SecretBackendDnsProviderAzure
Viewing docs for HashiCorp Vault v7.13.0
published on Friday, Sep 18, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.pkiexternalca.SecretBackendDnsProviderAzure

vault logo vault logo
Viewing docs for HashiCorp Vault v7.13.0
published on Friday, Sep 18, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages an Azure DNS provider configuration for PKI External CA DNS-01 ACME challenges.

    Important All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform, and will appear in the console output when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.

    This resource requires Vault 2.1.0 or later.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const pki_external_ca = new vault.Mount("pki-external-ca", {
    path: "pki-external-ca",
    type: "pki-external-ca",
});
const example = new vault.pkiexternalca.SecretBackendDnsProviderAzure("example", {
    mount: pki_external_ca.path,
    name: "my-azure-provider",
    identifiers: [
        "example.com",
        "*.example.com",
    ],
    clientId: "00000000-0000-0000-0000-000000000001",
    tenantId: "00000000-0000-0000-0000-000000000002",
    subscriptionId: "00000000-0000-0000-0000-000000000003",
    resourceGroupName: "my-dns-rg",
    zoneName: "example.com",
    clientSecretWo: azureClientSecret,
    clientSecretWoVersion: 1,
});

    import pulumi
import pulumi_vault as vault

pki_external_ca = vault.Mount("pki-external-ca",
    path="pki-external-ca",
    type="pki-external-ca")
example = vault.pkiexternalca.SecretBackendDnsProviderAzure("example",
    mount=pki_external_ca.path,
    name="my-azure-provider",
    identifiers=[
        "example.com",
        "*.example.com",
    ],
    client_id="00000000-0000-0000-0000-000000000001",
    tenant_id="00000000-0000-0000-0000-000000000002",
    subscription_id="00000000-0000-0000-0000-000000000003",
    resource_group_name="my-dns-rg",
    zone_name="example.com",
    client_secret_wo=azure_client_secret,
    client_secret_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki_external_ca, err := vault.NewMount(ctx, "pki-external-ca", &vault.MountArgs{
			Path: pulumi.String("pki-external-ca"),
			Type: pulumi.String("pki-external-ca"),
		})
		if err != nil {
			return err
		}
		_, err = pkiexternalca.NewSecretBackendDnsProviderAzure(ctx, "example", &pkiexternalca.SecretBackendDnsProviderAzureArgs{
			Mount: pki_external_ca.Path,
			Name:  pulumi.String("my-azure-provider"),
			Identifiers: pulumi.StringArray{
				pulumi.String("example.com"),
				pulumi.String("*.example.com"),
			},
			ClientId:              pulumi.String("00000000-0000-0000-0000-000000000001"),
			TenantId:              pulumi.String("00000000-0000-0000-0000-000000000002"),
			SubscriptionId:        pulumi.String("00000000-0000-0000-0000-000000000003"),
			ResourceGroupName:     pulumi.String("my-dns-rg"),
			ZoneName:              pulumi.String("example.com"),
			ClientSecretWo:        pulumi.Any(azureClientSecret),
			ClientSecretWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki_external_ca = new Vault.Mount("pki-external-ca", new()
    {
        Path = "pki-external-ca",
        Type = "pki-external-ca",
    });

    var example = new Vault.PkiExternalCa.SecretBackendDnsProviderAzure("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "my-azure-provider",
        Identifiers = new[]
        {
            "example.com",
            "*.example.com",
        },
        ClientId = "00000000-0000-0000-0000-000000000001",
        TenantId = "00000000-0000-0000-0000-000000000002",
        SubscriptionId = "00000000-0000-0000-0000-000000000003",
        ResourceGroupName = "my-dns-rg",
        ZoneName = "example.com",
        ClientSecretWo = azureClientSecret,
        ClientSecretWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendDnsProviderAzure;
import com.pulumi.vault.pkiexternalca.SecretBackendDnsProviderAzureArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki_external_ca = new Mount("pki-external-ca", MountArgs.builder()
            .path("pki-external-ca")
            .type("pki-external-ca")
            .build());

        var example = new SecretBackendDnsProviderAzure("example", SecretBackendDnsProviderAzureArgs.builder()
            .mount(pki_external_ca.path())
            .name("my-azure-provider")
            .identifiers(            
                "example.com",
                "*.example.com")
            .clientId("00000000-0000-0000-0000-000000000001")
            .tenantId("00000000-0000-0000-0000-000000000002")
            .subscriptionId("00000000-0000-0000-0000-000000000003")
            .resourceGroupName("my-dns-rg")
            .zoneName("example.com")
            .clientSecretWo(azureClientSecret)
            .clientSecretWoVersion(1)
            .build());

    }
}

    resources:
  pki-external-ca:
    type: vault:Mount
    properties:
      path: pki-external-ca
      type: pki-external-ca
  example:
    type: vault:pkiexternalca:SecretBackendDnsProviderAzure
    properties:
      mount: ${["pki-external-ca"].path}
      name: my-azure-provider
      identifiers:
        - example.com
        - '*.example.com'
      clientId: 00000000-0000-0000-0000-000000000001
      tenantId: 00000000-0000-0000-0000-000000000002
      subscriptionId: 00000000-0000-0000-0000-000000000003
      resourceGroupName: my-dns-rg
      zoneName: example.com
      clientSecretWo: ${azureClientSecret}
      clientSecretWoVersion: 1

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "pki-external-ca" {
  path = "pki-external-ca"
  type = "pki-external-ca"
}
resource "vault_pkiexternalca_secretbackenddnsproviderazure" "example" {
  mount                    = vault_mount.pki-external-ca.path
  name                     = "my-azure-provider"
  identifiers              = ["example.com", "*.example.com"]
  client_id                = "00000000-0000-0000-0000-000000000001"
  tenant_id                = "00000000-0000-0000-0000-000000000002"
  subscription_id          = "00000000-0000-0000-0000-000000000003"
  resource_group_name      = "my-dns-rg"
  zone_name                = "example.com"
  client_secret_wo         = azureClientSecret
  client_secret_wo_version = 1
}

    Create SecretBackendDnsProviderAzure Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendDnsProviderAzure(name: string, args: SecretBackendDnsProviderAzureArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendDnsProviderAzure(resource_name: str,
                                  args: SecretBackendDnsProviderAzureArgs,
                                  opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendDnsProviderAzure(resource_name: str,
                                  opts: Optional[ResourceOptions] = None,
                                  identifiers: Optional[Sequence[str]] = None,
                                  mount: Optional[str] = None,
                                  name: Optional[str] = None,
                                  environment: Optional[str] = None,
                                  client_secret_wo_version: Optional[int] = None,
                                  client_secret_wo: Optional[str] = None,
                                  client_id: Optional[str] = None,
                                  nameserver: Optional[str] = None,
                                  namespace: Optional[str] = None,
                                  resource_group_name: Optional[str] = None,
                                  subscription_id: Optional[str] = None,
                                  tenant_id: Optional[str] = None,
                                  ttl: Optional[int] = None,
                                  zone_name: Optional[str] = None)
    func NewSecretBackendDnsProviderAzure(ctx *Context, name string, args SecretBackendDnsProviderAzureArgs, opts ...ResourceOption) (*SecretBackendDnsProviderAzure, error)
    public SecretBackendDnsProviderAzure(string name, SecretBackendDnsProviderAzureArgs args, CustomResourceOptions? opts = null)
    public SecretBackendDnsProviderAzure(String name, SecretBackendDnsProviderAzureArgs args)
public SecretBackendDnsProviderAzure(String name, SecretBackendDnsProviderAzureArgs args, CustomResourceOptions options)

    type: vault:pkiexternalca:SecretBackendDnsProviderAzure
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_pkiexternalca_secret_backend_dns_provider_azure" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendDnsProviderAzureArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendDnsProviderAzureArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendDnsProviderAzureArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendDnsProviderAzureArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendDnsProviderAzureArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretBackendDnsProviderAzureResource = new Vault.PkiExternalCa.SecretBackendDnsProviderAzure("secretBackendDnsProviderAzureResource", new()
{
    Identifiers = new[]
    {
        "string",
    },
    Mount = "string",
    Name = "string",
    Environment = "string",
    ClientSecretWoVersion = 0,
    ClientSecretWo = "string",
    ClientId = "string",
    Nameserver = "string",
    Namespace = "string",
    ResourceGroupName = "string",
    SubscriptionId = "string",
    TenantId = "string",
    Ttl = 0,
    ZoneName = "string",
});

    example, err := pkiexternalca.NewSecretBackendDnsProviderAzure(ctx, "secretBackendDnsProviderAzureResource", &pkiexternalca.SecretBackendDnsProviderAzureArgs{
	Identifiers: pulumi.StringArray{
		pulumi.String("string"),
	},
	Mount:                 pulumi.String("string"),
	Name:                  pulumi.String("string"),
	Environment:           pulumi.String("string"),
	ClientSecretWoVersion: pulumi.Int(0),
	ClientSecretWo:        pulumi.String("string"),
	ClientId:              pulumi.String("string"),
	Nameserver:            pulumi.String("string"),
	Namespace:             pulumi.String("string"),
	ResourceGroupName:     pulumi.String("string"),
	SubscriptionId:        pulumi.String("string"),
	TenantId:              pulumi.String("string"),
	Ttl:                   pulumi.Int(0),
	ZoneName:              pulumi.String("string"),
})

    resource "vault_pkiexternalca_secret_backend_dns_provider_azure" "secretBackendDnsProviderAzureResource" {
  lifecycle {
    create_before_destroy = true
  }
  identifiers              = ["string"]
  mount                    = "string"
  name                     = "string"
  environment              = "string"
  client_secret_wo_version = 0
  client_secret_wo         = "string"
  client_id                = "string"
  nameserver               = "string"
  namespace                = "string"
  resource_group_name      = "string"
  subscription_id          = "string"
  tenant_id                = "string"
  ttl                      = 0
  zone_name                = "string"
}

    var secretBackendDnsProviderAzureResource = new SecretBackendDnsProviderAzure("secretBackendDnsProviderAzureResource", SecretBackendDnsProviderAzureArgs.builder()
    .identifiers("string")
    .mount("string")
    .name("string")
    .environment("string")
    .clientSecretWoVersion(0)
    .clientSecretWo("string")
    .clientId("string")
    .nameserver("string")
    .namespace("string")
    .resourceGroupName("string")
    .subscriptionId("string")
    .tenantId("string")
    .ttl(0)
    .zoneName("string")
    .build());

    secret_backend_dns_provider_azure_resource = vault.pkiexternalca.SecretBackendDnsProviderAzure("secretBackendDnsProviderAzureResource",
    identifiers=["string"],
    mount="string",
    name="string",
    environment="string",
    client_secret_wo_version=0,
    client_secret_wo="string",
    client_id="string",
    nameserver="string",
    namespace="string",
    resource_group_name="string",
    subscription_id="string",
    tenant_id="string",
    ttl=0,
    zone_name="string")

    const secretBackendDnsProviderAzureResource = new vault.pkiexternalca.SecretBackendDnsProviderAzure("secretBackendDnsProviderAzureResource", {
    identifiers: ["string"],
    mount: "string",
    name: "string",
    environment: "string",
    clientSecretWoVersion: 0,
    clientSecretWo: "string",
    clientId: "string",
    nameserver: "string",
    namespace: "string",
    resourceGroupName: "string",
    subscriptionId: "string",
    tenantId: "string",
    ttl: 0,
    zoneName: "string",
});

    type: vault:pkiexternalca:SecretBackendDnsProviderAzure
properties:
    clientId: string
    clientSecretWo: string
    clientSecretWoVersion: 0
    environment: string
    identifiers:
        - string
    mount: string
    name: string
    nameserver: string
    namespace: string
    resourceGroupName: string
    subscriptionId: string
    tenantId: string
    ttl: 0
    zoneName: string

    SecretBackendDnsProviderAzure Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendDnsProviderAzure resource accepts the following input properties:

    Identifiers List<string>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    Mount string
    The path where the PKI External CA secret backend is mounted.
    ClientId string
    Azure service principal client ID. Optional when using managed identities.
    ClientSecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    ClientSecretWoVersion int
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    Environment string
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ResourceGroupName string
    Resource group containing the Azure DNS zone.
    SubscriptionId string
    Azure subscription ID. Optional when using managed identities.
    TenantId string
    Azure tenant ID. Optional when using managed identities.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    ZoneName string
    Azure DNS zone name.
    Identifiers []string
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    Mount string
    The path where the PKI External CA secret backend is mounted.
    ClientId string
    Azure service principal client ID. Optional when using managed identities.
    ClientSecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    ClientSecretWoVersion int
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    Environment string
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ResourceGroupName string
    Resource group containing the Azure DNS zone.
    SubscriptionId string
    Azure subscription ID. Optional when using managed identities.
    TenantId string
    Azure tenant ID. Optional when using managed identities.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    ZoneName string
    Azure DNS zone name.
    identifiers list(string)
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount string
    The path where the PKI External CA secret backend is mounted.
    client_id string
    Azure service principal client ID. Optional when using managed identities.
    client_secret_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    client_secret_wo_version number
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    environment string
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resource_group_name string
    Resource group containing the Azure DNS zone.
    subscription_id string
    Azure subscription ID. Optional when using managed identities.
    tenant_id string
    Azure tenant ID. Optional when using managed identities.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zone_name string
    Azure DNS zone name.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount String
    The path where the PKI External CA secret backend is mounted.
    clientId String
    Azure service principal client ID. Optional when using managed identities.
    clientSecretWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    clientSecretWoVersion Integer
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    environment String
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resourceGroupName String
    Resource group containing the Azure DNS zone.
    subscriptionId String
    Azure subscription ID. Optional when using managed identities.
    tenantId String
    Azure tenant ID. Optional when using managed identities.
    ttl Integer
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName String
    Azure DNS zone name.
    identifiers string[]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount string
    The path where the PKI External CA secret backend is mounted.
    clientId string
    Azure service principal client ID. Optional when using managed identities.
    clientSecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    clientSecretWoVersion number
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    environment string
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resourceGroupName string
    Resource group containing the Azure DNS zone.
    subscriptionId string
    Azure subscription ID. Optional when using managed identities.
    tenantId string
    Azure tenant ID. Optional when using managed identities.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName string
    Azure DNS zone name.
    identifiers Sequence[str]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount str
    The path where the PKI External CA secret backend is mounted.
    client_id str
    Azure service principal client ID. Optional when using managed identities.
    client_secret_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    client_secret_wo_version int
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    environment str
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    name str
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver str
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resource_group_name str
    Resource group containing the Azure DNS zone.
    subscription_id str
    Azure subscription ID. Optional when using managed identities.
    tenant_id str
    Azure tenant ID. Optional when using managed identities.
    ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zone_name str
    Azure DNS zone name.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount String
    The path where the PKI External CA secret backend is mounted.
    clientId String
    Azure service principal client ID. Optional when using managed identities.
    clientSecretWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    clientSecretWoVersion Number
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    environment String
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resourceGroupName String
    Resource group containing the Azure DNS zone.
    subscriptionId String
    Azure subscription ID. Optional when using managed identities.
    tenantId String
    Azure tenant ID. Optional when using managed identities.
    ttl Number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName String
    Azure DNS zone name.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendDnsProviderAzure resource produces the following output properties:

    CreationDate string
    The date and time the provider was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUpdatedDate string
    The date and time the provider was last updated.
    CreationDate string
    The date and time the provider was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUpdatedDate string
    The date and time the provider was last updated.
    creation_date string
    The date and time the provider was created.
    id string
    The provider-assigned unique ID for this managed resource.
    last_updated_date string
    The date and time the provider was last updated.
    creationDate String
    The date and time the provider was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUpdatedDate String
    The date and time the provider was last updated.
    creationDate string
    The date and time the provider was created.
    id string
    The provider-assigned unique ID for this managed resource.
    lastUpdatedDate string
    The date and time the provider was last updated.
    creation_date str
    The date and time the provider was created.
    id str
    The provider-assigned unique ID for this managed resource.
    last_updated_date str
    The date and time the provider was last updated.
    creationDate String
    The date and time the provider was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUpdatedDate String
    The date and time the provider was last updated.

    Look up Existing SecretBackendDnsProviderAzure Resource

    Get an existing SecretBackendDnsProviderAzure resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendDnsProviderAzureState, opts?: CustomResourceOptions): SecretBackendDnsProviderAzure
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        client_id: Optional[str] = None,
        client_secret_wo: Optional[str] = None,
        client_secret_wo_version: Optional[int] = None,
        creation_date: Optional[str] = None,
        environment: Optional[str] = None,
        identifiers: Optional[Sequence[str]] = None,
        last_updated_date: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        nameserver: Optional[str] = None,
        namespace: Optional[str] = None,
        resource_group_name: Optional[str] = None,
        subscription_id: Optional[str] = None,
        tenant_id: Optional[str] = None,
        ttl: Optional[int] = None,
        zone_name: Optional[str] = None) -> SecretBackendDnsProviderAzure
    func GetSecretBackendDnsProviderAzure(ctx *Context, name string, id IDInput, state *SecretBackendDnsProviderAzureState, opts ...ResourceOption) (*SecretBackendDnsProviderAzure, error)
    public static SecretBackendDnsProviderAzure Get(string name, Input<string> id, SecretBackendDnsProviderAzureState? state, CustomResourceOptions? opts = null)
    public static SecretBackendDnsProviderAzure get(String name, Output<String> id, SecretBackendDnsProviderAzureState state, CustomResourceOptions options)
    resources:  _:    type: vault:pkiexternalca:SecretBackendDnsProviderAzure    get:      id: ${id}
    import {
  to = vault_pkiexternalca_secret_backend_dns_provider_azure.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ClientId string
    Azure service principal client ID. Optional when using managed identities.
    ClientSecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    ClientSecretWoVersion int
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    CreationDate string
    The date and time the provider was created.
    Environment string
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    Identifiers List<string>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    LastUpdatedDate string
    The date and time the provider was last updated.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ResourceGroupName string
    Resource group containing the Azure DNS zone.
    SubscriptionId string
    Azure subscription ID. Optional when using managed identities.
    TenantId string
    Azure tenant ID. Optional when using managed identities.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    ZoneName string
    Azure DNS zone name.
    ClientId string
    Azure service principal client ID. Optional when using managed identities.
    ClientSecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    ClientSecretWoVersion int
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    CreationDate string
    The date and time the provider was created.
    Environment string
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    Identifiers []string
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    LastUpdatedDate string
    The date and time the provider was last updated.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ResourceGroupName string
    Resource group containing the Azure DNS zone.
    SubscriptionId string
    Azure subscription ID. Optional when using managed identities.
    TenantId string
    Azure tenant ID. Optional when using managed identities.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    ZoneName string
    Azure DNS zone name.
    client_id string
    Azure service principal client ID. Optional when using managed identities.
    client_secret_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    client_secret_wo_version number
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    creation_date string
    The date and time the provider was created.
    environment string
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    identifiers list(string)
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    last_updated_date string
    The date and time the provider was last updated.
    mount string
    The path where the PKI External CA secret backend is mounted.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resource_group_name string
    Resource group containing the Azure DNS zone.
    subscription_id string
    Azure subscription ID. Optional when using managed identities.
    tenant_id string
    Azure tenant ID. Optional when using managed identities.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zone_name string
    Azure DNS zone name.
    clientId String
    Azure service principal client ID. Optional when using managed identities.
    clientSecretWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    clientSecretWoVersion Integer
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    creationDate String
    The date and time the provider was created.
    environment String
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    lastUpdatedDate String
    The date and time the provider was last updated.
    mount String
    The path where the PKI External CA secret backend is mounted.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resourceGroupName String
    Resource group containing the Azure DNS zone.
    subscriptionId String
    Azure subscription ID. Optional when using managed identities.
    tenantId String
    Azure tenant ID. Optional when using managed identities.
    ttl Integer
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName String
    Azure DNS zone name.
    clientId string
    Azure service principal client ID. Optional when using managed identities.
    clientSecretWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    clientSecretWoVersion number
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    creationDate string
    The date and time the provider was created.
    environment string
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    identifiers string[]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    lastUpdatedDate string
    The date and time the provider was last updated.
    mount string
    The path where the PKI External CA secret backend is mounted.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resourceGroupName string
    Resource group containing the Azure DNS zone.
    subscriptionId string
    Azure subscription ID. Optional when using managed identities.
    tenantId string
    Azure tenant ID. Optional when using managed identities.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName string
    Azure DNS zone name.
    client_id str
    Azure service principal client ID. Optional when using managed identities.
    client_secret_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    client_secret_wo_version int
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    creation_date str
    The date and time the provider was created.
    environment str
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    identifiers Sequence[str]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    last_updated_date str
    The date and time the provider was last updated.
    mount str
    The path where the PKI External CA secret backend is mounted.
    name str
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver str
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resource_group_name str
    Resource group containing the Azure DNS zone.
    subscription_id str
    Azure subscription ID. Optional when using managed identities.
    tenant_id str
    Azure tenant ID. Optional when using managed identities.
    ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zone_name str
    Azure DNS zone name.
    clientId String
    Azure service principal client ID. Optional when using managed identities.
    clientSecretWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Azure service principal client secret. Optional when using managed identities. Write-only — never stored in Terraform state.
    clientSecretWoVersion Number
    Version counter for clientSecretWo. Increment this to trigger an update to the client secret in Vault without changing any other field.
    creationDate String
    The date and time the provider was created.
    environment String
    Azure cloud environment. Valid values: AzurePublic, AzureChina, AzureGovernment. Defaults to AzurePublic.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    lastUpdatedDate String
    The date and time the provider was last updated.
    mount String
    The path where the PKI External CA secret backend is mounted.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 1.1.1.1:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    resourceGroupName String
    Resource group containing the Azure DNS zone.
    subscriptionId String
    Azure subscription ID. Optional when using managed identities.
    tenantId String
    Azure tenant ID. Optional when using managed identities.
    ttl Number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName String
    Azure DNS zone name.

    Import

    Azure DNS provider configurations can be imported using the format <mount>/config/dns/azure-dns/<name>, e.g.

    $ pulumi import vault:pkiexternalca/secretBackendDnsProviderAzure:SecretBackendDnsProviderAzure example pki-external-ca/config/dns/azure-dns/my-azure-provider

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.13.0
    published on Friday, Sep 18, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial