Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. pkiSecret
  6. BackendExportKey
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.pkiSecret.BackendExportKey

vault logo vault logo
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages a wrapping keypair on a PKI secrets engine mount. Vault stores the private half internally and returns the public key and its HMAC fingerprint.

    For more information, please refer to the Vault documentation for PKI export key management.

    Available only for Vault Enterprise.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const pki = new vault.Mount("pki", {
    path: "pki",
    type: "pki",
});
const example = new vault.pkisecret.BackendExportKey("example", {
    mount: pki.path,
    keyType: "ec-p256",
    name: "example-wrapping-key",
});

    import pulumi
import pulumi_vault as vault

pki = vault.Mount("pki",
    path="pki",
    type="pki")
example = vault.pkisecret.BackendExportKey("example",
    mount=pki.path,
    key_type="ec-p256",
    name="example-wrapping-key")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki, err := vault.NewMount(ctx, "pki", &vault.MountArgs{
			Path: pulumi.String("pki"),
			Type: pulumi.String("pki"),
		})
		if err != nil {
			return err
		}
		_, err = pkisecret.NewBackendExportKey(ctx, "example", &pkisecret.BackendExportKeyArgs{
			Mount:   pki.Path,
			KeyType: pulumi.String("ec-p256"),
			Name:    pulumi.String("example-wrapping-key"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki = new Vault.Mount("pki", new()
    {
        Path = "pki",
        Type = "pki",
    });

    var example = new Vault.PkiSecret.BackendExportKey("example", new()
    {
        Mount = pki.Path,
        KeyType = "ec-p256",
        Name = "example-wrapping-key",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiSecret.BackendExportKey;
import com.pulumi.vault.pkiSecret.BackendExportKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki = new Mount("pki", MountArgs.builder()
            .path("pki")
            .type("pki")
            .build());

        var example = new BackendExportKey("example", BackendExportKeyArgs.builder()
            .mount(pki.path())
            .keyType("ec-p256")
            .name("example-wrapping-key")
            .build());

    }
}

    resources:
  pki:
    type: vault:Mount
    properties:
      path: pki
      type: pki
  example:
    type: vault:pkiSecret:BackendExportKey
    properties:
      mount: ${pki.path}
      keyType: ec-p256
      name: example-wrapping-key

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "pki" {
  lifecycle {
    create_before_destroy = true
  }
  path = "pki"
  type = "pki"
}
resource "vault_pki_secret_backend_export_key" "example" {
  lifecycle {
    create_before_destroy = true
  }
  mount    = vault_mount.pki.path
  key_type = "ec-p256"
  name     = "example-wrapping-key"
}

    Create BackendExportKey Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new BackendExportKey(name: string, args: BackendExportKeyArgs, opts?: CustomResourceOptions);
    @overload
def BackendExportKey(resource_name: str,
                     args: BackendExportKeyArgs,
                     opts: Optional[ResourceOptions] = None)

@overload
def BackendExportKey(resource_name: str,
                     opts: Optional[ResourceOptions] = None,
                     key_type: Optional[str] = None,
                     mount: Optional[str] = None,
                     name: Optional[str] = None,
                     namespace: Optional[str] = None)
    func NewBackendExportKey(ctx *Context, name string, args BackendExportKeyArgs, opts ...ResourceOption) (*BackendExportKey, error)
    public BackendExportKey(string name, BackendExportKeyArgs args, CustomResourceOptions? opts = null)
    public BackendExportKey(String name, BackendExportKeyArgs args)
public BackendExportKey(String name, BackendExportKeyArgs args, CustomResourceOptions options)

    type: vault:pkiSecret:BackendExportKey
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_pki_secret_backend_export_key" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args BackendExportKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args BackendExportKeyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args BackendExportKeyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args BackendExportKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args BackendExportKeyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var backendExportKeyResource = new Vault.PkiSecret.BackendExportKey("backendExportKeyResource", new()
{
    KeyType = "string",
    Mount = "string",
    Name = "string",
    Namespace = "string",
});

    example, err := pkisecret.NewBackendExportKey(ctx, "backendExportKeyResource", &pkisecret.BackendExportKeyArgs{
	KeyType:   pulumi.String("string"),
	Mount:     pulumi.String("string"),
	Name:      pulumi.String("string"),
	Namespace: pulumi.String("string"),
})

    resource "vault_pki_secret_backend_export_key" "backendExportKeyResource" {
  lifecycle {
    create_before_destroy = true
  }
  key_type  = "string"
  mount     = "string"
  name      = "string"
  namespace = "string"
}

    var backendExportKeyResource = new BackendExportKey("backendExportKeyResource", BackendExportKeyArgs.builder()
    .keyType("string")
    .mount("string")
    .name("string")
    .namespace("string")
    .build());

    backend_export_key_resource = vault.pkisecret.BackendExportKey("backendExportKeyResource",
    key_type="string",
    mount="string",
    name="string",
    namespace="string")

    const backendExportKeyResource = new vault.pkisecret.BackendExportKey("backendExportKeyResource", {
    keyType: "string",
    mount: "string",
    name: "string",
    namespace: "string",
});

    type: vault:pkiSecret:BackendExportKey
properties:
    keyType: string
    mount: string
    name: string
    namespace: string

    BackendExportKey Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The BackendExportKey resource accepts the following input properties:

    KeyType string
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    Mount string
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    Name string
    Human-readable name for this export key. Changing this field forces a new resource.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    KeyType string
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    Mount string
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    Name string
    Human-readable name for this export key. Changing this field forces a new resource.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    key_type string
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount string
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name string
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyType String
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount String
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name String
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyType string
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount string
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name string
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    key_type str
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount str
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name str
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyType String
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount String
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name String
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the BackendExportKey resource produces the following output properties:

    CreatedAt string
    RFC3339 timestamp of when this export key was created.
    ExportKeyHmac string
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    ExportKeyUuid string
    UUID assigned by Vault to this export key.
    Id string
    The provider-assigned unique ID for this managed resource.
    PublicKey string
    PKIX PEM-encoded public key returned by Vault.
    CreatedAt string
    RFC3339 timestamp of when this export key was created.
    ExportKeyHmac string
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    ExportKeyUuid string
    UUID assigned by Vault to this export key.
    Id string
    The provider-assigned unique ID for this managed resource.
    PublicKey string
    PKIX PEM-encoded public key returned by Vault.
    created_at string
    RFC3339 timestamp of when this export key was created.
    export_key_hmac string
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    export_key_uuid string
    UUID assigned by Vault to this export key.
    id string
    The provider-assigned unique ID for this managed resource.
    public_key string
    PKIX PEM-encoded public key returned by Vault.
    createdAt String
    RFC3339 timestamp of when this export key was created.
    exportKeyHmac String
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    exportKeyUuid String
    UUID assigned by Vault to this export key.
    id String
    The provider-assigned unique ID for this managed resource.
    publicKey String
    PKIX PEM-encoded public key returned by Vault.
    createdAt string
    RFC3339 timestamp of when this export key was created.
    exportKeyHmac string
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    exportKeyUuid string
    UUID assigned by Vault to this export key.
    id string
    The provider-assigned unique ID for this managed resource.
    publicKey string
    PKIX PEM-encoded public key returned by Vault.
    created_at str
    RFC3339 timestamp of when this export key was created.
    export_key_hmac str
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    export_key_uuid str
    UUID assigned by Vault to this export key.
    id str
    The provider-assigned unique ID for this managed resource.
    public_key str
    PKIX PEM-encoded public key returned by Vault.
    createdAt String
    RFC3339 timestamp of when this export key was created.
    exportKeyHmac String
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    exportKeyUuid String
    UUID assigned by Vault to this export key.
    id String
    The provider-assigned unique ID for this managed resource.
    publicKey String
    PKIX PEM-encoded public key returned by Vault.

    Look up Existing BackendExportKey Resource

    Get an existing BackendExportKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: BackendExportKeyState, opts?: CustomResourceOptions): BackendExportKey
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        created_at: Optional[str] = None,
        export_key_hmac: Optional[str] = None,
        export_key_uuid: Optional[str] = None,
        key_type: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        public_key: Optional[str] = None) -> BackendExportKey
    func GetBackendExportKey(ctx *Context, name string, id IDInput, state *BackendExportKeyState, opts ...ResourceOption) (*BackendExportKey, error)
    public static BackendExportKey Get(string name, Input<string> id, BackendExportKeyState? state, CustomResourceOptions? opts = null)
    public static BackendExportKey get(String name, Output<String> id, BackendExportKeyState state, CustomResourceOptions options)
    resources:  _:    type: vault:pkiSecret:BackendExportKey    get:      id: ${id}
    import {
  to = vault_pki_secret_backend_export_key.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CreatedAt string
    RFC3339 timestamp of when this export key was created.
    ExportKeyHmac string
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    ExportKeyUuid string
    UUID assigned by Vault to this export key.
    KeyType string
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    Mount string
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    Name string
    Human-readable name for this export key. Changing this field forces a new resource.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PublicKey string
    PKIX PEM-encoded public key returned by Vault.
    CreatedAt string
    RFC3339 timestamp of when this export key was created.
    ExportKeyHmac string
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    ExportKeyUuid string
    UUID assigned by Vault to this export key.
    KeyType string
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    Mount string
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    Name string
    Human-readable name for this export key. Changing this field forces a new resource.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    PublicKey string
    PKIX PEM-encoded public key returned by Vault.
    created_at string
    RFC3339 timestamp of when this export key was created.
    export_key_hmac string
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    export_key_uuid string
    UUID assigned by Vault to this export key.
    key_type string
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount string
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name string
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    public_key string
    PKIX PEM-encoded public key returned by Vault.
    createdAt String
    RFC3339 timestamp of when this export key was created.
    exportKeyHmac String
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    exportKeyUuid String
    UUID assigned by Vault to this export key.
    keyType String
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount String
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name String
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    publicKey String
    PKIX PEM-encoded public key returned by Vault.
    createdAt string
    RFC3339 timestamp of when this export key was created.
    exportKeyHmac string
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    exportKeyUuid string
    UUID assigned by Vault to this export key.
    keyType string
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount string
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name string
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    publicKey string
    PKIX PEM-encoded public key returned by Vault.
    created_at str
    RFC3339 timestamp of when this export key was created.
    export_key_hmac str
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    export_key_uuid str
    UUID assigned by Vault to this export key.
    key_type str
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount str
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name str
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    public_key str
    PKIX PEM-encoded public key returned by Vault.
    createdAt String
    RFC3339 timestamp of when this export key was created.
    exportKeyHmac String
    Deterministic HMAC fingerprint of the public key (format sha256:<hex>).
    exportKeyUuid String
    UUID assigned by Vault to this export key.
    keyType String
    Algorithm for the wrapping keypair. Supported values: rsa-2048, rsa-3072, rsa-4096, rsa-8192, ec-p256, ec-p384, ec-p521, ml-kem-768, ml-kem-1024. Changing this field forces a new resource.
    mount String
    Path of the PKI secrets engine mount. Changing this field forces a new resource.
    name String
    Human-readable name for this export key. Changing this field forces a new resource.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    publicKey String
    PKIX PEM-encoded public key returned by Vault.

    Import

    PKI export keys can be imported using the <mount>/export/<uuid> format, e.g.

    $ pulumi import vault:pkiSecret/backendExportKey:BackendExportKey example pki/export/bf9b0d48-d0dd-652c-30be-77d04fc7e94d

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.14.1
    published on Tuesday, Oct 27, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial