Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. pkiexternalca
  6. SecretBackendRole
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.pkiexternalca.SecretBackendRole

vault logo
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages PKI External CA roles for certificate issuance via ACME. This resource defines the configuration for obtaining certificates from external Certificate Authorities through the ACME protocol.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const pki_external_ca = new vault.Mount("pki-external-ca", {
    path: "pki-external-ca",
    type: "pki-external-ca",
});
const example = new vault.pkiexternalca.SecretBackendAcmeAccount("example", {
    mount: pki_external_ca.path,
    name: "my-acme-account",
    directoryUrl: "https://acme-v02.api.letsencrypt.org/directory",
    emailContacts: ["admin@example.com"],
});
const exampleSecretBackendRole = new vault.pkiexternalca.SecretBackendRole("example", {
    mount: pki_external_ca.path,
    name: "example-role",
    acmeAccountName: example.name,
    allowedDomains: [
        "example.com",
        "*.example.com",
    ],
    allowedDomainOptions: [
        "bare_domains",
        "subdomains",
        "wildcards",
    ],
    allowedChallengeTypes: [
        "http-01",
        "dns-01",
    ],
});

    import pulumi
import pulumi_vault as vault

pki_external_ca = vault.Mount("pki-external-ca",
    path="pki-external-ca",
    type="pki-external-ca")
example = vault.pkiexternalca.SecretBackendAcmeAccount("example",
    mount=pki_external_ca.path,
    name="my-acme-account",
    directory_url="https://acme-v02.api.letsencrypt.org/directory",
    email_contacts=["admin@example.com"])
example_secret_backend_role = vault.pkiexternalca.SecretBackendRole("example",
    mount=pki_external_ca.path,
    name="example-role",
    acme_account_name=example.name,
    allowed_domains=[
        "example.com",
        "*.example.com",
    ],
    allowed_domain_options=[
        "bare_domains",
        "subdomains",
        "wildcards",
    ],
    allowed_challenge_types=[
        "http-01",
        "dns-01",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki_external_ca, err := vault.NewMount(ctx, "pki-external-ca", &vault.MountArgs{
			Path: pulumi.String("pki-external-ca"),
			Type: pulumi.String("pki-external-ca"),
		})
		if err != nil {
			return err
		}
		example, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, "example", &pkiexternalca.SecretBackendAcmeAccountArgs{
			Mount:        pki_external_ca.Path,
			Name:         pulumi.String("my-acme-account"),
			DirectoryUrl: pulumi.String("https://acme-v02.api.letsencrypt.org/directory"),
			EmailContacts: pulumi.StringArray{
				pulumi.String("admin@example.com"),
			},
		})
		if err != nil {
			return err
		}
		_, err = pkiexternalca.NewSecretBackendRole(ctx, "example", &pkiexternalca.SecretBackendRoleArgs{
			Mount:           pki_external_ca.Path,
			Name:            pulumi.String("example-role"),
			AcmeAccountName: example.Name,
			AllowedDomains: pulumi.StringArray{
				pulumi.String("example.com"),
				pulumi.String("*.example.com"),
			},
			AllowedDomainOptions: pulumi.StringArray{
				pulumi.String("bare_domains"),
				pulumi.String("subdomains"),
				pulumi.String("wildcards"),
			},
			AllowedChallengeTypes: pulumi.StringArray{
				pulumi.String("http-01"),
				pulumi.String("dns-01"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki_external_ca = new Vault.Mount("pki-external-ca", new()
    {
        Path = "pki-external-ca",
        Type = "pki-external-ca",
    });

    var example = new Vault.PkiExternalCa.SecretBackendAcmeAccount("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "my-acme-account",
        DirectoryUrl = "https://acme-v02.api.letsencrypt.org/directory",
        EmailContacts = new[]
        {
            "admin@example.com",
        },
    });

    var exampleSecretBackendRole = new Vault.PkiExternalCa.SecretBackendRole("example", new()
    {
        Mount = pki_external_ca.Path,
        Name = "example-role",
        AcmeAccountName = example.Name,
        AllowedDomains = new[]
        {
            "example.com",
            "*.example.com",
        },
        AllowedDomainOptions = new[]
        {
            "bare_domains",
            "subdomains",
            "wildcards",
        },
        AllowedChallengeTypes = new[]
        {
            "http-01",
            "dns-01",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;
import com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;
import com.pulumi.vault.pkiexternalca.SecretBackendRole;
import com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki_external_ca = new Mount("pki-external-ca", MountArgs.builder()
            .path("pki-external-ca")
            .type("pki-external-ca")
            .build());

        var example = new SecretBackendAcmeAccount("example", SecretBackendAcmeAccountArgs.builder()
            .mount(pki_external_ca.path())
            .name("my-acme-account")
            .directoryUrl("https://acme-v02.api.letsencrypt.org/directory")
            .emailContacts("admin@example.com")
            .build());

        var exampleSecretBackendRole = new SecretBackendRole("exampleSecretBackendRole", SecretBackendRoleArgs.builder()
            .mount(pki_external_ca.path())
            .name("example-role")
            .acmeAccountName(example.name())
            .allowedDomains(            
                "example.com",
                "*.example.com")
            .allowedDomainOptions(            
                "bare_domains",
                "subdomains",
                "wildcards")
            .allowedChallengeTypes(            
                "http-01",
                "dns-01")
            .build());

    }
}

    resources:
  pki-external-ca:
    type: vault:Mount
    properties:
      path: pki-external-ca
      type: pki-external-ca
  example:
    type: vault:pkiexternalca:SecretBackendAcmeAccount
    properties:
      mount: ${["pki-external-ca"].path}
      name: my-acme-account
      directoryUrl: https://acme-v02.api.letsencrypt.org/directory
      emailContacts:
        - admin@example.com
  exampleSecretBackendRole:
    type: vault:pkiexternalca:SecretBackendRole
    name: example
    properties:
      mount: ${["pki-external-ca"].path}
      name: example-role
      acmeAccountName: ${example.name}
      allowedDomains:
        - example.com
        - '*.example.com'
      allowedDomainOptions:
        - bare_domains
        - subdomains
        - wildcards
      allowedChallengeTypes:
        - http-01
        - dns-01

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "pki-external-ca" {
  path = "pki-external-ca"
  type = "pki-external-ca"
}
resource "vault_pkiexternalca_secretbackendacmeaccount" "example" {
  mount          = vault_mount.pki-external-ca.path
  name           = "my-acme-account"
  directory_url  = "https://acme-v02.api.letsencrypt.org/directory"
  email_contacts = ["admin@example.com"]
}
resource "vault_pkiexternalca_secretbackendrole" "example" {
  mount                   = vault_mount.pki-external-ca.path
  name                    = "example-role"
  acme_account_name       = vault_pkiexternalca_secretbackendacmeaccount.example.name
  allowed_domains         = ["example.com", "*.example.com"]
  allowed_domain_options  = ["bare_domains", "subdomains", "wildcards"]
  allowed_challenge_types = ["http-01", "dns-01"]
}

    With Identity Templates

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const templated = new vault.pkiexternalca.SecretBackendRole("templated", {
    mount: pki_external_ca.path,
    name: "user-role",
    acmeAccountName: example.name,
    allowedDomains: ["{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com"],
    allowedDomainOptions: ["bare_domains"],
    csrGenerateKeyType: "rsa-2048",
    csrIdentifierPopulation: "cn_first",
});

    import pulumi
import pulumi_vault as vault

templated = vault.pkiexternalca.SecretBackendRole("templated",
    mount=pki_external_ca["path"],
    name="user-role",
    acme_account_name=example["name"],
    allowed_domains=["{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com"],
    allowed_domain_options=["bare_domains"],
    csr_generate_key_type="rsa-2048",
    csr_identifier_population="cn_first")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := pkiexternalca.NewSecretBackendRole(ctx, "templated", &pkiexternalca.SecretBackendRoleArgs{
			Mount:           pulumi.Any(pki_external_ca.Path),
			Name:            pulumi.String("user-role"),
			AcmeAccountName: pulumi.Any(example.Name),
			AllowedDomains: pulumi.StringArray{
				pulumi.String("{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com"),
			},
			AllowedDomainOptions: pulumi.StringArray{
				pulumi.String("bare_domains"),
			},
			CsrGenerateKeyType:      pulumi.String("rsa-2048"),
			CsrIdentifierPopulation: pulumi.String("cn_first"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var templated = new Vault.PkiExternalCa.SecretBackendRole("templated", new()
    {
        Mount = pki_external_ca.Path,
        Name = "user-role",
        AcmeAccountName = example.Name,
        AllowedDomains = new[]
        {
            "{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com",
        },
        AllowedDomainOptions = new[]
        {
            "bare_domains",
        },
        CsrGenerateKeyType = "rsa-2048",
        CsrIdentifierPopulation = "cn_first",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.pkiexternalca.SecretBackendRole;
import com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var templated = new SecretBackendRole("templated", SecretBackendRoleArgs.builder()
            .mount(pki_external_ca.path())
            .name("user-role")
            .acmeAccountName(example.name())
            .allowedDomains("{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com")
            .allowedDomainOptions("bare_domains")
            .csrGenerateKeyType("rsa-2048")
            .csrIdentifierPopulation("cn_first")
            .build());

    }
}

    resources:
  templated:
    type: vault:pkiexternalca:SecretBackendRole
    properties:
      mount: ${["pki-external-ca"].path}
      name: user-role
      acmeAccountName: ${example.name}
      allowedDomains:
        - '{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com'
      allowedDomainOptions:
        - bare_domains
      csrGenerateKeyType: rsa-2048
      csrIdentifierPopulation: cn_first

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_pkiexternalca_secretbackendrole" "templated" {
  mount                     = pki-external-ca.path
  name                      = "user-role"
  acme_account_name         = example.name
  allowed_domains           = ["{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com"]
  allowed_domain_options    = ["bare_domains"]
  csr_generate_key_type     = "rsa-2048"
  csr_identifier_population = "cn_first"
}

    Create SecretBackendRole Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendRole(name: string, args: SecretBackendRoleArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendRole(resource_name: str,
                      args: SecretBackendRoleArgs,
                      opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendRole(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      acme_account_name: Optional[str] = None,
                      mount: Optional[str] = None,
                      allowed_challenge_types: Optional[Sequence[str]] = None,
                      allowed_domain_options: Optional[Sequence[str]] = None,
                      allowed_domains: Optional[Sequence[str]] = None,
                      csr_generate_key_type: Optional[str] = None,
                      csr_identifier_population: Optional[str] = None,
                      force: Optional[bool] = None,
                      name: Optional[str] = None,
                      namespace: Optional[str] = None)
    func NewSecretBackendRole(ctx *Context, name string, args SecretBackendRoleArgs, opts ...ResourceOption) (*SecretBackendRole, error)
    public SecretBackendRole(string name, SecretBackendRoleArgs args, CustomResourceOptions? opts = null)
    public SecretBackendRole(String name, SecretBackendRoleArgs args)
public SecretBackendRole(String name, SecretBackendRoleArgs args, CustomResourceOptions options)

    type: vault:pkiexternalca:SecretBackendRole
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_pkiexternalca_secret_backend_role" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var examplesecretBackendRoleResourceResourceFromPkiexternalcasecretBackendRole = new Vault.PkiExternalCa.SecretBackendRole("examplesecretBackendRoleResourceResourceFromPkiexternalcasecretBackendRole", new()
{
    AcmeAccountName = "string",
    Mount = "string",
    AllowedChallengeTypes = new[]
    {
        "string",
    },
    AllowedDomainOptions = new[]
    {
        "string",
    },
    AllowedDomains = new[]
    {
        "string",
    },
    CsrGenerateKeyType = "string",
    CsrIdentifierPopulation = "string",
    Force = false,
    Name = "string",
    Namespace = "string",
});

    example, err := pkiexternalca.NewSecretBackendRole(ctx, "examplesecretBackendRoleResourceResourceFromPkiexternalcasecretBackendRole", &pkiexternalca.SecretBackendRoleArgs{
	AcmeAccountName: pulumi.String("string"),
	Mount:           pulumi.String("string"),
	AllowedChallengeTypes: pulumi.StringArray{
		pulumi.String("string"),
	},
	AllowedDomainOptions: pulumi.StringArray{
		pulumi.String("string"),
	},
	AllowedDomains: pulumi.StringArray{
		pulumi.String("string"),
	},
	CsrGenerateKeyType:      pulumi.String("string"),
	CsrIdentifierPopulation: pulumi.String("string"),
	Force:                   pulumi.Bool(false),
	Name:                    pulumi.String("string"),
	Namespace:               pulumi.String("string"),
})

    resource "vault_pkiexternalca_secret_backend_role" "examplesecretBackendRoleResourceResourceFromPkiexternalcasecretBackendRole" {
  lifecycle {
    create_before_destroy = true
  }
  acme_account_name         = "string"
  mount                     = "string"
  allowed_challenge_types   = ["string"]
  allowed_domain_options    = ["string"]
  allowed_domains           = ["string"]
  csr_generate_key_type     = "string"
  csr_identifier_population = "string"
  force                     = false
  name                      = "string"
  namespace                 = "string"
}

    var examplesecretBackendRoleResourceResourceFromPkiexternalcasecretBackendRole = new com.pulumi.vault.pkiexternalca.SecretBackendRole("examplesecretBackendRoleResourceResourceFromPkiexternalcasecretBackendRole", com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs.builder()
    .acmeAccountName("string")
    .mount("string")
    .allowedChallengeTypes("string")
    .allowedDomainOptions("string")
    .allowedDomains("string")
    .csrGenerateKeyType("string")
    .csrIdentifierPopulation("string")
    .force(false)
    .name("string")
    .namespace("string")
    .build());

    examplesecret_backend_role_resource_resource_from_pkiexternalcasecret_backend_role = vault.pkiexternalca.SecretBackendRole("examplesecretBackendRoleResourceResourceFromPkiexternalcasecretBackendRole",
    acme_account_name="string",
    mount="string",
    allowed_challenge_types=["string"],
    allowed_domain_options=["string"],
    allowed_domains=["string"],
    csr_generate_key_type="string",
    csr_identifier_population="string",
    force=False,
    name="string",
    namespace="string")

    const examplesecretBackendRoleResourceResourceFromPkiexternalcasecretBackendRole = new vault.pkiexternalca.SecretBackendRole("examplesecretBackendRoleResourceResourceFromPkiexternalcasecretBackendRole", {
    acmeAccountName: "string",
    mount: "string",
    allowedChallengeTypes: ["string"],
    allowedDomainOptions: ["string"],
    allowedDomains: ["string"],
    csrGenerateKeyType: "string",
    csrIdentifierPopulation: "string",
    force: false,
    name: "string",
    namespace: "string",
});

    type: vault:pkiexternalca:SecretBackendRole
properties:
    acmeAccountName: string
    allowedChallengeTypes:
        - string
    allowedDomainOptions:
        - string
    allowedDomains:
        - string
    csrGenerateKeyType: string
    csrIdentifierPopulation: string
    force: false
    mount: string
    name: string
    namespace: string

    SecretBackendRole Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendRole resource accepts the following input properties:

    AcmeAccountName string
    The ACME account to use when validating certificates.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    AllowedChallengeTypes List<string>
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    AllowedDomainOptions List<string>
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    AllowedDomains List<string>
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    CsrGenerateKeyType string
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    CsrIdentifierPopulation string
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    Force bool
    Force deletion even when active orders exist. Defaults to false.
    Name string
    Name of the role. Must be unique within the backend.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    AcmeAccountName string
    The ACME account to use when validating certificates.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    AllowedChallengeTypes []string
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    AllowedDomainOptions []string
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    AllowedDomains []string
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    CsrGenerateKeyType string
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    CsrIdentifierPopulation string
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    Force bool
    Force deletion even when active orders exist. Defaults to false.
    Name string
    Name of the role. Must be unique within the backend.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acme_account_name string
    The ACME account to use when validating certificates.
    mount string
    The path where the PKI External CA secret backend is mounted.
    allowed_challenge_types list(string)
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowed_domain_options list(string)
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowed_domains list(string)
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    csr_generate_key_type string
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csr_identifier_population string
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force bool
    Force deletion even when active orders exist. Defaults to false.
    name string
    Name of the role. Must be unique within the backend.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acmeAccountName String
    The ACME account to use when validating certificates.
    mount String
    The path where the PKI External CA secret backend is mounted.
    allowedChallengeTypes List<String>
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowedDomainOptions List<String>
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowedDomains List<String>
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    csrGenerateKeyType String
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csrIdentifierPopulation String
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force Boolean
    Force deletion even when active orders exist. Defaults to false.
    name String
    Name of the role. Must be unique within the backend.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acmeAccountName string
    The ACME account to use when validating certificates.
    mount string
    The path where the PKI External CA secret backend is mounted.
    allowedChallengeTypes string[]
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowedDomainOptions string[]
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowedDomains string[]
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    csrGenerateKeyType string
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csrIdentifierPopulation string
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force boolean
    Force deletion even when active orders exist. Defaults to false.
    name string
    Name of the role. Must be unique within the backend.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acme_account_name str
    The ACME account to use when validating certificates.
    mount str
    The path where the PKI External CA secret backend is mounted.
    allowed_challenge_types Sequence[str]
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowed_domain_options Sequence[str]
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowed_domains Sequence[str]
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    csr_generate_key_type str
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csr_identifier_population str
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force bool
    Force deletion even when active orders exist. Defaults to false.
    name str
    Name of the role. Must be unique within the backend.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acmeAccountName String
    The ACME account to use when validating certificates.
    mount String
    The path where the PKI External CA secret backend is mounted.
    allowedChallengeTypes List<String>
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowedDomainOptions List<String>
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowedDomains List<String>
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    csrGenerateKeyType String
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csrIdentifierPopulation String
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force Boolean
    Force deletion even when active orders exist. Defaults to false.
    name String
    Name of the role. Must be unique within the backend.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendRole resource produces the following output properties:

    CreationDate string
    The date and time the role was created in RFC3339 format.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUpdateDate string
    The date and time the role was last updated in RFC3339 format.
    CreationDate string
    The date and time the role was created in RFC3339 format.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUpdateDate string
    The date and time the role was last updated in RFC3339 format.
    creation_date string
    The date and time the role was created in RFC3339 format.
    id string
    The provider-assigned unique ID for this managed resource.
    last_update_date string
    The date and time the role was last updated in RFC3339 format.
    creationDate String
    The date and time the role was created in RFC3339 format.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUpdateDate String
    The date and time the role was last updated in RFC3339 format.
    creationDate string
    The date and time the role was created in RFC3339 format.
    id string
    The provider-assigned unique ID for this managed resource.
    lastUpdateDate string
    The date and time the role was last updated in RFC3339 format.
    creation_date str
    The date and time the role was created in RFC3339 format.
    id str
    The provider-assigned unique ID for this managed resource.
    last_update_date str
    The date and time the role was last updated in RFC3339 format.
    creationDate String
    The date and time the role was created in RFC3339 format.
    id String
    The provider-assigned unique ID for this managed resource.
    lastUpdateDate String
    The date and time the role was last updated in RFC3339 format.

    Look up Existing SecretBackendRole Resource

    Get an existing SecretBackendRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendRoleState, opts?: CustomResourceOptions): SecretBackendRole
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        acme_account_name: Optional[str] = None,
        allowed_challenge_types: Optional[Sequence[str]] = None,
        allowed_domain_options: Optional[Sequence[str]] = None,
        allowed_domains: Optional[Sequence[str]] = None,
        creation_date: Optional[str] = None,
        csr_generate_key_type: Optional[str] = None,
        csr_identifier_population: Optional[str] = None,
        force: Optional[bool] = None,
        last_update_date: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None) -> SecretBackendRole
    func GetSecretBackendRole(ctx *Context, name string, id IDInput, state *SecretBackendRoleState, opts ...ResourceOption) (*SecretBackendRole, error)
    public static SecretBackendRole Get(string name, Input<string> id, SecretBackendRoleState? state, CustomResourceOptions? opts = null)
    public static SecretBackendRole get(String name, Output<String> id, SecretBackendRoleState state, CustomResourceOptions options)
    resources:  _:    type: vault:pkiexternalca:SecretBackendRole    get:      id: ${id}
    import {
  to = vault_pkiexternalca_secret_backend_role.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AcmeAccountName string
    The ACME account to use when validating certificates.
    AllowedChallengeTypes List<string>
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    AllowedDomainOptions List<string>
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    AllowedDomains List<string>
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    CreationDate string
    The date and time the role was created in RFC3339 format.
    CsrGenerateKeyType string
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    CsrIdentifierPopulation string
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    Force bool
    Force deletion even when active orders exist. Defaults to false.
    LastUpdateDate string
    The date and time the role was last updated in RFC3339 format.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Name string
    Name of the role. Must be unique within the backend.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    AcmeAccountName string
    The ACME account to use when validating certificates.
    AllowedChallengeTypes []string
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    AllowedDomainOptions []string
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    AllowedDomains []string
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    CreationDate string
    The date and time the role was created in RFC3339 format.
    CsrGenerateKeyType string
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    CsrIdentifierPopulation string
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    Force bool
    Force deletion even when active orders exist. Defaults to false.
    LastUpdateDate string
    The date and time the role was last updated in RFC3339 format.
    Mount string
    The path where the PKI External CA secret backend is mounted.
    Name string
    Name of the role. Must be unique within the backend.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acme_account_name string
    The ACME account to use when validating certificates.
    allowed_challenge_types list(string)
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowed_domain_options list(string)
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowed_domains list(string)
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    creation_date string
    The date and time the role was created in RFC3339 format.
    csr_generate_key_type string
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csr_identifier_population string
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force bool
    Force deletion even when active orders exist. Defaults to false.
    last_update_date string
    The date and time the role was last updated in RFC3339 format.
    mount string
    The path where the PKI External CA secret backend is mounted.
    name string
    Name of the role. Must be unique within the backend.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acmeAccountName String
    The ACME account to use when validating certificates.
    allowedChallengeTypes List<String>
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowedDomainOptions List<String>
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowedDomains List<String>
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    creationDate String
    The date and time the role was created in RFC3339 format.
    csrGenerateKeyType String
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csrIdentifierPopulation String
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force Boolean
    Force deletion even when active orders exist. Defaults to false.
    lastUpdateDate String
    The date and time the role was last updated in RFC3339 format.
    mount String
    The path where the PKI External CA secret backend is mounted.
    name String
    Name of the role. Must be unique within the backend.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acmeAccountName string
    The ACME account to use when validating certificates.
    allowedChallengeTypes string[]
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowedDomainOptions string[]
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowedDomains string[]
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    creationDate string
    The date and time the role was created in RFC3339 format.
    csrGenerateKeyType string
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csrIdentifierPopulation string
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force boolean
    Force deletion even when active orders exist. Defaults to false.
    lastUpdateDate string
    The date and time the role was last updated in RFC3339 format.
    mount string
    The path where the PKI External CA secret backend is mounted.
    name string
    Name of the role. Must be unique within the backend.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acme_account_name str
    The ACME account to use when validating certificates.
    allowed_challenge_types Sequence[str]
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowed_domain_options Sequence[str]
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowed_domains Sequence[str]
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    creation_date str
    The date and time the role was created in RFC3339 format.
    csr_generate_key_type str
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csr_identifier_population str
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force bool
    Force deletion even when active orders exist. Defaults to false.
    last_update_date str
    The date and time the role was last updated in RFC3339 format.
    mount str
    The path where the PKI External CA secret backend is mounted.
    name str
    Name of the role. Must be unique within the backend.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    acmeAccountName String
    The ACME account to use when validating certificates.
    allowedChallengeTypes List<String>
    The list of challenge types that are allowed to be used. Valid values are http-01, dns-01, tls-alpn-01. Defaults to all challenge types.
    allowedDomainOptions List<String>
    A list of keyword options that influence how values within allowedDomains are interpreted against the requested set of identifiers from the client. Valid values are:
    allowedDomains List<String>
    A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., {{identity.entity.aliases.<mount accessor>.name}}).
    creationDate String
    The date and time the role was created in RFC3339 format.
    csrGenerateKeyType String
    The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are ec-256, ec-384, ec-521, rsa-2048, rsa-4096. Defaults to ec-256.
    csrIdentifierPopulation String
    The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:
    force Boolean
    Force deletion even when active orders exist. Defaults to false.
    lastUpdateDate String
    The date and time the role was last updated in RFC3339 format.
    mount String
    The path where the PKI External CA secret backend is mounted.
    name String
    Name of the role. Must be unique within the backend.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Import

    PKI External CA roles can be imported using the format <mount>/role/<name>, e.g.

    $ terraform import vault_pki_external_ca_secret_backend_role.example pki-external-ca/role/example-role

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo
    Viewing docs for HashiCorp Vault v7.11.0
    published on Wednesday, Jul 22, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial