Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. pkiexternalca
  6. SecretBackendOrder
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.pkiexternalca.SecretBackendOrder

vault logo
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Creates and manages ACME orders for certificate issuance via PKI External CA roles. This resource initiates the ACME certificate order process with an external Certificate Authority.

    Note This resource creates an ACME order but does not automatically fulfill challenges or fetch the certificate. Use vault.pkiexternalca.getSecretBackendOrderChallenge data source to retrieve challenge details, vault.pkiexternalca.SecretBackendOrderChallengeFulfilled to mark challenges as fulfilled, and vault.pkiexternalca.SecretBackendOrderCertificate to fetch the final certificate.

    Example Usage

    With Identifiers

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const pki_external_ca = new vault.Mount("pki-external-ca", {
    path: "pki-external-ca",
    type: "pki-external-ca",
});
const example = new vault.pkiexternalca.SecretBackendAcmeAccount("example", {
    mount: pki_external_ca.path,
    name: "my-acme-account",
    directoryUrl: "https://acme-v02.api.letsencrypt.org/directory",
    emailContacts: ["admin@example.com"],
});
const exampleSecretBackendRole = new vault.pkiexternalca.SecretBackendRole("example", {
    mount: pki_external_ca.path,
    name: "example-role",
    acmeAccountName: example.name,
    allowedDomains: ["example.com"],
    allowedDomainOptions: [
        "bare_domains",
        "subdomains",
    ],
});
const exampleSecretBackendOrder = new vault.pkiexternalca.SecretBackendOrder("example", {
    mount: pki_external_ca.path,
    roleName: exampleSecretBackendRole.name,
    identifiers: [
        "www.example.com",
        "api.example.com",
    ],
});

    import pulumi
import pulumi_vault as vault

pki_external_ca = vault.Mount("pki-external-ca",
    path="pki-external-ca",
    type="pki-external-ca")
example = vault.pkiexternalca.SecretBackendAcmeAccount("example",
    mount=pki_external_ca.path,
    name="my-acme-account",
    directory_url="https://acme-v02.api.letsencrypt.org/directory",
    email_contacts=["admin@example.com"])
example_secret_backend_role = vault.pkiexternalca.SecretBackendRole("example",
    mount=pki_external_ca.path,
    name="example-role",
    acme_account_name=example.name,
    allowed_domains=["example.com"],
    allowed_domain_options=[
        "bare_domains",
        "subdomains",
    ])
example_secret_backend_order = vault.pkiexternalca.SecretBackendOrder("example",
    mount=pki_external_ca.path,
    role_name=example_secret_backend_role.name,
    identifiers=[
        "www.example.com",
        "api.example.com",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki_external_ca, err := vault.NewMount(ctx, "pki-external-ca", &vault.MountArgs{
			Path: pulumi.String("pki-external-ca"),
			Type: pulumi.String("pki-external-ca"),
		})
		if err != nil {
			return err
		}
		example, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, "example", &pkiexternalca.SecretBackendAcmeAccountArgs{
			Mount:        pki_external_ca.Path,
			Name:         pulumi.String("my-acme-account"),
			DirectoryUrl: pulumi.String("https://acme-v02.api.letsencrypt.org/directory"),
			EmailContacts: pulumi.StringArray{
				pulumi.String("admin@example.com"),
			},
		})
		if err != nil {
			return err
		}
		exampleSecretBackendRole, err := pkiexternalca.NewSecretBackendRole(ctx, "example", &pkiexternalca.SecretBackendRoleArgs{
			Mount:           pki_external_ca.Path,
			Name:            pulumi.String("example-role"),
			AcmeAccountName: example.Name,
			AllowedDomains: pulumi.StringArray{
				pulumi.String("example.com"),
			},
			AllowedDomainOptions: pulumi.StringArray{
				pulumi.String("bare_domains"),
				pulumi.String("subdomains"),
			},
		})
		if err != nil {
			return err
		}
		_, err = pkiexternalca.NewSecretBackendOrder(ctx, "example", &pkiexternalca.SecretBackendOrderArgs{
			Mount:    pki_external_ca.Path,
			RoleName: exampleSecretBackendRole.Name,
			Identifiers: pulumi.StringArray{
				pulumi.String("www.example.com"),
				pulumi.String("api.example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki_external_ca = new Vault.Mount("pki-external-ca", new()
    {
        Path = "pki-external-ca",
        Type = "pki-external-ca",
    });

    var example = new Vault.PkiExternalCa.SecretBackendAcmeAccount("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "my-acme-account",
        DirectoryUrl = "https://acme-v02.api.letsencrypt.org/directory",
        EmailContacts = new[]
        {
            "admin@example.com",
        },
    });

    var exampleSecretBackendRole = new Vault.PkiExternalCa.SecretBackendRole("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "example-role",
        AcmeAccountName = example.Name,
        AllowedDomains = new[]
        {
            "example.com",
        },
        AllowedDomainOptions = new[]
        {
            "bare_domains",
            "subdomains",
        },
    });

    var exampleSecretBackendOrder = new Vault.PkiExternalCa.SecretBackendOrder("example", new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleSecretBackendRole.Name,
        Identifiers = new[]
        {
            "www.example.com",
            "api.example.com",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendRole;
import com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendOrder;
import com.pulumi.vault.pkiexternalca.SecretBackendOrderArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki_external_ca = new Mount("pki-external-ca", MountArgs.builder()
            .path("pki-external-ca")
            .type("pki-external-ca")
            .build());

        var example = new SecretBackendAcmeAccount("example", SecretBackendAcmeAccountArgs.builder()
            .mount(pki_external_ca.path())
            .name("my-acme-account")
            .directoryUrl("https://acme-v02.api.letsencrypt.org/directory")
            .emailContacts("admin@example.com")
            .build());

        var exampleSecretBackendRole = new SecretBackendRole("exampleSecretBackendRole", SecretBackendRoleArgs.builder()
            .mount(pki_external_ca.path())
            .name("example-role")
            .acmeAccountName(example.name())
            .allowedDomains("example.com")
            .allowedDomainOptions(            
                "bare_domains",
                "subdomains")
            .build());

        var exampleSecretBackendOrder = new SecretBackendOrder("exampleSecretBackendOrder", SecretBackendOrderArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleSecretBackendRole.name())
            .identifiers(            
                "www.example.com",
                "api.example.com")
            .build());

    }
}

    resources:
  pki-external-ca:
    type: vault:Mount
    properties:
      path: pki-external-ca
      type: pki-external-ca
  example:
    type: vault:pkiexternalca:SecretBackendAcmeAccount
    properties:
      mount: ${["pki-external-ca"].path}
      name: my-acme-account
      directoryUrl: https://acme-v02.api.letsencrypt.org/directory
      emailContacts:
        - admin@example.com
  exampleSecretBackendRole:
    type: vault:pkiexternalca:SecretBackendRole
    name: example
    properties:
      mount: ${["pki-external-ca"].path}
      name: example-role
      acmeAccountName: ${example.name}
      allowedDomains:
        - example.com
      allowedDomainOptions:
        - bare_domains
        - subdomains
  exampleSecretBackendOrder:
    type: vault:pkiexternalca:SecretBackendOrder
    name: example
    properties:
      mount: ${["pki-external-ca"].path}
      roleName: ${exampleSecretBackendRole.name}
      identifiers:
        - www.example.com
        - api.example.com

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "pki-external-ca" {
  path = "pki-external-ca"
  type = "pki-external-ca"
}
resource "vault_pkiexternalca_secretbackendacmeaccount" "example" {
  mount          = vault_mount.pki-external-ca.path
  name           = "my-acme-account"
  directory_url  = "https://acme-v02.api.letsencrypt.org/directory"
  email_contacts = ["admin@example.com"]
}
resource "vault_pkiexternalca_secretbackendrole" "example" {
  mount                  = vault_mount.pki-external-ca.path
  name                   = "example-role"
  acme_account_name      = vault_pkiexternalca_secretbackendacmeaccount.example.name
  allowed_domains        = ["example.com"]
  allowed_domain_options = ["bare_domains", "subdomains"]
}
resource "vault_pkiexternalca_secretbackendorder" "example" {
  mount       = vault_mount.pki-external-ca.path
  role_name   = vault_pkiexternalca_secretbackendrole.example.name
  identifiers = ["www.example.com", "api.example.com"]
}

    With CSR

    import * as pulumi from "@pulumi/pulumi";
import * as tls from "@pulumi/tls";
import * as vault from "@pulumi/vault";

const example = new tls.index.PrivateKey("example", {
    algorithm: "RSA",
    rsaBits: 2048,
});
const exampleCertRequest = new tls.index.CertRequest("example", {
    privateKeyPem: example.privateKeyPem,
    subject: [{
        commonName: "www.example.com",
    }],
    dnsNames: [
        "www.example.com",
        "api.example.com",
    ],
});
const withCsr = new vault.pkiexternalca.SecretBackendOrder("with_csr", {
    mount: pki_external_ca.path,
    roleName: exampleVaultPkiExternalCaSecretBackendRole.name,
    csr: exampleCertRequest.certRequestPem,
});

    import pulumi
import pulumi_tls as tls
import pulumi_vault as vault

example = tls.PrivateKey("example",
    algorithm=RSA,
    rsa_bits=2048)
example_cert_request = tls.CertRequest("example",
    private_key_pem=example.private_key_pem,
    subject=[{
        commonName: www.example.com,
    }],
    dns_names=[
        www.example.com,
        api.example.com,
    ])
with_csr = vault.pkiexternalca.SecretBackendOrder("with_csr",
    mount=pki_external_ca["path"],
    role_name=example_vault_pki_external_ca_secret_backend_role["name"],
    csr=example_cert_request["certRequestPem"])

    package main

import (
	"github.com/pulumi/pulumi-tls/sdk/go/tls"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := tls.NewPrivateKey(ctx, "example", &tls.PrivateKeyArgs{
			Algorithm: "RSA",
			RsaBits:   2048,
		})
		if err != nil {
			return err
		}
		exampleCertRequest, err := tls.NewCertRequest(ctx, "example", &tls.CertRequestArgs{
			PrivateKeyPem: example.PrivateKeyPem,
			Subject: []map[string]interface{}{
				map[string]interface{}{
					"commonName": "www.example.com",
				},
			},
			DnsNames: []string{
				"www.example.com",
				"api.example.com",
			},
		})
		if err != nil {
			return err
		}
		_, err = pkiexternalca.NewSecretBackendOrder(ctx, "with_csr", &pkiexternalca.SecretBackendOrderArgs{
			Mount:    pulumi.Any(pki_external_ca.Path),
			RoleName: pulumi.Any(exampleVaultPkiExternalCaSecretBackendRole.Name),
			Csr:      exampleCertRequest.CertRequestPem,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Tls = Pulumi.Tls;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var example = new Tls.PrivateKey("example", new()
    {
        Algorithm = "RSA",
        RsaBits = 2048,
    });

    var exampleCertRequest = new Tls.CertRequest("example", new()
    {
        PrivateKeyPem = example.PrivateKeyPem,
        Subject = new[]
        {
            
            {
                { "commonName", "www.example.com" },
            },
        },
        DnsNames = new[]
        {
            "www.example.com",
            "api.example.com",
        },
    });

    var withCsr = new Vault.PkiExternalCa.SecretBackendOrder("with_csr", new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleVaultPkiExternalCaSecretBackendRole.Name,
        Csr = exampleCertRequest.CertRequestPem,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.tls.PrivateKey;
import com.pulumi.tls.PrivateKeyArgs;
import com.pulumi.tls.CertRequest;
import com.pulumi.tls.CertRequestArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendOrder;
import com.pulumi.vault.pkiexternalca.SecretBackendOrderArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new PrivateKey("example", PrivateKeyArgs.builder()
            .algorithm("RSA")
            .rsaBits(2048)
            .build());

        var exampleCertRequest = new CertRequest("exampleCertRequest", CertRequestArgs.builder()
            .privateKeyPem(example.privateKeyPem())
            .subject(Arrays.asList(Map.of("commonName", "www.example.com")))
            .dnsNames(Arrays.asList(            
                "www.example.com",
                "api.example.com"))
            .build());

        var withCsr = new SecretBackendOrder("withCsr", SecretBackendOrderArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleVaultPkiExternalCaSecretBackendRole.name())
            .csr(exampleCertRequest.certRequestPem())
            .build());

    }
}

    resources:
  example:
    type: tls:PrivateKey
    properties:
      algorithm: RSA
      rsaBits: 2048
  exampleCertRequest:
    type: tls:CertRequest
    name: example
    properties:
      privateKeyPem: ${example.privateKeyPem}
      subject:
        - commonName: www.example.com
      dnsNames:
        - www.example.com
        - api.example.com
  withCsr:
    type: vault:pkiexternalca:SecretBackendOrder
    name: with_csr
    properties:
      mount: ${["pki-external-ca"].path}
      roleName: ${exampleVaultPkiExternalCaSecretBackendRole.name}
      csr: ${exampleCertRequest.certRequestPem}

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "tls_privatekey" "example" {
  algorithm = "RSA"
  rsa_bits  = 2048
}
resource "tls_certrequest" "example" {
  private_key_pem = tls_privatekey.example.privateKeyPem
  subject = [{
    "commonName" = "www.example.com"
  }]
  dns_names = ["www.example.com", "api.example.com"]
}
resource "vault_pkiexternalca_secretbackendorder" "with_csr" {
  mount     = pki-external-ca.path
  role_name = exampleVaultPkiExternalCaSecretBackendRole.name
  csr       = tls_certrequest.example.certRequestPem
}

    Create SecretBackendOrder Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendOrder(name: string, args: SecretBackendOrderArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendOrder(resource_name: str,
                       args: SecretBackendOrderArgs,
                       opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendOrder(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       mount: Optional[str] = None,
                       role_name: Optional[str] = None,
                       csr: Optional[str] = None,
                       identifiers: Optional[Sequence[str]] = None,
                       namespace: Optional[str] = None)
    func NewSecretBackendOrder(ctx *Context, name string, args SecretBackendOrderArgs, opts ...ResourceOption) (*SecretBackendOrder, error)
    public SecretBackendOrder(string name, SecretBackendOrderArgs args, CustomResourceOptions? opts = null)
    public SecretBackendOrder(String name, SecretBackendOrderArgs args)
public SecretBackendOrder(String name, SecretBackendOrderArgs args, CustomResourceOptions options)

    type: vault:pkiexternalca:SecretBackendOrder
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_pkiexternalca_secret_backend_order" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendOrderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendOrderArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendOrderArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendOrderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendOrderArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretBackendOrderResource = new Vault.PkiExternalCa.SecretBackendOrder("secretBackendOrderResource", new()
{
    Mount = "string",
    RoleName = "string",
    Csr = "string",
    Identifiers = new[]
    {
        "string",
    },
    Namespace = "string",
});

    example, err := pkiexternalca.NewSecretBackendOrder(ctx, "secretBackendOrderResource", &pkiexternalca.SecretBackendOrderArgs{
	Mount:    pulumi.String("string"),
	RoleName: pulumi.String("string"),
	Csr:      pulumi.String("string"),
	Identifiers: pulumi.StringArray{
		pulumi.String("string"),
	},
	Namespace: pulumi.String("string"),
})

    resource "vault_pkiexternalca_secret_backend_order" "secretBackendOrderResource" {
  lifecycle {
    create_before_destroy = true
  }
  mount       = "string"
  role_name   = "string"
  csr         = "string"
  identifiers = ["string"]
  namespace   = "string"
}

    var secretBackendOrderResource = new SecretBackendOrder("secretBackendOrderResource", SecretBackendOrderArgs.builder()
    .mount("string")
    .roleName("string")
    .csr("string")
    .identifiers("string")
    .namespace("string")
    .build());

    secret_backend_order_resource = vault.pkiexternalca.SecretBackendOrder("secretBackendOrderResource",
    mount="string",
    role_name="string",
    csr="string",
    identifiers=["string"],
    namespace="string")

    const secretBackendOrderResource = new vault.pkiexternalca.SecretBackendOrder("secretBackendOrderResource", {
    mount: "string",
    roleName: "string",
    csr: "string",
    identifiers: ["string"],
    namespace: "string",
});

    type: vault:pkiexternalca:SecretBackendOrder
properties:
    csr: string
    identifiers:
        - string
    mount: string
    namespace: string
    roleName: string

    SecretBackendOrder Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendOrder resource accepts the following input properties:

    Mount string
    The path where the PKI External CA secret backend is mounted.
    RoleName string
    Name of the role to create the order for.
    Csr string
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    Identifiers List<string>
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    RoleName string
    Name of the role to create the order for.
    Csr string
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    Identifiers []string
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount string
    The path where the PKI External CA secret backend is mounted.
    role_name string
    Name of the role to create the order for.
    csr string
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    identifiers list(string)
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount String
    The path where the PKI External CA secret backend is mounted.
    roleName String
    Name of the role to create the order for.
    csr String
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    identifiers List<String>
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount string
    The path where the PKI External CA secret backend is mounted.
    roleName string
    Name of the role to create the order for.
    csr string
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    identifiers string[]
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount str
    The path where the PKI External CA secret backend is mounted.
    role_name str
    Name of the role to create the order for.
    csr str
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    identifiers Sequence[str]
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount String
    The path where the PKI External CA secret backend is mounted.
    roleName String
    Name of the role to create the order for.
    csr String
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    identifiers List<String>
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendOrder resource produces the following output properties:

    Challenges Dictionary<string, string>
    Map of identifiers to their ACME challenges (simplified representation).
    CreationDate string
    The date and time the order was created in RFC3339 format.
    Expires string
    The expiration date of the order in RFC3339 format.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastError string
    The last error message encountered during order processing, if any.
    LastUpdate string
    The date and time the order was last updated in RFC3339 format.
    NextWorkDate string
    The next scheduled work date for this order in RFC3339 format.
    OrderId string
    The unique identifier for this ACME order.
    OrderStatus string
    Current status of the order. Possible values include:
    SerialNumber string
    The serial number of the issued certificate (available when order is completed).
    Challenges map[string]string
    Map of identifiers to their ACME challenges (simplified representation).
    CreationDate string
    The date and time the order was created in RFC3339 format.
    Expires string
    The expiration date of the order in RFC3339 format.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastError string
    The last error message encountered during order processing, if any.
    LastUpdate string
    The date and time the order was last updated in RFC3339 format.
    NextWorkDate string
    The next scheduled work date for this order in RFC3339 format.
    OrderId string
    The unique identifier for this ACME order.
    OrderStatus string
    Current status of the order. Possible values include:
    SerialNumber string
    The serial number of the issued certificate (available when order is completed).
    challenges map(string)
    Map of identifiers to their ACME challenges (simplified representation).
    creation_date string
    The date and time the order was created in RFC3339 format.
    expires string
    The expiration date of the order in RFC3339 format.
    id string
    The provider-assigned unique ID for this managed resource.
    last_error string
    The last error message encountered during order processing, if any.
    last_update string
    The date and time the order was last updated in RFC3339 format.
    next_work_date string
    The next scheduled work date for this order in RFC3339 format.
    order_id string
    The unique identifier for this ACME order.
    order_status string
    Current status of the order. Possible values include:
    serial_number string
    The serial number of the issued certificate (available when order is completed).
    challenges Map<String,String>
    Map of identifiers to their ACME challenges (simplified representation).
    creationDate String
    The date and time the order was created in RFC3339 format.
    expires String
    The expiration date of the order in RFC3339 format.
    id String
    The provider-assigned unique ID for this managed resource.
    lastError String
    The last error message encountered during order processing, if any.
    lastUpdate String
    The date and time the order was last updated in RFC3339 format.
    nextWorkDate String
    The next scheduled work date for this order in RFC3339 format.
    orderId String
    The unique identifier for this ACME order.
    orderStatus String
    Current status of the order. Possible values include:
    serialNumber String
    The serial number of the issued certificate (available when order is completed).
    challenges {[key: string]: string}
    Map of identifiers to their ACME challenges (simplified representation).
    creationDate string
    The date and time the order was created in RFC3339 format.
    expires string
    The expiration date of the order in RFC3339 format.
    id string
    The provider-assigned unique ID for this managed resource.
    lastError string
    The last error message encountered during order processing, if any.
    lastUpdate string
    The date and time the order was last updated in RFC3339 format.
    nextWorkDate string
    The next scheduled work date for this order in RFC3339 format.
    orderId string
    The unique identifier for this ACME order.
    orderStatus string
    Current status of the order. Possible values include:
    serialNumber string
    The serial number of the issued certificate (available when order is completed).
    challenges Mapping[str, str]
    Map of identifiers to their ACME challenges (simplified representation).
    creation_date str
    The date and time the order was created in RFC3339 format.
    expires str
    The expiration date of the order in RFC3339 format.
    id str
    The provider-assigned unique ID for this managed resource.
    last_error str
    The last error message encountered during order processing, if any.
    last_update str
    The date and time the order was last updated in RFC3339 format.
    next_work_date str
    The next scheduled work date for this order in RFC3339 format.
    order_id str
    The unique identifier for this ACME order.
    order_status str
    Current status of the order. Possible values include:
    serial_number str
    The serial number of the issued certificate (available when order is completed).
    challenges Map<String>
    Map of identifiers to their ACME challenges (simplified representation).
    creationDate String
    The date and time the order was created in RFC3339 format.
    expires String
    The expiration date of the order in RFC3339 format.
    id String
    The provider-assigned unique ID for this managed resource.
    lastError String
    The last error message encountered during order processing, if any.
    lastUpdate String
    The date and time the order was last updated in RFC3339 format.
    nextWorkDate String
    The next scheduled work date for this order in RFC3339 format.
    orderId String
    The unique identifier for this ACME order.
    orderStatus String
    Current status of the order. Possible values include:
    serialNumber String
    The serial number of the issued certificate (available when order is completed).

    Look up Existing SecretBackendOrder Resource

    Get an existing SecretBackendOrder resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendOrderState, opts?: CustomResourceOptions): SecretBackendOrder
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        challenges: Optional[Mapping[str, str]] = None,
        creation_date: Optional[str] = None,
        csr: Optional[str] = None,
        expires: Optional[str] = None,
        identifiers: Optional[Sequence[str]] = None,
        last_error: Optional[str] = None,
        last_update: Optional[str] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        next_work_date: Optional[str] = None,
        order_id: Optional[str] = None,
        order_status: Optional[str] = None,
        role_name: Optional[str] = None,
        serial_number: Optional[str] = None) -> SecretBackendOrder
    func GetSecretBackendOrder(ctx *Context, name string, id IDInput, state *SecretBackendOrderState, opts ...ResourceOption) (*SecretBackendOrder, error)
    public static SecretBackendOrder Get(string name, Input<string> id, SecretBackendOrderState? state, CustomResourceOptions? opts = null)
    public static SecretBackendOrder get(String name, Output<String> id, SecretBackendOrderState state, CustomResourceOptions options)
    resources:  _:    type: vault:pkiexternalca:SecretBackendOrder    get:      id: ${id}
    import {
  to = vault_pkiexternalca_secret_backend_order.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Challenges Dictionary<string, string>
    Map of identifiers to their ACME challenges (simplified representation).
    CreationDate string
    The date and time the order was created in RFC3339 format.
    Csr string
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    Expires string
    The expiration date of the order in RFC3339 format.
    Identifiers List<string>
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    LastError string
    The last error message encountered during order processing, if any.
    LastUpdate string
    The date and time the order was last updated in RFC3339 format.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NextWorkDate string
    The next scheduled work date for this order in RFC3339 format.
    OrderId string
    The unique identifier for this ACME order.
    OrderStatus string
    Current status of the order. Possible values include:
    RoleName string
    Name of the role to create the order for.
    SerialNumber string
    The serial number of the issued certificate (available when order is completed).
    Challenges map[string]string
    Map of identifiers to their ACME challenges (simplified representation).
    CreationDate string
    The date and time the order was created in RFC3339 format.
    Csr string
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    Expires string
    The expiration date of the order in RFC3339 format.
    Identifiers []string
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    LastError string
    The last error message encountered during order processing, if any.
    LastUpdate string
    The date and time the order was last updated in RFC3339 format.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NextWorkDate string
    The next scheduled work date for this order in RFC3339 format.
    OrderId string
    The unique identifier for this ACME order.
    OrderStatus string
    Current status of the order. Possible values include:
    RoleName string
    Name of the role to create the order for.
    SerialNumber string
    The serial number of the issued certificate (available when order is completed).
    challenges map(string)
    Map of identifiers to their ACME challenges (simplified representation).
    creation_date string
    The date and time the order was created in RFC3339 format.
    csr string
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    expires string
    The expiration date of the order in RFC3339 format.
    identifiers list(string)
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    last_error string
    The last error message encountered during order processing, if any.
    last_update string
    The date and time the order was last updated in RFC3339 format.
    mount string
    The path where the PKI External CA secret backend is mounted.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    next_work_date string
    The next scheduled work date for this order in RFC3339 format.
    order_id string
    The unique identifier for this ACME order.
    order_status string
    Current status of the order. Possible values include:
    role_name string
    Name of the role to create the order for.
    serial_number string
    The serial number of the issued certificate (available when order is completed).
    challenges Map<String,String>
    Map of identifiers to their ACME challenges (simplified representation).
    creationDate String
    The date and time the order was created in RFC3339 format.
    csr String
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    expires String
    The expiration date of the order in RFC3339 format.
    identifiers List<String>
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    lastError String
    The last error message encountered during order processing, if any.
    lastUpdate String
    The date and time the order was last updated in RFC3339 format.
    mount String
    The path where the PKI External CA secret backend is mounted.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    nextWorkDate String
    The next scheduled work date for this order in RFC3339 format.
    orderId String
    The unique identifier for this ACME order.
    orderStatus String
    Current status of the order. Possible values include:
    roleName String
    Name of the role to create the order for.
    serialNumber String
    The serial number of the issued certificate (available when order is completed).
    challenges {[key: string]: string}
    Map of identifiers to their ACME challenges (simplified representation).
    creationDate string
    The date and time the order was created in RFC3339 format.
    csr string
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    expires string
    The expiration date of the order in RFC3339 format.
    identifiers string[]
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    lastError string
    The last error message encountered during order processing, if any.
    lastUpdate string
    The date and time the order was last updated in RFC3339 format.
    mount string
    The path where the PKI External CA secret backend is mounted.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    nextWorkDate string
    The next scheduled work date for this order in RFC3339 format.
    orderId string
    The unique identifier for this ACME order.
    orderStatus string
    Current status of the order. Possible values include:
    roleName string
    Name of the role to create the order for.
    serialNumber string
    The serial number of the issued certificate (available when order is completed).
    challenges Mapping[str, str]
    Map of identifiers to their ACME challenges (simplified representation).
    creation_date str
    The date and time the order was created in RFC3339 format.
    csr str
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    expires str
    The expiration date of the order in RFC3339 format.
    identifiers Sequence[str]
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    last_error str
    The last error message encountered during order processing, if any.
    last_update str
    The date and time the order was last updated in RFC3339 format.
    mount str
    The path where the PKI External CA secret backend is mounted.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    next_work_date str
    The next scheduled work date for this order in RFC3339 format.
    order_id str
    The unique identifier for this ACME order.
    order_status str
    Current status of the order. Possible values include:
    role_name str
    Name of the role to create the order for.
    serial_number str
    The serial number of the issued certificate (available when order is completed).
    challenges Map<String>
    Map of identifiers to their ACME challenges (simplified representation).
    creationDate String
    The date and time the order was created in RFC3339 format.
    csr String
    PEM-encoded Certificate Signing Request containing identifiers. Required if identifiers is not provided. Mutually exclusive with identifiers.
    expires String
    The expiration date of the order in RFC3339 format.
    identifiers List<String>
    List of identifiers (domain names) for the certificate order. Required if csr is not provided. Mutually exclusive with csr.
    lastError String
    The last error message encountered during order processing, if any.
    lastUpdate String
    The date and time the order was last updated in RFC3339 format.
    mount String
    The path where the PKI External CA secret backend is mounted.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    nextWorkDate String
    The next scheduled work date for this order in RFC3339 format.
    orderId String
    The unique identifier for this ACME order.
    orderStatus String
    Current status of the order. Possible values include:
    roleName String
    Name of the role to create the order for.
    serialNumber String
    The serial number of the issued certificate (available when order is completed).

    Import

    PKI External CA orders can be imported using the format <mount>/role/<role_name>/order/<order_id>, e.g.

    $ pulumi import vault:pkiexternalca/secretBackendOrder:SecretBackendOrder example pki-external-ca/role/example-role/order/abc123

    Note Orders are immutable once created. Any changes to the configuration will require creating a new order.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo
    Viewing docs for HashiCorp Vault v7.11.0
    published on Wednesday, Jul 22, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial