Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. pkiexternalca
  6. SecretBackendDnsProviderGcp
Viewing docs for HashiCorp Vault v7.13.0
published on Friday, Sep 18, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.pkiexternalca.SecretBackendDnsProviderGcp

vault logo vault logo
Viewing docs for HashiCorp Vault v7.13.0
published on Friday, Sep 18, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages a Google Cloud DNS provider configuration for PKI External CA DNS-01 ACME challenges.

    Important All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform, and will appear in the console output when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.

    This resource requires Vault 2.1.0 or later.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const pki_external_ca = new vault.Mount("pki-external-ca", {
    path: "pki-external-ca",
    type: "pki-external-ca",
});
const example = new vault.pkiexternalca.SecretBackendDnsProviderGcp("example", {
    mount: pki_external_ca.path,
    name: "my-gcp-provider",
    identifiers: [
        "example.com",
        "*.example.com",
    ],
    project: "my-gcp-project",
    zoneName: "example-com",
});

    import pulumi
import pulumi_vault as vault

pki_external_ca = vault.Mount("pki-external-ca",
    path="pki-external-ca",
    type="pki-external-ca")
example = vault.pkiexternalca.SecretBackendDnsProviderGcp("example",
    mount=pki_external_ca.path,
    name="my-gcp-provider",
    identifiers=[
        "example.com",
        "*.example.com",
    ],
    project="my-gcp-project",
    zone_name="example-com")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki_external_ca, err := vault.NewMount(ctx, "pki-external-ca", &vault.MountArgs{
			Path: pulumi.String("pki-external-ca"),
			Type: pulumi.String("pki-external-ca"),
		})
		if err != nil {
			return err
		}
		_, err = pkiexternalca.NewSecretBackendDnsProviderGcp(ctx, "example", &pkiexternalca.SecretBackendDnsProviderGcpArgs{
			Mount: pki_external_ca.Path,
			Name:  pulumi.String("my-gcp-provider"),
			Identifiers: pulumi.StringArray{
				pulumi.String("example.com"),
				pulumi.String("*.example.com"),
			},
			Project:  pulumi.String("my-gcp-project"),
			ZoneName: pulumi.String("example-com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki_external_ca = new Vault.Mount("pki-external-ca", new()
    {
        Path = "pki-external-ca",
        Type = "pki-external-ca",
    });

    var example = new Vault.PkiExternalCa.SecretBackendDnsProviderGcp("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "my-gcp-provider",
        Identifiers = new[]
        {
            "example.com",
            "*.example.com",
        },
        Project = "my-gcp-project",
        ZoneName = "example-com",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendDnsProviderGcp;
import com.pulumi.vault.pkiexternalca.SecretBackendDnsProviderGcpArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki_external_ca = new Mount("pki-external-ca", MountArgs.builder()
            .path("pki-external-ca")
            .type("pki-external-ca")
            .build());

        var example = new SecretBackendDnsProviderGcp("example", SecretBackendDnsProviderGcpArgs.builder()
            .mount(pki_external_ca.path())
            .name("my-gcp-provider")
            .identifiers(            
                "example.com",
                "*.example.com")
            .project("my-gcp-project")
            .zoneName("example-com")
            .build());

    }
}

    resources:
  pki-external-ca:
    type: vault:Mount
    properties:
      path: pki-external-ca
      type: pki-external-ca
  example:
    type: vault:pkiexternalca:SecretBackendDnsProviderGcp
    properties:
      mount: ${["pki-external-ca"].path}
      name: my-gcp-provider
      identifiers:
        - example.com
        - '*.example.com'
      project: my-gcp-project
      zoneName: example-com

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "pki-external-ca" {
  path = "pki-external-ca"
  type = "pki-external-ca"
}
resource "vault_pkiexternalca_secretbackenddnsprovidergcp" "example" {
  mount       = vault_mount.pki-external-ca.path
  name        = "my-gcp-provider"
  identifiers = ["example.com", "*.example.com"]
  project     = "my-gcp-project"
  zone_name   = "example-com"
}

    Create SecretBackendDnsProviderGcp Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendDnsProviderGcp(name: string, args: SecretBackendDnsProviderGcpArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendDnsProviderGcp(resource_name: str,
                                args: SecretBackendDnsProviderGcpArgs,
                                opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendDnsProviderGcp(resource_name: str,
                                opts: Optional[ResourceOptions] = None,
                                identifiers: Optional[Sequence[str]] = None,
                                mount: Optional[str] = None,
                                credentials_wo: Optional[str] = None,
                                credentials_wo_version: Optional[int] = None,
                                impersonate_service_account: Optional[str] = None,
                                name: Optional[str] = None,
                                nameserver: Optional[str] = None,
                                namespace: Optional[str] = None,
                                project: Optional[str] = None,
                                ttl: Optional[int] = None,
                                zone_name: Optional[str] = None)
    func NewSecretBackendDnsProviderGcp(ctx *Context, name string, args SecretBackendDnsProviderGcpArgs, opts ...ResourceOption) (*SecretBackendDnsProviderGcp, error)
    public SecretBackendDnsProviderGcp(string name, SecretBackendDnsProviderGcpArgs args, CustomResourceOptions? opts = null)
    public SecretBackendDnsProviderGcp(String name, SecretBackendDnsProviderGcpArgs args)
public SecretBackendDnsProviderGcp(String name, SecretBackendDnsProviderGcpArgs args, CustomResourceOptions options)

    type: vault:pkiexternalca:SecretBackendDnsProviderGcp
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_pkiexternalca_secret_backend_dns_provider_gcp" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendDnsProviderGcpArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendDnsProviderGcpArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendDnsProviderGcpArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendDnsProviderGcpArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendDnsProviderGcpArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretBackendDnsProviderGcpResource = new Vault.PkiExternalCa.SecretBackendDnsProviderGcp("secretBackendDnsProviderGcpResource", new()
{
    Identifiers = new[]
    {
        "string",
    },
    Mount = "string",
    CredentialsWo = "string",
    CredentialsWoVersion = 0,
    ImpersonateServiceAccount = "string",
    Name = "string",
    Nameserver = "string",
    Namespace = "string",
    Project = "string",
    Ttl = 0,
    ZoneName = "string",
});

    example, err := pkiexternalca.NewSecretBackendDnsProviderGcp(ctx, "secretBackendDnsProviderGcpResource", &pkiexternalca.SecretBackendDnsProviderGcpArgs{
	Identifiers: pulumi.StringArray{
		pulumi.String("string"),
	},
	Mount:                     pulumi.String("string"),
	CredentialsWo:             pulumi.String("string"),
	CredentialsWoVersion:      pulumi.Int(0),
	ImpersonateServiceAccount: pulumi.String("string"),
	Name:                      pulumi.String("string"),
	Nameserver:                pulumi.String("string"),
	Namespace:                 pulumi.String("string"),
	Project:                   pulumi.String("string"),
	Ttl:                       pulumi.Int(0),
	ZoneName:                  pulumi.String("string"),
})

    resource "vault_pkiexternalca_secret_backend_dns_provider_gcp" "secretBackendDnsProviderGcpResource" {
  lifecycle {
    create_before_destroy = true
  }
  identifiers                 = ["string"]
  mount                       = "string"
  credentials_wo              = "string"
  credentials_wo_version      = 0
  impersonate_service_account = "string"
  name                        = "string"
  nameserver                  = "string"
  namespace                   = "string"
  project                     = "string"
  ttl                         = 0
  zone_name                   = "string"
}

    var secretBackendDnsProviderGcpResource = new SecretBackendDnsProviderGcp("secretBackendDnsProviderGcpResource", SecretBackendDnsProviderGcpArgs.builder()
    .identifiers("string")
    .mount("string")
    .credentialsWo("string")
    .credentialsWoVersion(0)
    .impersonateServiceAccount("string")
    .name("string")
    .nameserver("string")
    .namespace("string")
    .project("string")
    .ttl(0)
    .zoneName("string")
    .build());

    secret_backend_dns_provider_gcp_resource = vault.pkiexternalca.SecretBackendDnsProviderGcp("secretBackendDnsProviderGcpResource",
    identifiers=["string"],
    mount="string",
    credentials_wo="string",
    credentials_wo_version=0,
    impersonate_service_account="string",
    name="string",
    nameserver="string",
    namespace="string",
    project="string",
    ttl=0,
    zone_name="string")

    const secretBackendDnsProviderGcpResource = new vault.pkiexternalca.SecretBackendDnsProviderGcp("secretBackendDnsProviderGcpResource", {
    identifiers: ["string"],
    mount: "string",
    credentialsWo: "string",
    credentialsWoVersion: 0,
    impersonateServiceAccount: "string",
    name: "string",
    nameserver: "string",
    namespace: "string",
    project: "string",
    ttl: 0,
    zoneName: "string",
});

    type: vault:pkiexternalca:SecretBackendDnsProviderGcp
properties:
    credentialsWo: string
    credentialsWoVersion: 0
    identifiers:
        - string
    impersonateServiceAccount: string
    mount: string
    name: string
    nameserver: string
    namespace: string
    project: string
    ttl: 0
    zoneName: string

    SecretBackendDnsProviderGcp Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendDnsProviderGcp resource accepts the following input properties:

    Identifiers List<string>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    Mount string
    The path where the PKI External CA secret backend is mounted.
    CredentialsWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    CredentialsWoVersion int
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    ImpersonateServiceAccount string
    Service account email to impersonate when calling the Cloud DNS API.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Project string
    GCP project name containing the Cloud DNS zone.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    ZoneName string
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    Identifiers []string
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    Mount string
    The path where the PKI External CA secret backend is mounted.
    CredentialsWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    CredentialsWoVersion int
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    ImpersonateServiceAccount string
    Service account email to impersonate when calling the Cloud DNS API.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Project string
    GCP project name containing the Cloud DNS zone.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    ZoneName string
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    identifiers list(string)
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount string
    The path where the PKI External CA secret backend is mounted.
    credentials_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentials_wo_version number
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    impersonate_service_account string
    Service account email to impersonate when calling the Cloud DNS API.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project string
    GCP project name containing the Cloud DNS zone.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zone_name string
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount String
    The path where the PKI External CA secret backend is mounted.
    credentialsWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentialsWoVersion Integer
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    impersonateServiceAccount String
    Service account email to impersonate when calling the Cloud DNS API.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project String
    GCP project name containing the Cloud DNS zone.
    ttl Integer
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName String
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    identifiers string[]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount string
    The path where the PKI External CA secret backend is mounted.
    credentialsWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentialsWoVersion number
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    impersonateServiceAccount string
    Service account email to impersonate when calling the Cloud DNS API.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project string
    GCP project name containing the Cloud DNS zone.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName string
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    identifiers Sequence[str]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount str
    The path where the PKI External CA secret backend is mounted.
    credentials_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentials_wo_version int
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    impersonate_service_account str
    Service account email to impersonate when calling the Cloud DNS API.
    name str
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver str
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project str
    GCP project name containing the Cloud DNS zone.
    ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zone_name str
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    mount String
    The path where the PKI External CA secret backend is mounted.
    credentialsWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentialsWoVersion Number
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    impersonateServiceAccount String
    Service account email to impersonate when calling the Cloud DNS API.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project String
    GCP project name containing the Cloud DNS zone.
    ttl Number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName String
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendDnsProviderGcp resource produces the following output properties:

    CreationDate string
    The date and time the provider was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUpdatedDate string
    The date and time the provider was last updated.
    CreationDate string
    The date and time the provider was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUpdatedDate string
    The date and time the provider was last updated.
    creation_date string
    The date and time the provider was created.
    id string
    The provider-assigned unique ID for this managed resource.
    last_updated_date string
    The date and time the provider was last updated.
    creationDate String
    The date and time the provider was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUpdatedDate String
    The date and time the provider was last updated.
    creationDate string
    The date and time the provider was created.
    id string
    The provider-assigned unique ID for this managed resource.
    lastUpdatedDate string
    The date and time the provider was last updated.
    creation_date str
    The date and time the provider was created.
    id str
    The provider-assigned unique ID for this managed resource.
    last_updated_date str
    The date and time the provider was last updated.
    creationDate String
    The date and time the provider was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUpdatedDate String
    The date and time the provider was last updated.

    Look up Existing SecretBackendDnsProviderGcp Resource

    Get an existing SecretBackendDnsProviderGcp resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendDnsProviderGcpState, opts?: CustomResourceOptions): SecretBackendDnsProviderGcp
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        creation_date: Optional[str] = None,
        credentials_wo: Optional[str] = None,
        credentials_wo_version: Optional[int] = None,
        identifiers: Optional[Sequence[str]] = None,
        impersonate_service_account: Optional[str] = None,
        last_updated_date: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        nameserver: Optional[str] = None,
        namespace: Optional[str] = None,
        project: Optional[str] = None,
        ttl: Optional[int] = None,
        zone_name: Optional[str] = None) -> SecretBackendDnsProviderGcp
    func GetSecretBackendDnsProviderGcp(ctx *Context, name string, id IDInput, state *SecretBackendDnsProviderGcpState, opts ...ResourceOption) (*SecretBackendDnsProviderGcp, error)
    public static SecretBackendDnsProviderGcp Get(string name, Input<string> id, SecretBackendDnsProviderGcpState? state, CustomResourceOptions? opts = null)
    public static SecretBackendDnsProviderGcp get(String name, Output<String> id, SecretBackendDnsProviderGcpState state, CustomResourceOptions options)
    resources:  _:    type: vault:pkiexternalca:SecretBackendDnsProviderGcp    get:      id: ${id}
    import {
  to = vault_pkiexternalca_secret_backend_dns_provider_gcp.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CreationDate string
    The date and time the provider was created.
    CredentialsWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    CredentialsWoVersion int
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    Identifiers List<string>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    ImpersonateServiceAccount string
    Service account email to impersonate when calling the Cloud DNS API.
    LastUpdatedDate string
    The date and time the provider was last updated.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Project string
    GCP project name containing the Cloud DNS zone.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    ZoneName string
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    CreationDate string
    The date and time the provider was created.
    CredentialsWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    CredentialsWoVersion int
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    Identifiers []string
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    ImpersonateServiceAccount string
    Service account email to impersonate when calling the Cloud DNS API.
    LastUpdatedDate string
    The date and time the provider was last updated.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Name string
    Name of the DNS provider configuration. Must be unique within the backend.
    Nameserver string
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Project string
    GCP project name containing the Cloud DNS zone.
    Ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    ZoneName string
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    creation_date string
    The date and time the provider was created.
    credentials_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentials_wo_version number
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    identifiers list(string)
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    impersonate_service_account string
    Service account email to impersonate when calling the Cloud DNS API.
    last_updated_date string
    The date and time the provider was last updated.
    mount string
    The path where the PKI External CA secret backend is mounted.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project string
    GCP project name containing the Cloud DNS zone.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zone_name string
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    creationDate String
    The date and time the provider was created.
    credentialsWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentialsWoVersion Integer
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    impersonateServiceAccount String
    Service account email to impersonate when calling the Cloud DNS API.
    lastUpdatedDate String
    The date and time the provider was last updated.
    mount String
    The path where the PKI External CA secret backend is mounted.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project String
    GCP project name containing the Cloud DNS zone.
    ttl Integer
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName String
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    creationDate string
    The date and time the provider was created.
    credentialsWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentialsWoVersion number
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    identifiers string[]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    impersonateServiceAccount string
    Service account email to impersonate when calling the Cloud DNS API.
    lastUpdatedDate string
    The date and time the provider was last updated.
    mount string
    The path where the PKI External CA secret backend is mounted.
    name string
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver string
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project string
    GCP project name containing the Cloud DNS zone.
    ttl number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName string
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    creation_date str
    The date and time the provider was created.
    credentials_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentials_wo_version int
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    identifiers Sequence[str]
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    impersonate_service_account str
    Service account email to impersonate when calling the Cloud DNS API.
    last_updated_date str
    The date and time the provider was last updated.
    mount str
    The path where the PKI External CA secret backend is mounted.
    name str
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver str
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project str
    GCP project name containing the Cloud DNS zone.
    ttl int
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zone_name str
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).
    creationDate String
    The date and time the provider was created.
    credentialsWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. GCP service account credentials as JSON content. Write-only — never stored in Terraform state. If omitted, Vault uses Application Default Credentials at challenge time.
    credentialsWoVersion Number
    Version counter for credentialsWo. Increment this to trigger an update to the credentials in Vault without changing any other field.
    identifiers List<String>
    List of domain identifiers this provider handles. Supports wildcard patterns with a leftmost * (e.g. *.example.com).
    impersonateServiceAccount String
    Service account email to impersonate when calling the Cloud DNS API.
    lastUpdatedDate String
    The date and time the provider was last updated.
    mount String
    The path where the PKI External CA secret backend is mounted.
    name String
    Name of the DNS provider configuration. Must be unique within the backend.
    nameserver String
    DNS server address in IP:port format (e.g. 8.8.4.4:53) used to verify TXT record propagation. Overrides the defaultNameserver set on the ACME account.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    project String
    GCP project name containing the Cloud DNS zone.
    ttl Number
    TTL for DNS TXT records used in DNS-01 challenges. Defaults to 60s.
    zoneName String
    GCP Cloud DNS zone name (the resource name, not the DNS name — e.g. example-com rather than example.com).

    Import

    GCP DNS provider configurations can be imported using the format <mount>/config/dns/google-cloud-dns/<name>, e.g.

    $ pulumi import vault:pkiexternalca/secretBackendDnsProviderGcp:SecretBackendDnsProviderGcp example pki-external-ca/config/dns/google-cloud-dns/my-gcp-provider

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.13.0
    published on Friday, Sep 18, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial