Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. pkiSecret
  6. BackendWrappedKeyImport
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.pkiSecret.BackendWrappedKeyImport

vault logo vault logo
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Imports a wrapped CA private key into a PKI secrets engine mount.

    For more information, please refer to the Vault documentation for importing a key.

    Available only for Vault Enterprise.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const pki = new vault.Mount("pki", {
    path: "pki",
    type: "pki",
});
const example = new vault.pkisecret.BackendWrappedKeyImport("example", {
    mount: pki.path,
    keyName: "example-key",
    wrappedKey: "...",
    exportKeyHmac: "sha256:...",
});

    import pulumi
import pulumi_vault as vault

pki = vault.Mount("pki",
    path="pki",
    type="pki")
example = vault.pkisecret.BackendWrappedKeyImport("example",
    mount=pki.path,
    key_name="example-key",
    wrapped_key="...",
    export_key_hmac="sha256:...")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		pki, err := vault.NewMount(ctx, "pki", &vault.MountArgs{
			Path: pulumi.String("pki"),
			Type: pulumi.String("pki"),
		})
		if err != nil {
			return err
		}
		_, err = pkisecret.NewBackendWrappedKeyImport(ctx, "example", &pkisecret.BackendWrappedKeyImportArgs{
			Mount:         pki.Path,
			KeyName:       pulumi.String("example-key"),
			WrappedKey:    pulumi.String("..."),
			ExportKeyHmac: pulumi.String("sha256:..."),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pki = new Vault.Mount("pki", new()
    {
        Path = "pki",
        Type = "pki",
    });

    var example = new Vault.PkiSecret.BackendWrappedKeyImport("example", new()
    {
        Mount = pki.Path,
        KeyName = "example-key",
        WrappedKey = "...",
        ExportKeyHmac = "sha256:...",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiSecret.BackendWrappedKeyImport;
import com.pulumi.vault.pkiSecret.BackendWrappedKeyImportArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pki = new Mount("pki", MountArgs.builder()
            .path("pki")
            .type("pki")
            .build());

        var example = new BackendWrappedKeyImport("example", BackendWrappedKeyImportArgs.builder()
            .mount(pki.path())
            .keyName("example-key")
            .wrappedKey("...")
            .exportKeyHmac("sha256:...")
            .build());

    }
}

    resources:
  pki:
    type: vault:Mount
    properties:
      path: pki
      type: pki
  example:
    type: vault:pkiSecret:BackendWrappedKeyImport
    properties:
      mount: ${pki.path}
      keyName: example-key
      wrappedKey: '...'
      exportKeyHmac: sha256:...

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "pki" {
  lifecycle {
    create_before_destroy = true
  }
  path = "pki"
  type = "pki"
}
resource "vault_pki_secret_backend_wrapped_key_import" "example" {
  lifecycle {
    create_before_destroy = true
  }
  mount           = vault_mount.pki.path
  key_name        = "example-key"
  wrapped_key     = "..."
  export_key_hmac = "sha256:..."
}

    Create BackendWrappedKeyImport Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new BackendWrappedKeyImport(name: string, args: BackendWrappedKeyImportArgs, opts?: CustomResourceOptions);
    @overload
def BackendWrappedKeyImport(resource_name: str,
                            args: BackendWrappedKeyImportArgs,
                            opts: Optional[ResourceOptions] = None)

@overload
def BackendWrappedKeyImport(resource_name: str,
                            opts: Optional[ResourceOptions] = None,
                            export_key_hmac: Optional[str] = None,
                            mount: Optional[str] = None,
                            wrapped_key: Optional[str] = None,
                            key_name: Optional[str] = None,
                            namespace: Optional[str] = None)
    func NewBackendWrappedKeyImport(ctx *Context, name string, args BackendWrappedKeyImportArgs, opts ...ResourceOption) (*BackendWrappedKeyImport, error)
    public BackendWrappedKeyImport(string name, BackendWrappedKeyImportArgs args, CustomResourceOptions? opts = null)
    public BackendWrappedKeyImport(String name, BackendWrappedKeyImportArgs args)
public BackendWrappedKeyImport(String name, BackendWrappedKeyImportArgs args, CustomResourceOptions options)

    type: vault:pkiSecret:BackendWrappedKeyImport
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_pki_secret_backend_wrapped_key_import" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args BackendWrappedKeyImportArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args BackendWrappedKeyImportArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args BackendWrappedKeyImportArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args BackendWrappedKeyImportArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args BackendWrappedKeyImportArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var backendWrappedKeyImportResource = new Vault.PkiSecret.BackendWrappedKeyImport("backendWrappedKeyImportResource", new()
{
    ExportKeyHmac = "string",
    Mount = "string",
    WrappedKey = "string",
    KeyName = "string",
    Namespace = "string",
});

    example, err := pkisecret.NewBackendWrappedKeyImport(ctx, "backendWrappedKeyImportResource", &pkisecret.BackendWrappedKeyImportArgs{
	ExportKeyHmac: pulumi.String("string"),
	Mount:         pulumi.String("string"),
	WrappedKey:    pulumi.String("string"),
	KeyName:       pulumi.String("string"),
	Namespace:     pulumi.String("string"),
})

    resource "vault_pki_secret_backend_wrapped_key_import" "backendWrappedKeyImportResource" {
  lifecycle {
    create_before_destroy = true
  }
  export_key_hmac = "string"
  mount           = "string"
  wrapped_key     = "string"
  key_name        = "string"
  namespace       = "string"
}

    var backendWrappedKeyImportResource = new BackendWrappedKeyImport("backendWrappedKeyImportResource", BackendWrappedKeyImportArgs.builder()
    .exportKeyHmac("string")
    .mount("string")
    .wrappedKey("string")
    .keyName("string")
    .namespace("string")
    .build());

    backend_wrapped_key_import_resource = vault.pkisecret.BackendWrappedKeyImport("backendWrappedKeyImportResource",
    export_key_hmac="string",
    mount="string",
    wrapped_key="string",
    key_name="string",
    namespace="string")

    const backendWrappedKeyImportResource = new vault.pkisecret.BackendWrappedKeyImport("backendWrappedKeyImportResource", {
    exportKeyHmac: "string",
    mount: "string",
    wrappedKey: "string",
    keyName: "string",
    namespace: "string",
});

    type: vault:pkiSecret:BackendWrappedKeyImport
properties:
    exportKeyHmac: string
    keyName: string
    mount: string
    namespace: string
    wrappedKey: string

    BackendWrappedKeyImport Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The BackendWrappedKeyImport resource accepts the following input properties:

    ExportKeyHmac string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    Mount string
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    WrappedKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    KeyName string
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ExportKeyHmac string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    Mount string
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    WrappedKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    KeyName string
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    export_key_hmac string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    mount string
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    wrapped_key string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    key_name string
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    exportKeyHmac String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    mount String
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    wrappedKey String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    keyName String
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    exportKeyHmac string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    mount string
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    wrappedKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    keyName string
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    export_key_hmac str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    mount str
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    wrapped_key str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    key_name str
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    exportKeyHmac String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    mount String
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    wrappedKey String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    keyName String
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the BackendWrappedKeyImport resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    KeyId string
    UUID assigned by Vault to the imported key.
    KeyType string
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    Id string
    The provider-assigned unique ID for this managed resource.
    KeyId string
    UUID assigned by Vault to the imported key.
    KeyType string
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    id string
    The provider-assigned unique ID for this managed resource.
    key_id string
    UUID assigned by Vault to the imported key.
    key_type string
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    id String
    The provider-assigned unique ID for this managed resource.
    keyId String
    UUID assigned by Vault to the imported key.
    keyType String
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    id string
    The provider-assigned unique ID for this managed resource.
    keyId string
    UUID assigned by Vault to the imported key.
    keyType string
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    id str
    The provider-assigned unique ID for this managed resource.
    key_id str
    UUID assigned by Vault to the imported key.
    key_type str
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    id String
    The provider-assigned unique ID for this managed resource.
    keyId String
    UUID assigned by Vault to the imported key.
    keyType String
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).

    Look up Existing BackendWrappedKeyImport Resource

    Get an existing BackendWrappedKeyImport resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: BackendWrappedKeyImportState, opts?: CustomResourceOptions): BackendWrappedKeyImport
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        export_key_hmac: Optional[str] = None,
        key_id: Optional[str] = None,
        key_name: Optional[str] = None,
        key_type: Optional[str] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        wrapped_key: Optional[str] = None) -> BackendWrappedKeyImport
    func GetBackendWrappedKeyImport(ctx *Context, name string, id IDInput, state *BackendWrappedKeyImportState, opts ...ResourceOption) (*BackendWrappedKeyImport, error)
    public static BackendWrappedKeyImport Get(string name, Input<string> id, BackendWrappedKeyImportState? state, CustomResourceOptions? opts = null)
    public static BackendWrappedKeyImport get(String name, Output<String> id, BackendWrappedKeyImportState state, CustomResourceOptions options)
    resources:  _:    type: vault:pkiSecret:BackendWrappedKeyImport    get:      id: ${id}
    import {
  to = vault_pki_secret_backend_wrapped_key_import.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ExportKeyHmac string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    KeyId string
    UUID assigned by Vault to the imported key.
    KeyName string
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    KeyType string
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    Mount string
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    WrappedKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    ExportKeyHmac string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    KeyId string
    UUID assigned by Vault to the imported key.
    KeyName string
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    KeyType string
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    Mount string
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    WrappedKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    export_key_hmac string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    key_id string
    UUID assigned by Vault to the imported key.
    key_name string
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    key_type string
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    mount string
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    wrapped_key string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    exportKeyHmac String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    keyId String
    UUID assigned by Vault to the imported key.
    keyName String
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    keyType String
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    mount String
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    wrappedKey String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    exportKeyHmac string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    keyId string
    UUID assigned by Vault to the imported key.
    keyName string
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    keyType string
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    mount string
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    wrappedKey string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    export_key_hmac str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    key_id str
    UUID assigned by Vault to the imported key.
    key_name str
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    key_type str
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    mount str
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    wrapped_key str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.
    exportKeyHmac String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Deterministic HMAC fingerprint of the wrapping key used to encrypt the blob. Write-only — not stored in state after create. Accepts ephemeral values.
    keyId String
    UUID assigned by Vault to the imported key.
    keyName String
    Human-readable name for the imported key in Vault. Changing this field forces a new resource.
    keyType String
    Key algorithm type as reported by Vault after import (e.g. rsa, ec, ed25519).
    mount String
    Path of the destination PKI secrets engine mount. Changing this field forces a new resource.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    wrappedKey String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded wrapped CA private key blob. Write-only — sent to Vault on create and never stored in Terraform state. Accepts ephemeral values.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.14.1
    published on Tuesday, Oct 27, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial