vault.pkiexternalca.SecretBackendOrderChallengeFulfilled

HashiCorp Vault v7.11.0, Jul 22 26

Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-vault

Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-vault

Note This resource should be used after you have completed the challenge requirements (e.g., placed the HTTP-01 challenge file, created the DNS-01 TXT record, or configured the TLS-ALPN-01 certificate). Use the vault.pkiexternalca.getSecretBackendOrderChallenge data source to retrieve the challenge details first.

Example Usage

With HTTP-01 Challenge

import * as pulumi from "@pulumi/pulumi";
import * as local from "@pulumi/local";
import * as vault from "@pulumi/vault";

const pki_external_ca = new vault.Mount("pki-external-ca", {
    path: "pki-external-ca",
    type: "pki-external-ca",
});
const exampleSecretBackendAcmeAccount = new vault.pkiexternalca.SecretBackendAcmeAccount("example", {
    mount: pki_external_ca.path,
    name: "my-acme-account",
    directoryUrl: "https://acme-v02.api.letsencrypt.org/directory",
    emailContacts: ["admin@example.com"],
});
const exampleSecretBackendRole = new vault.pkiexternalca.SecretBackendRole("example", {
    mount: pki_external_ca.path,
    name: "example-role",
    acmeAccountName: exampleSecretBackendAcmeAccount.name,
    allowedDomains: ["example.com"],
    allowedDomainOptions: [
        "bare_domains",
        "subdomains",
    ],
    allowedChallengeTypes: ["http-01"],
});
const exampleSecretBackendOrder = new vault.pkiexternalca.SecretBackendOrder("example", {
    mount: pki_external_ca.path,
    roleName: exampleSecretBackendRole.name,
    identifiers: ["www.example.com"],
});
// Retrieve challenge details
const example = vault.pkiexternalca.getSecretBackendOrderChallengeOutput({
    mount: pki_external_ca.path,
    roleName: exampleSecretBackendRole.name,
    orderId: exampleSecretBackendOrder.orderId,
    challengeType: "http-01",
    identifier: "www.example.com",
});
// Deploy the challenge (example using local_file)
const challenge = new local.index.File("challenge", {
    filename: `/var/www/html/.well-known/acme-challenge/${example.token}`,
    content: example.keyAuthorization,
});
// Mark challenge as fulfilled after deployment
const exampleSecretBackendOrderChallengeFulfilled = new vault.pkiexternalca.SecretBackendOrderChallengeFulfilled("example", {
    mount: pki_external_ca.path,
    roleName: exampleSecretBackendRole.name,
    orderId: exampleSecretBackendOrder.orderId,
    challengeType: "http-01",
    identifier: "www.example.com",
}, {
    dependsOn: [challenge],
});

import pulumi
import pulumi_local as local
import pulumi_vault as vault

pki_external_ca = vault.Mount("pki-external-ca",
    path="pki-external-ca",
    type="pki-external-ca")
example_secret_backend_acme_account = vault.pkiexternalca.SecretBackendAcmeAccount("example",
    mount=pki_external_ca.path,
    name="my-acme-account",
    directory_url="https://acme-v02.api.letsencrypt.org/directory",
    email_contacts=["admin@example.com"])
example_secret_backend_role = vault.pkiexternalca.SecretBackendRole("example",
    mount=pki_external_ca.path,
    name="example-role",
    acme_account_name=example_secret_backend_acme_account.name,
    allowed_domains=["example.com"],
    allowed_domain_options=[
        "bare_domains",
        "subdomains",
    ],
    allowed_challenge_types=["http-01"])
example_secret_backend_order = vault.pkiexternalca.SecretBackendOrder("example",
    mount=pki_external_ca.path,
    role_name=example_secret_backend_role.name,
    identifiers=["www.example.com"])
# Retrieve challenge details
example = vault.pkiexternalca.get_secret_backend_order_challenge_output(mount=pki_external_ca.path,
    role_name=example_secret_backend_role.name,
    order_id=example_secret_backend_order.order_id,
    challenge_type="http-01",
    identifier="www.example.com")
# Deploy the challenge (example using local_file)
challenge = local.File("challenge",
    filename=f/var/www/html/.well-known/acme-challenge/{example.token},
    content=example.key_authorization)
# Mark challenge as fulfilled after deployment
example_secret_backend_order_challenge_fulfilled = vault.pkiexternalca.SecretBackendOrderChallengeFulfilled("example",
    mount=pki_external_ca.path,
    role_name=example_secret_backend_role.name,
    order_id=example_secret_backend_order.order_id,
    challenge_type="http-01",
    identifier="www.example.com",
    opts = pulumi.ResourceOptions(depends_on=[challenge]))

package main

import (
	"github.com/pulumi/pulumi-local/sdk/go/local"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki_external_ca, err := vault.NewMount(ctx, "pki-external-ca", &vault.MountArgs{
			Path: pulumi.String("pki-external-ca"),
			Type: pulumi.String("pki-external-ca"),
		})
		if err != nil {
			return err
		}
		exampleSecretBackendAcmeAccount, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, "example", &pkiexternalca.SecretBackendAcmeAccountArgs{
			Mount:        pki_external_ca.Path,
			Name:         pulumi.String("my-acme-account"),
			DirectoryUrl: pulumi.String("https://acme-v02.api.letsencrypt.org/directory"),
			EmailContacts: pulumi.StringArray{
				pulumi.String("admin@example.com"),
			},
		})
		if err != nil {
			return err
		}
		exampleSecretBackendRole, err := pkiexternalca.NewSecretBackendRole(ctx, "example", &pkiexternalca.SecretBackendRoleArgs{
			Mount:           pki_external_ca.Path,
			Name:            pulumi.String("example-role"),
			AcmeAccountName: exampleSecretBackendAcmeAccount.Name,
			AllowedDomains: pulumi.StringArray{
				pulumi.String("example.com"),
			},
			AllowedDomainOptions: pulumi.StringArray{
				pulumi.String("bare_domains"),
				pulumi.String("subdomains"),
			},
			AllowedChallengeTypes: pulumi.StringArray{
				pulumi.String("http-01"),
			},
		})
		if err != nil {
			return err
		}
		exampleSecretBackendOrder, err := pkiexternalca.NewSecretBackendOrder(ctx, "example", &pkiexternalca.SecretBackendOrderArgs{
			Mount:    pki_external_ca.Path,
			RoleName: exampleSecretBackendRole.Name,
			Identifiers: pulumi.StringArray{
				pulumi.String("www.example.com"),
			},
		})
		if err != nil {
			return err
		}
		// Retrieve challenge details
		example := pkiexternalca.GetSecretBackendOrderChallengeOutput(ctx, pkiexternalca.GetSecretBackendOrderChallengeOutputArgs{
			Mount:         pki_external_ca.Path,
			RoleName:      exampleSecretBackendRole.Name,
			OrderId:       exampleSecretBackendOrder.OrderId,
			ChallengeType: pulumi.String("http-01"),
			Identifier:    pulumi.String("www.example.com"),
		}, nil)
		// Deploy the challenge (example using local_file)
		challenge, err := local.NewFile(ctx, "challenge", &local.FileArgs{
			Filename: pulumi.Sprintf("/var/www/html/.well-known/acme-challenge/%v", example.Token),
			Content:  example.KeyAuthorization,
		})
		if err != nil {
			return err
		}
		// Mark challenge as fulfilled after deployment
		_, err = pkiexternalca.NewSecretBackendOrderChallengeFulfilled(ctx, "example", &pkiexternalca.SecretBackendOrderChallengeFulfilledArgs{
			Mount:         pki_external_ca.Path,
			RoleName:      exampleSecretBackendRole.Name,
			OrderId:       exampleSecretBackendOrder.OrderId,
			ChallengeType: pulumi.String("http-01"),
			Identifier:    pulumi.String("www.example.com"),
		}, pulumi.DependsOn([]pulumi.Resource{
			challenge,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Local = Pulumi.Local;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki_external_ca = new Vault.Mount("pki-external-ca", new()
    {
        Path = "pki-external-ca",
        Type = "pki-external-ca",
    });

    var exampleSecretBackendAcmeAccount = new Vault.PkiExternalCa.SecretBackendAcmeAccount("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "my-acme-account",
        DirectoryUrl = "https://acme-v02.api.letsencrypt.org/directory",
        EmailContacts = new[]
        {
            "admin@example.com",
        },
    });

    var exampleSecretBackendRole = new Vault.PkiExternalCa.SecretBackendRole("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "example-role",
        AcmeAccountName = exampleSecretBackendAcmeAccount.Name,
        AllowedDomains = new[]
        {
            "example.com",
        },
        AllowedDomainOptions = new[]
        {
            "bare_domains",
            "subdomains",
        },
        AllowedChallengeTypes = new[]
        {
            "http-01",
        },
    });

    var exampleSecretBackendOrder = new Vault.PkiExternalCa.SecretBackendOrder("example", new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleSecretBackendRole.Name,
        Identifiers = new[]
        {
            "www.example.com",
        },
    });

    // Retrieve challenge details
    var example = Vault.PkiExternalCa.GetSecretBackendOrderChallenge.Invoke(new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleSecretBackendRole.Name,
        OrderId = exampleSecretBackendOrder.OrderId,
        ChallengeType = "http-01",
        Identifier = "www.example.com",
    });

    // Deploy the challenge (example using local_file)
    var challenge = new Local.File("challenge", new()
    {
        Filename = $"/var/www/html/.well-known/acme-challenge/{example.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.Token)}",
        Content = example.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.KeyAuthorization),
    });

    // Mark challenge as fulfilled after deployment
    var exampleSecretBackendOrderChallengeFulfilled = new Vault.PkiExternalCa.SecretBackendOrderChallengeFulfilled("example", new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleSecretBackendRole.Name,
        OrderId = exampleSecretBackendOrder.OrderId,
        ChallengeType = "http-01",
        Identifier = "www.example.com",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            challenge,
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendRole;
import com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendOrder;
import com.pulumi.vault.pkiexternalca.SecretBackendOrderArgs;
import com.pulumi.vault.pkiexternalca.PkiexternalcaFunctions;
import com.pulumi.vault.pkiexternalca.inputs.GetSecretBackendOrderChallengeArgs;
import com.pulumi.local.File;
import com.pulumi.local.FileArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilled;
import com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilledArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki_external_ca = new Mount("pki-external-ca", MountArgs.builder()
            .path("pki-external-ca")
            .type("pki-external-ca")
            .build());

        var exampleSecretBackendAcmeAccount = new SecretBackendAcmeAccount("exampleSecretBackendAcmeAccount", SecretBackendAcmeAccountArgs.builder()
            .mount(pki_external_ca.path())
            .name("my-acme-account")
            .directoryUrl("https://acme-v02.api.letsencrypt.org/directory")
            .emailContacts("admin@example.com")
            .build());

        var exampleSecretBackendRole = new SecretBackendRole("exampleSecretBackendRole", SecretBackendRoleArgs.builder()
            .mount(pki_external_ca.path())
            .name("example-role")
            .acmeAccountName(exampleSecretBackendAcmeAccount.name())
            .allowedDomains("example.com")
            .allowedDomainOptions(            
                "bare_domains",
                "subdomains")
            .allowedChallengeTypes("http-01")
            .build());

        var exampleSecretBackendOrder = new SecretBackendOrder("exampleSecretBackendOrder", SecretBackendOrderArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleSecretBackendRole.name())
            .identifiers("www.example.com")
            .build());

        // Retrieve challenge details
        final var example = PkiexternalcaFunctions.getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleSecretBackendRole.name())
            .orderId(exampleSecretBackendOrder.orderId())
            .challengeType("http-01")
            .identifier("www.example.com")
            .build());

        // Deploy the challenge (example using local_file)
        var challenge = new File("challenge", FileArgs.builder()
            .filename(String.format("/var/www/html/.well-known/acme-challenge/%s", example.token()))
            .content(example.keyAuthorization())
            .build());

        // Mark challenge as fulfilled after deployment
        var exampleSecretBackendOrderChallengeFulfilled = new SecretBackendOrderChallengeFulfilled("exampleSecretBackendOrderChallengeFulfilled", SecretBackendOrderChallengeFulfilledArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleSecretBackendRole.name())
            .orderId(exampleSecretBackendOrder.orderId())
            .challengeType("http-01")
            .identifier("www.example.com")
            .build(), CustomResourceOptions.builder()
                .dependsOn(challenge)
                .build());

    }
}

resources:
  pki-external-ca:
    type: vault:Mount
    properties:
      path: pki-external-ca
      type: pki-external-ca
  exampleSecretBackendAcmeAccount:
    type: vault:pkiexternalca:SecretBackendAcmeAccount
    name: example
    properties:
      mount: ${["pki-external-ca"].path}
      name: my-acme-account
      directoryUrl: https://acme-v02.api.letsencrypt.org/directory
      emailContacts:
        - admin@example.com
  exampleSecretBackendRole:
    type: vault:pkiexternalca:SecretBackendRole
    name: example
    properties:
      mount: ${["pki-external-ca"].path}
      name: example-role
      acmeAccountName: ${exampleSecretBackendAcmeAccount.name}
      allowedDomains:
        - example.com
      allowedDomainOptions:
        - bare_domains
        - subdomains
      allowedChallengeTypes:
        - http-01
  exampleSecretBackendOrder:
    type: vault:pkiexternalca:SecretBackendOrder
    name: example
    properties:
      mount: ${["pki-external-ca"].path}
      roleName: ${exampleSecretBackendRole.name}
      identifiers:
        - www.example.com
  # Deploy the challenge (example using local_file)
  challenge:
    type: local:File
    properties:
      filename: /var/www/html/.well-known/acme-challenge/${example.token}
      content: ${example.keyAuthorization}
  # Mark challenge as fulfilled after deployment
  exampleSecretBackendOrderChallengeFulfilled:
    type: vault:pkiexternalca:SecretBackendOrderChallengeFulfilled
    name: example
    properties:
      mount: ${["pki-external-ca"].path}
      roleName: ${exampleSecretBackendRole.name}
      orderId: ${exampleSecretBackendOrder.orderId}
      challengeType: http-01
      identifier: www.example.com
    options:
      dependsOn:
        - ${challenge}
variables:
  # Retrieve challenge details
  example:
    fn::invoke:
      function: vault:pkiexternalca:getSecretBackendOrderChallenge
      arguments:
        mount: ${["pki-external-ca"].path}
        roleName: ${exampleSecretBackendRole.name}
        orderId: ${exampleSecretBackendOrder.orderId}
        challengeType: http-01
        identifier: www.example.com

pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

data "vault_pkiexternalca_getsecretbackendorderchallenge" "example" {
  mount          = vault_mount.pki-external-ca.path
  role_name      = vault_pkiexternalca_secretbackendrole.example.name
  order_id       = vault_pkiexternalca_secretbackendorder.example.order_id
  challenge_type = "http-01"
  identifier     = "www.example.com"
}

resource "vault_mount" "pki-external-ca" {
  path = "pki-external-ca"
  type = "pki-external-ca"
}
resource "vault_pkiexternalca_secretbackendacmeaccount" "example" {
  mount          = vault_mount.pki-external-ca.path
  name           = "my-acme-account"
  directory_url  = "https://acme-v02.api.letsencrypt.org/directory"
  email_contacts = ["admin@example.com"]
}
resource "vault_pkiexternalca_secretbackendrole" "example" {
  mount                   = vault_mount.pki-external-ca.path
  name                    = "example-role"
  acme_account_name       = vault_pkiexternalca_secretbackendacmeaccount.example.name
  allowed_domains         = ["example.com"]
  allowed_domain_options  = ["bare_domains", "subdomains"]
  allowed_challenge_types = ["http-01"]
}
resource "vault_pkiexternalca_secretbackendorder" "example" {
  mount       = vault_mount.pki-external-ca.path
  role_name   = vault_pkiexternalca_secretbackendrole.example.name
  identifiers = ["www.example.com"]
}
# Deploy the challenge (example using local_file)
resource "local_file" "challenge" {
  filename ="/var/www/html/.well-known/acme-challenge/${data.vault_pkiexternalca_getsecretbackendorderchallenge.example.token}"
  content  = data.vault_pkiexternalca_getsecretbackendorderchallenge.example.key_authorization
}
# Mark challenge as fulfilled after deployment
resource "vault_pkiexternalca_secretbackendorderchallengefulfilled" "example" {
  depends_on     = [local_file.challenge]
  mount          = vault_mount.pki-external-ca.path
  role_name      = vault_pkiexternalca_secretbackendrole.example.name
  order_id       = vault_pkiexternalca_secretbackendorder.example.order_id
  challenge_type = "http-01"
  identifier     = "www.example.com"
}
# Retrieve challenge details

With DNS-01 Challenge

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as vault from "@pulumi/vault";

// Retrieve DNS challenge details
const dns = vault.pkiexternalca.getSecretBackendOrderChallenge({
    mount: pki_external_ca.path,
    roleName: exampleVaultPkiExternalCaSecretBackendRole.name,
    orderId: example.orderId,
    challengeType: "dns-01",
    identifier: "www.example.com",
});
// Create DNS TXT record (example using AWS Route53)
const acmeChallenge = new aws.index.Route53Record("acme_challenge", {
    zoneId: exampleAwsRoute53Zone.zoneId,
    name: "_acme-challenge.www.example.com",
    type: "TXT",
    ttl: 60,
    records: [dns.keyAuthorization],
});
// Mark challenge as fulfilled
const dnsSecretBackendOrderChallengeFulfilled = new vault.pkiexternalca.SecretBackendOrderChallengeFulfilled("dns", {
    mount: pki_external_ca.path,
    roleName: exampleVaultPkiExternalCaSecretBackendRole.name,
    orderId: example.orderId,
    challengeType: "dns-01",
    identifier: "www.example.com",
}, {
    dependsOn: [acmeChallenge],
});

import pulumi
import pulumi_aws as aws
import pulumi_vault as vault

# Retrieve DNS challenge details
dns = vault.pkiexternalca.get_secret_backend_order_challenge(mount=pki_external_ca["path"],
    role_name=example_vault_pki_external_ca_secret_backend_role["name"],
    order_id=example["orderId"],
    challenge_type="dns-01",
    identifier="www.example.com")
# Create DNS TXT record (example using AWS Route53)
acme_challenge = aws.Route53Record("acme_challenge",
    zone_id=example_aws_route53_zone.zone_id,
    name=_acme-challenge.www.example.com,
    type=TXT,
    ttl=60,
    records=[dns.key_authorization])
# Mark challenge as fulfilled
dns_secret_backend_order_challenge_fulfilled = vault.pkiexternalca.SecretBackendOrderChallengeFulfilled("dns",
    mount=pki_external_ca["path"],
    role_name=example_vault_pki_external_ca_secret_backend_role["name"],
    order_id=example["orderId"],
    challenge_type="dns-01",
    identifier="www.example.com",
    opts = pulumi.ResourceOptions(depends_on=[acme_challenge]))

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Retrieve DNS challenge details
		dns, err := pkiexternalca.GetSecretBackendOrderChallenge(ctx, &pkiexternalca.GetSecretBackendOrderChallengeArgs{
			Mount:         pki_external_ca.Path,
			RoleName:      exampleVaultPkiExternalCaSecretBackendRole.Name,
			OrderId:       example.OrderId,
			ChallengeType: "dns-01",
			Identifier:    "www.example.com",
		}, nil)
		if err != nil {
			return err
		}
		// Create DNS TXT record (example using AWS Route53)
		acmeChallenge, err := aws.NewRoute53Record(ctx, "acme_challenge", &aws.Route53RecordArgs{
			ZoneId: exampleAwsRoute53Zone.ZoneId,
			Name:   "_acme-challenge.www.example.com",
			Type:   "TXT",
			Ttl:    60,
			Records: []*string{
				dns.KeyAuthorization,
			},
		})
		if err != nil {
			return err
		}
		// Mark challenge as fulfilled
		_, err = pkiexternalca.NewSecretBackendOrderChallengeFulfilled(ctx, "dns", &pkiexternalca.SecretBackendOrderChallengeFulfilledArgs{
			Mount:         pulumi.Any(pki_external_ca.Path),
			RoleName:      pulumi.Any(exampleVaultPkiExternalCaSecretBackendRole.Name),
			OrderId:       pulumi.Any(example.OrderId),
			ChallengeType: pulumi.String("dns-01"),
			Identifier:    pulumi.String("www.example.com"),
		}, pulumi.DependsOn([]pulumi.Resource{
			acmeChallenge,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    // Retrieve DNS challenge details
    var dns = Vault.PkiExternalCa.GetSecretBackendOrderChallenge.Invoke(new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleVaultPkiExternalCaSecretBackendRole.Name,
        OrderId = example.OrderId,
        ChallengeType = "dns-01",
        Identifier = "www.example.com",
    });

    // Create DNS TXT record (example using AWS Route53)
    var acmeChallenge = new Aws.Route53Record("acme_challenge", new()
    {
        ZoneId = exampleAwsRoute53Zone.ZoneId,
        Name = "_acme-challenge.www.example.com",
        Type = "TXT",
        Ttl = 60,
        Records = new[]
        {
            dns.Apply(getSecretBackendOrderChallengeResult => getSecretBackendOrderChallengeResult.KeyAuthorization),
        },
    });

    // Mark challenge as fulfilled
    var dnsSecretBackendOrderChallengeFulfilled = new Vault.PkiExternalCa.SecretBackendOrderChallengeFulfilled("dns", new()
    {
        Mount = pki_external_ca.Path,
        RoleName = exampleVaultPkiExternalCaSecretBackendRole.Name,
        OrderId = example.OrderId,
        ChallengeType = "dns-01",
        Identifier = "www.example.com",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            acmeChallenge,
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.pkiexternalca.PkiexternalcaFunctions;
import com.pulumi.vault.pkiexternalca.inputs.GetSecretBackendOrderChallengeArgs;
import com.pulumi.aws.Route53Record;
import com.pulumi.aws.Route53RecordArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilled;
import com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilledArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Retrieve DNS challenge details
        final var dns = PkiexternalcaFunctions.getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleVaultPkiExternalCaSecretBackendRole.name())
            .orderId(example.orderId())
            .challengeType("dns-01")
            .identifier("www.example.com")
            .build());

        // Create DNS TXT record (example using AWS Route53)
        var acmeChallenge = new Route53Record("acmeChallenge", Route53RecordArgs.builder()
            .zoneId(exampleAwsRoute53Zone.zoneId())
            .name("_acme-challenge.www.example.com")
            .type("TXT")
            .ttl(60)
            .records(Arrays.asList(dns.keyAuthorization()))
            .build());

        // Mark challenge as fulfilled
        var dnsSecretBackendOrderChallengeFulfilled = new SecretBackendOrderChallengeFulfilled("dnsSecretBackendOrderChallengeFulfilled", SecretBackendOrderChallengeFulfilledArgs.builder()
            .mount(pki_external_ca.path())
            .roleName(exampleVaultPkiExternalCaSecretBackendRole.name())
            .orderId(example.orderId())
            .challengeType("dns-01")
            .identifier("www.example.com")
            .build(), CustomResourceOptions.builder()
                .dependsOn(acmeChallenge)
                .build());

    }
}

resources:
  # Create DNS TXT record (example using AWS Route53)
  acmeChallenge:
    type: aws:Route53Record
    name: acme_challenge
    properties:
      zoneId: ${exampleAwsRoute53Zone.zoneId}
      name: _acme-challenge.www.example.com
      type: TXT
      ttl: 60
      records:
        - ${dns.keyAuthorization}
  # Mark challenge as fulfilled
  dnsSecretBackendOrderChallengeFulfilled:
    type: vault:pkiexternalca:SecretBackendOrderChallengeFulfilled
    name: dns
    properties:
      mount: ${["pki-external-ca"].path}
      roleName: ${exampleVaultPkiExternalCaSecretBackendRole.name}
      orderId: ${example.orderId}
      challengeType: dns-01
      identifier: www.example.com
    options:
      dependsOn:
        - ${acmeChallenge}
variables:
  # Retrieve DNS challenge details
  dns:
    fn::invoke:
      function: vault:pkiexternalca:getSecretBackendOrderChallenge
      arguments:
        mount: ${["pki-external-ca"].path}
        roleName: ${exampleVaultPkiExternalCaSecretBackendRole.name}
        orderId: ${example.orderId}
        challengeType: dns-01
        identifier: www.example.com

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

data "vault_pkiexternalca_getsecretbackendorderchallenge" "dns" {
  mount          = pki-external-ca.path
  role_name      = exampleVaultPkiExternalCaSecretBackendRole.name
  order_id       = example.orderId
  challenge_type = "dns-01"
  identifier     = "www.example.com"
}

# Create DNS TXT record (example using AWS Route53)
resource "aws_route53record" "acme_challenge" {
  zone_id = exampleAwsRoute53Zone.zoneId
  name    = "_acme-challenge.www.example.com"
  type    = "TXT"
  ttl     = 60
  records = [data.vault_pkiexternalca_getsecretbackendorderchallenge.dns.key_authorization]
}
# Mark challenge as fulfilled
resource "vault_pkiexternalca_secretbackendorderchallengefulfilled" "dns" {
  depends_on     = [aws_route53record.acme_challenge]
  mount          = pki-external-ca.path
  role_name      = exampleVaultPkiExternalCaSecretBackendRole.name
  order_id       = example.orderId
  challenge_type = "dns-01"
  identifier     = "www.example.com"
}
# Retrieve DNS challenge details

Create SecretBackendOrderChallengeFulfilled Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new SecretBackendOrderChallengeFulfilled(name: string, args: SecretBackendOrderChallengeFulfilledArgs, opts?: CustomResourceOptions);

@overload
def SecretBackendOrderChallengeFulfilled(resource_name: str,
                                         args: SecretBackendOrderChallengeFulfilledArgs,
                                         opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendOrderChallengeFulfilled(resource_name: str,
                                         opts: Optional[ResourceOptions] = None,
                                         challenge_type: Optional[str] = None,
                                         identifier: Optional[str] = None,
                                         mount: Optional[str] = None,
                                         order_id: Optional[str] = None,
                                         role_name: Optional[str] = None,
                                         namespace: Optional[str] = None)

func NewSecretBackendOrderChallengeFulfilled(ctx *Context, name string, args SecretBackendOrderChallengeFulfilledArgs, opts ...ResourceOption) (*SecretBackendOrderChallengeFulfilled, error)

public SecretBackendOrderChallengeFulfilled(string name, SecretBackendOrderChallengeFulfilledArgs args, CustomResourceOptions? opts = null)

public SecretBackendOrderChallengeFulfilled(String name, SecretBackendOrderChallengeFulfilledArgs args)
public SecretBackendOrderChallengeFulfilled(String name, SecretBackendOrderChallengeFulfilledArgs args, CustomResourceOptions options)

type: vault:pkiexternalca:SecretBackendOrderChallengeFulfilled
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

resource "vault_pkiexternalca_secret_backend_order_challenge_fulfilled" "name" {
    # resource properties
}

Parameters

name string: The unique name of the resource.
args SecretBackendOrderChallengeFulfilledArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args SecretBackendOrderChallengeFulfilledArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args SecretBackendOrderChallengeFulfilledArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args SecretBackendOrderChallengeFulfilledArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args SecretBackendOrderChallengeFulfilledArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var secretBackendOrderChallengeFulfilledResource = new Vault.PkiExternalCa.SecretBackendOrderChallengeFulfilled("secretBackendOrderChallengeFulfilledResource", new()
{
    ChallengeType = "string",
    Identifier = "string",
    Mount = "string",
    OrderId = "string",
    RoleName = "string",
    Namespace = "string",
});

example, err := pkiexternalca.NewSecretBackendOrderChallengeFulfilled(ctx, "secretBackendOrderChallengeFulfilledResource", &pkiexternalca.SecretBackendOrderChallengeFulfilledArgs{
	ChallengeType: pulumi.String("string"),
	Identifier:    pulumi.String("string"),
	Mount:         pulumi.String("string"),
	OrderId:       pulumi.String("string"),
	RoleName:      pulumi.String("string"),
	Namespace:     pulumi.String("string"),
})

resource "vault_pkiexternalca_secret_backend_order_challenge_fulfilled" "secretBackendOrderChallengeFulfilledResource" {
  lifecycle {
    create_before_destroy = true
  }
  challenge_type = "string"
  identifier     = "string"
  mount          = "string"
  order_id       = "string"
  role_name      = "string"
  namespace      = "string"
}

var secretBackendOrderChallengeFulfilledResource = new SecretBackendOrderChallengeFulfilled("secretBackendOrderChallengeFulfilledResource", SecretBackendOrderChallengeFulfilledArgs.builder()
    .challengeType("string")
    .identifier("string")
    .mount("string")
    .orderId("string")
    .roleName("string")
    .namespace("string")
    .build());

secret_backend_order_challenge_fulfilled_resource = vault.pkiexternalca.SecretBackendOrderChallengeFulfilled("secretBackendOrderChallengeFulfilledResource",
    challenge_type="string",
    identifier="string",
    mount="string",
    order_id="string",
    role_name="string",
    namespace="string")

const secretBackendOrderChallengeFulfilledResource = new vault.pkiexternalca.SecretBackendOrderChallengeFulfilled("secretBackendOrderChallengeFulfilledResource", {
    challengeType: "string",
    identifier: "string",
    mount: "string",
    orderId: "string",
    roleName: "string",
    namespace: "string",
});

type: vault:pkiexternalca:SecretBackendOrderChallengeFulfilled
properties:
    challengeType: string
    identifier: string
    mount: string
    namespace: string
    orderId: string
    roleName: string

SecretBackendOrderChallengeFulfilled Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The SecretBackendOrderChallengeFulfilled resource accepts the following input properties:

ChallengeType string: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
Identifier string: The identifier (domain name) for which the challenge was fulfilled.
Mount string: The path where the PKI External CA secret backend is mounted.
OrderId string: The unique identifier for the ACME order.
RoleName string: Name of the role associated with the order.
Namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

ChallengeType string: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
Identifier string: The identifier (domain name) for which the challenge was fulfilled.
Mount string: The path where the PKI External CA secret backend is mounted.
OrderId string: The unique identifier for the ACME order.
RoleName string: Name of the role associated with the order.
Namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

challenge_type string: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier string: The identifier (domain name) for which the challenge was fulfilled.
mount string: The path where the PKI External CA secret backend is mounted.
order_id string: The unique identifier for the ACME order.
role_name string: Name of the role associated with the order.
namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

challengeType String: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier String: The identifier (domain name) for which the challenge was fulfilled.
mount String: The path where the PKI External CA secret backend is mounted.
orderId String: The unique identifier for the ACME order.
roleName String: Name of the role associated with the order.
namespace String: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

challengeType string: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier string: The identifier (domain name) for which the challenge was fulfilled.
mount string: The path where the PKI External CA secret backend is mounted.
orderId string: The unique identifier for the ACME order.
roleName string: Name of the role associated with the order.
namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

challenge_type str: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier str: The identifier (domain name) for which the challenge was fulfilled.
mount str: The path where the PKI External CA secret backend is mounted.
order_id str: The unique identifier for the ACME order.
role_name str: Name of the role associated with the order.
namespace str: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

challengeType String: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier String: The identifier (domain name) for which the challenge was fulfilled.
mount String: The path where the PKI External CA secret backend is mounted.
orderId String: The unique identifier for the ACME order.
roleName String: Name of the role associated with the order.
namespace String: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

Outputs

All input properties are implicitly available as output properties. Additionally, the SecretBackendOrderChallengeFulfilled resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing SecretBackendOrderChallengeFulfilled Resource

Get an existing SecretBackendOrderChallengeFulfilled resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: SecretBackendOrderChallengeFulfilledState, opts?: CustomResourceOptions): SecretBackendOrderChallengeFulfilled

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        challenge_type: Optional[str] = None,
        identifier: Optional[str] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        order_id: Optional[str] = None,
        role_name: Optional[str] = None) -> SecretBackendOrderChallengeFulfilled

func GetSecretBackendOrderChallengeFulfilled(ctx *Context, name string, id IDInput, state *SecretBackendOrderChallengeFulfilledState, opts ...ResourceOption) (*SecretBackendOrderChallengeFulfilled, error)

public static SecretBackendOrderChallengeFulfilled Get(string name, Input<string> id, SecretBackendOrderChallengeFulfilledState? state, CustomResourceOptions? opts = null)

public static SecretBackendOrderChallengeFulfilled get(String name, Output<String> id, SecretBackendOrderChallengeFulfilledState state, CustomResourceOptions options)

resources:  _:    type: vault:pkiexternalca:SecretBackendOrderChallengeFulfilled    get:      id: ${id}

import {
  to = vault_pkiexternalca_secret_backend_order_challenge_fulfilled.example
  id = "${id}"
}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

ChallengeType string: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
Identifier string: The identifier (domain name) for which the challenge was fulfilled.
Mount string: The path where the PKI External CA secret backend is mounted.
Namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
OrderId string: The unique identifier for the ACME order.
RoleName string: Name of the role associated with the order.

ChallengeType string: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
Identifier string: The identifier (domain name) for which the challenge was fulfilled.
Mount string: The path where the PKI External CA secret backend is mounted.
Namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
OrderId string: The unique identifier for the ACME order.
RoleName string: Name of the role associated with the order.

challenge_type string: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier string: The identifier (domain name) for which the challenge was fulfilled.
mount string: The path where the PKI External CA secret backend is mounted.
namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
order_id string: The unique identifier for the ACME order.
role_name string: Name of the role associated with the order.

challengeType String: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier String: The identifier (domain name) for which the challenge was fulfilled.
mount String: The path where the PKI External CA secret backend is mounted.
namespace String: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
orderId String: The unique identifier for the ACME order.
roleName String: Name of the role associated with the order.

challengeType string: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier string: The identifier (domain name) for which the challenge was fulfilled.
mount string: The path where the PKI External CA secret backend is mounted.
namespace string: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
orderId string: The unique identifier for the ACME order.
roleName string: Name of the role associated with the order.

challenge_type str: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier str: The identifier (domain name) for which the challenge was fulfilled.
mount str: The path where the PKI External CA secret backend is mounted.
namespace str: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
order_id str: The unique identifier for the ACME order.
role_name str: Name of the role associated with the order.

challengeType String: The type of ACME challenge that was fulfilled. Valid values are http-01, dns-01, tls-alpn-01.
identifier String: The identifier (domain name) for which the challenge was fulfilled.
mount String: The path where the PKI External CA secret backend is mounted.
namespace String: The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
orderId String: The unique identifier for the ACME order.
roleName String: Name of the role associated with the order.

Import

PKI External CA order challenge fulfilled resources can be imported using the format <mount>/role/<role_name>/order/<order_id>/fulfilled-challenge/<challenge_type>/<identifier>, e.g.

$ pulumi import vault:pkiexternalca/secretBackendOrderChallengeFulfilled:SecretBackendOrderChallengeFulfilled example pki-external-ca/role/example-role/order/abc123/fulfilled-challenge/http-01/www.example.com

Note This resource represents an action (marking a challenge as fulfilled) rather than a persistent object. Deletion removes it from state without making any API calls, as the action cannot be undone.

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: Vault pulumi/pulumi-vault
License: Apache-2.0
Notes: This Pulumi package is based on the vault Terraform Provider.

Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-vault

vault.pkiexternalca.SecretBackendOrderChallengeFulfilled

On this page

On this page

Example Usage

With HTTP-01 Challenge

With DNS-01 Challenge

Create SecretBackendOrderChallengeFulfilled Resource

Constructor syntax

Parameters

Constructor example

SecretBackendOrderChallengeFulfilled Resource Properties

Inputs

Outputs

Look up Existing SecretBackendOrderChallengeFulfilled Resource

Import

Package Details

On this page

On this page

Try Pulumi Cloud free.
Your team will thank you.

vault.pkiexternalca.SecretBackendOrderChallengeFulfilled

On this page

On this page

Example Usage

With HTTP-01 Challenge

With DNS-01 Challenge

Create SecretBackendOrderChallengeFulfilled Resource

Constructor syntax

Parameters

Constructor example

SecretBackendOrderChallengeFulfilled Resource Properties

Inputs

Outputs

Look up Existing SecretBackendOrderChallengeFulfilled Resource

Import

Package Details

On this page

On this page

Try Pulumi Cloud free.Your team will thank you.

Try Pulumi Cloud free.
Your team will thank you.