Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. QuotaConfig
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.QuotaConfig

vault logo
Viewing docs for HashiCorp Vault v7.11.0
published on Wednesday, Jul 22, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages the singleton quota configuration at /sys/quotas/config.

    Important This is a global singleton configuration. Do not define this resource multiple times for the same Vault server, because each instance targets the same remote configuration.

    Important Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but that support is asymmetric. Administrative namespaces can read the configuration and update the boolean flags, while the exempt-path fields remain effectively root-managed.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const global = new vault.QuotaConfig("global", {
    namespace: "ns_admin",
    enableRateLimitAuditLogging: true,
    enableRateLimitResponseHeaders: true,
});

    import pulumi
import pulumi_vault as vault

global_ = vault.QuotaConfig("global",
    namespace="ns_admin",
    enable_rate_limit_audit_logging=True,
    enable_rate_limit_response_headers=True)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vault.NewQuotaConfig(ctx, "global", &vault.QuotaConfigArgs{
			Namespace:                      pulumi.String("ns_admin"),
			EnableRateLimitAuditLogging:    pulumi.Bool(true),
			EnableRateLimitResponseHeaders: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var @global = new Vault.QuotaConfig("global", new()
    {
        Namespace = "ns_admin",
        EnableRateLimitAuditLogging = true,
        EnableRateLimitResponseHeaders = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.QuotaConfig;
import com.pulumi.vault.QuotaConfigArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var global = new QuotaConfig("global", QuotaConfigArgs.builder()
            .namespace("ns_admin")
            .enableRateLimitAuditLogging(true)
            .enableRateLimitResponseHeaders(true)
            .build());

    }
}

    resources:
  global:
    type: vault:QuotaConfig
    properties:
      namespace: ns_admin
      enableRateLimitAuditLogging: true
      enableRateLimitResponseHeaders: true

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_quotaconfig" "global" {
  namespace                          = "ns_admin"
  enable_rate_limit_audit_logging    = true
  enable_rate_limit_response_headers = true
}

    Delete Behavior

    Vault does not expose a DELETE operation for /sys/quotas/config. Destroying this resource resets the configuration to the Vault defaults by writing:

    • rateLimitExemptPaths = []
    • absoluteRateLimitExemptPaths = []
    • enableRateLimitAuditLogging = false
    • enableRateLimitResponseHeaders = false

    This reset behavior is supported only when the resource is managed from the root namespace. Destroying a namespaced vault.QuotaConfig resource is not supported, because administrative namespaces cannot reset the root-managed exempt-path fields. To remove a namespaced instance from Terraform, first reset the quota configuration from the root namespace if needed, then remove the resource from state.

    Create QuotaConfig Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new QuotaConfig(name: string, args?: QuotaConfigArgs, opts?: CustomResourceOptions);
    @overload
def QuotaConfig(resource_name: str,
                args: Optional[QuotaConfigArgs] = None,
                opts: Optional[ResourceOptions] = None)

@overload
def QuotaConfig(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                absolute_rate_limit_exempt_paths: Optional[Sequence[str]] = None,
                enable_rate_limit_audit_logging: Optional[bool] = None,
                enable_rate_limit_response_headers: Optional[bool] = None,
                namespace: Optional[str] = None,
                rate_limit_exempt_paths: Optional[Sequence[str]] = None)
    func NewQuotaConfig(ctx *Context, name string, args *QuotaConfigArgs, opts ...ResourceOption) (*QuotaConfig, error)
    public QuotaConfig(string name, QuotaConfigArgs? args = null, CustomResourceOptions? opts = null)
    public QuotaConfig(String name, QuotaConfigArgs args)
public QuotaConfig(String name, QuotaConfigArgs args, CustomResourceOptions options)

    type: vault:QuotaConfig
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_quota_config" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args QuotaConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args QuotaConfigArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args QuotaConfigArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args QuotaConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args QuotaConfigArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var quotaConfigResource = new Vault.QuotaConfig("quotaConfigResource", new()
{
    AbsoluteRateLimitExemptPaths = new[]
    {
        "string",
    },
    EnableRateLimitAuditLogging = false,
    EnableRateLimitResponseHeaders = false,
    Namespace = "string",
    RateLimitExemptPaths = new[]
    {
        "string",
    },
});

    example, err := vault.NewQuotaConfig(ctx, "quotaConfigResource", &vault.QuotaConfigArgs{
	AbsoluteRateLimitExemptPaths: pulumi.StringArray{
		pulumi.String("string"),
	},
	EnableRateLimitAuditLogging:    pulumi.Bool(false),
	EnableRateLimitResponseHeaders: pulumi.Bool(false),
	Namespace:                      pulumi.String("string"),
	RateLimitExemptPaths: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "vault_quota_config" "quotaConfigResource" {
  lifecycle {
    create_before_destroy = true
  }
  absolute_rate_limit_exempt_paths   = ["string"]
  enable_rate_limit_audit_logging    = false
  enable_rate_limit_response_headers = false
  namespace                          = "string"
  rate_limit_exempt_paths            = ["string"]
}

    var quotaConfigResource = new QuotaConfig("quotaConfigResource", QuotaConfigArgs.builder()
    .absoluteRateLimitExemptPaths("string")
    .enableRateLimitAuditLogging(false)
    .enableRateLimitResponseHeaders(false)
    .namespace("string")
    .rateLimitExemptPaths("string")
    .build());

    quota_config_resource = vault.QuotaConfig("quotaConfigResource",
    absolute_rate_limit_exempt_paths=["string"],
    enable_rate_limit_audit_logging=False,
    enable_rate_limit_response_headers=False,
    namespace="string",
    rate_limit_exempt_paths=["string"])

    const quotaConfigResource = new vault.QuotaConfig("quotaConfigResource", {
    absoluteRateLimitExemptPaths: ["string"],
    enableRateLimitAuditLogging: false,
    enableRateLimitResponseHeaders: false,
    namespace: "string",
    rateLimitExemptPaths: ["string"],
});

    type: vault:QuotaConfig
properties:
    absoluteRateLimitExemptPaths:
        - string
    enableRateLimitAuditLogging: false
    enableRateLimitResponseHeaders: false
    namespace: string
    rateLimitExemptPaths:
        - string

    QuotaConfig Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The QuotaConfig resource accepts the following input properties:

    AbsoluteRateLimitExemptPaths List<string>
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    EnableRateLimitAuditLogging bool
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    EnableRateLimitResponseHeaders bool
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    RateLimitExemptPaths List<string>
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    AbsoluteRateLimitExemptPaths []string
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    EnableRateLimitAuditLogging bool
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    EnableRateLimitResponseHeaders bool
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    RateLimitExemptPaths []string
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absolute_rate_limit_exempt_paths list(string)
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enable_rate_limit_audit_logging bool
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enable_rate_limit_response_headers bool
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rate_limit_exempt_paths list(string)
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absoluteRateLimitExemptPaths List<String>
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enableRateLimitAuditLogging Boolean
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enableRateLimitResponseHeaders Boolean
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rateLimitExemptPaths List<String>
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absoluteRateLimitExemptPaths string[]
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enableRateLimitAuditLogging boolean
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enableRateLimitResponseHeaders boolean
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rateLimitExemptPaths string[]
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absolute_rate_limit_exempt_paths Sequence[str]
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enable_rate_limit_audit_logging bool
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enable_rate_limit_response_headers bool
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rate_limit_exempt_paths Sequence[str]
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absoluteRateLimitExemptPaths List<String>
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enableRateLimitAuditLogging Boolean
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enableRateLimitResponseHeaders Boolean
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rateLimitExemptPaths List<String>
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the QuotaConfig resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing QuotaConfig Resource

    Get an existing QuotaConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: QuotaConfigState, opts?: CustomResourceOptions): QuotaConfig
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        absolute_rate_limit_exempt_paths: Optional[Sequence[str]] = None,
        enable_rate_limit_audit_logging: Optional[bool] = None,
        enable_rate_limit_response_headers: Optional[bool] = None,
        namespace: Optional[str] = None,
        rate_limit_exempt_paths: Optional[Sequence[str]] = None) -> QuotaConfig
    func GetQuotaConfig(ctx *Context, name string, id IDInput, state *QuotaConfigState, opts ...ResourceOption) (*QuotaConfig, error)
    public static QuotaConfig Get(string name, Input<string> id, QuotaConfigState? state, CustomResourceOptions? opts = null)
    public static QuotaConfig get(String name, Output<String> id, QuotaConfigState state, CustomResourceOptions options)
    resources:  _:    type: vault:QuotaConfig    get:      id: ${id}
    import {
  to = vault_quota_config.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AbsoluteRateLimitExemptPaths List<string>
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    EnableRateLimitAuditLogging bool
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    EnableRateLimitResponseHeaders bool
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    RateLimitExemptPaths List<string>
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    AbsoluteRateLimitExemptPaths []string
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    EnableRateLimitAuditLogging bool
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    EnableRateLimitResponseHeaders bool
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    RateLimitExemptPaths []string
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absolute_rate_limit_exempt_paths list(string)
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enable_rate_limit_audit_logging bool
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enable_rate_limit_response_headers bool
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rate_limit_exempt_paths list(string)
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absoluteRateLimitExemptPaths List<String>
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enableRateLimitAuditLogging Boolean
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enableRateLimitResponseHeaders Boolean
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rateLimitExemptPaths List<String>
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absoluteRateLimitExemptPaths string[]
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enableRateLimitAuditLogging boolean
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enableRateLimitResponseHeaders boolean
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rateLimitExemptPaths string[]
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absolute_rate_limit_exempt_paths Sequence[str]
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enable_rate_limit_audit_logging bool
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enable_rate_limit_response_headers bool
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rate_limit_exempt_paths Sequence[str]
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.
    absoluteRateLimitExemptPaths List<String>
    Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.
    enableRateLimitAuditLogging Boolean
    Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    enableRateLimitResponseHeaders Boolean
    Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Vault Enterprise allows /sys/quotas/config to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only. Available only for Vault Enterprise.
    rateLimitExemptPaths List<String>
    Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.

    Import

    Import the singleton configuration with the fixed endpoint identifier:

    $ pulumi import vault:index/quotaConfig:QuotaConfig global sys/quotas/config

    When importing a namespaced instance, set TERRAFORM_VAULT_NAMESPACE_IMPORT so Terraform records the namespace in state:

    $ TERRAFORM_VAULT_NAMESPACE_IMPORT=ns_admin terraform import vault_quota_config.global sys/quotas/config

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo
    Viewing docs for HashiCorp Vault v7.11.0
    published on Wednesday, Jul 22, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial