Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. spiffe
  6. SecretBackendConfig
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.spiffe.SecretBackendConfig

vault logo vault logo
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Configure the SPIFFE trust domain.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const spiffeSecrets = new vault.Mount("spiffe_secrets", {
    path: "spiffe",
    type: "spiffe",
});
const spiffeConfig = new vault.spiffe.SecretBackendConfig("spiffe_config", {
    mount: spiffeSecrets.path,
    trustDomain: "example.com",
});

    import pulumi
import pulumi_vault as vault

spiffe_secrets = vault.Mount("spiffe_secrets",
    path="spiffe",
    type="spiffe")
spiffe_config = vault.spiffe.SecretBackendConfig("spiffe_config",
    mount=spiffe_secrets.path,
    trust_domain="example.com")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/spiffe"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		spiffeSecrets, err := vault.NewMount(ctx, "spiffe_secrets", &vault.MountArgs{
			Path: pulumi.String("spiffe"),
			Type: pulumi.String("spiffe"),
		})
		if err != nil {
			return err
		}
		_, err = spiffe.NewSecretBackendConfig(ctx, "spiffe_config", &spiffe.SecretBackendConfigArgs{
			Mount:       spiffeSecrets.Path,
			TrustDomain: pulumi.String("example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var spiffeSecrets = new Vault.Mount("spiffe_secrets", new()
    {
        Path = "spiffe",
        Type = "spiffe",
    });

    var spiffeConfig = new Vault.Spiffe.SecretBackendConfig("spiffe_config", new()
    {
        Mount = spiffeSecrets.Path,
        TrustDomain = "example.com",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.spiffe.SecretBackendConfig;
import com.pulumi.vault.spiffe.SecretBackendConfigArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var spiffeSecrets = new Mount("spiffeSecrets", MountArgs.builder()
            .path("spiffe")
            .type("spiffe")
            .build());

        var spiffeConfig = new SecretBackendConfig("spiffeConfig", SecretBackendConfigArgs.builder()
            .mount(spiffeSecrets.path())
            .trustDomain("example.com")
            .build());

    }
}

    resources:
  spiffeSecrets:
    type: vault:Mount
    name: spiffe_secrets
    properties:
      path: spiffe
      type: spiffe
  spiffeConfig:
    type: vault:spiffe:SecretBackendConfig
    name: spiffe_config
    properties:
      mount: ${spiffeSecrets.path}
      trustDomain: example.com

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "spiffe_secrets" {
  path = "spiffe"
  type = "spiffe"
}
resource "vault_spiffe_secretbackendconfig" "spiffe_config" {
  mount        = vault_mount.spiffe_secrets.path
  trust_domain = "example.com"
}

    Create SecretBackendConfig Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendConfig(name: string, args: SecretBackendConfigArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendConfig(resource_name: str,
                        args: SecretBackendConfigArgs,
                        opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendConfig(resource_name: str,
                        opts: Optional[ResourceOptions] = None,
                        mount: Optional[str] = None,
                        trust_domain: Optional[str] = None,
                        bundle_refresh_hint: Optional[str] = None,
                        jwt_issuer_url: Optional[str] = None,
                        jwt_oidc_compatibility_mode: Optional[bool] = None,
                        jwt_signing_algorithm: Optional[str] = None,
                        key_lifetime: Optional[str] = None,
                        namespace: Optional[str] = None)
    func NewSecretBackendConfig(ctx *Context, name string, args SecretBackendConfigArgs, opts ...ResourceOption) (*SecretBackendConfig, error)
    public SecretBackendConfig(string name, SecretBackendConfigArgs args, CustomResourceOptions? opts = null)
    public SecretBackendConfig(String name, SecretBackendConfigArgs args)
public SecretBackendConfig(String name, SecretBackendConfigArgs args, CustomResourceOptions options)

    type: vault:spiffe:SecretBackendConfig
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_spiffe_secret_backend_config" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendConfigArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendConfigArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendConfigArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretBackendConfigResource = new Vault.Spiffe.SecretBackendConfig("secretBackendConfigResource", new()
{
    Mount = "string",
    TrustDomain = "string",
    BundleRefreshHint = "string",
    JwtIssuerUrl = "string",
    JwtOidcCompatibilityMode = false,
    JwtSigningAlgorithm = "string",
    KeyLifetime = "string",
    Namespace = "string",
});

    example, err := spiffe.NewSecretBackendConfig(ctx, "secretBackendConfigResource", &spiffe.SecretBackendConfigArgs{
	Mount:                    pulumi.String("string"),
	TrustDomain:              pulumi.String("string"),
	BundleRefreshHint:        pulumi.String("string"),
	JwtIssuerUrl:             pulumi.String("string"),
	JwtOidcCompatibilityMode: pulumi.Bool(false),
	JwtSigningAlgorithm:      pulumi.String("string"),
	KeyLifetime:              pulumi.String("string"),
	Namespace:                pulumi.String("string"),
})

    resource "vault_spiffe_secret_backend_config" "secretBackendConfigResource" {
  lifecycle {
    create_before_destroy = true
  }
  mount                       = "string"
  trust_domain                = "string"
  bundle_refresh_hint         = "string"
  jwt_issuer_url              = "string"
  jwt_oidc_compatibility_mode = false
  jwt_signing_algorithm       = "string"
  key_lifetime                = "string"
  namespace                   = "string"
}

    var secretBackendConfigResource = new SecretBackendConfig("secretBackendConfigResource", SecretBackendConfigArgs.builder()
    .mount("string")
    .trustDomain("string")
    .bundleRefreshHint("string")
    .jwtIssuerUrl("string")
    .jwtOidcCompatibilityMode(false)
    .jwtSigningAlgorithm("string")
    .keyLifetime("string")
    .namespace("string")
    .build());

    secret_backend_config_resource = vault.spiffe.SecretBackendConfig("secretBackendConfigResource",
    mount="string",
    trust_domain="string",
    bundle_refresh_hint="string",
    jwt_issuer_url="string",
    jwt_oidc_compatibility_mode=False,
    jwt_signing_algorithm="string",
    key_lifetime="string",
    namespace="string")

    const secretBackendConfigResource = new vault.spiffe.SecretBackendConfig("secretBackendConfigResource", {
    mount: "string",
    trustDomain: "string",
    bundleRefreshHint: "string",
    jwtIssuerUrl: "string",
    jwtOidcCompatibilityMode: false,
    jwtSigningAlgorithm: "string",
    keyLifetime: "string",
    namespace: "string",
});

    type: vault:spiffe:SecretBackendConfig
properties:
    bundleRefreshHint: string
    jwtIssuerUrl: string
    jwtOidcCompatibilityMode: false
    jwtSigningAlgorithm: string
    keyLifetime: string
    mount: string
    namespace: string
    trustDomain: string

    SecretBackendConfig Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendConfig resource accepts the following input properties:

    Mount string
    The PKI secret backend the resource belongs to.
    TrustDomain string
    The SPIFFE trust domain used by the backend.
    BundleRefreshHint string
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    JwtIssuerUrl string
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    JwtOidcCompatibilityMode bool
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    JwtSigningAlgorithm string
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    KeyLifetime string
    How often to generate a new signing key. Uses duration format strings.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    Mount string
    The PKI secret backend the resource belongs to.
    TrustDomain string
    The SPIFFE trust domain used by the backend.
    BundleRefreshHint string
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    JwtIssuerUrl string
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    JwtOidcCompatibilityMode bool
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    JwtSigningAlgorithm string
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    KeyLifetime string
    How often to generate a new signing key. Uses duration format strings.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount string
    The PKI secret backend the resource belongs to.
    trust_domain string
    The SPIFFE trust domain used by the backend.
    bundle_refresh_hint string
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwt_issuer_url string
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwt_oidc_compatibility_mode bool
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwt_signing_algorithm string
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    key_lifetime string
    How often to generate a new signing key. Uses duration format strings.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount String
    The PKI secret backend the resource belongs to.
    trustDomain String
    The SPIFFE trust domain used by the backend.
    bundleRefreshHint String
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwtIssuerUrl String
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwtOidcCompatibilityMode Boolean
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwtSigningAlgorithm String
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    keyLifetime String
    How often to generate a new signing key. Uses duration format strings.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount string
    The PKI secret backend the resource belongs to.
    trustDomain string
    The SPIFFE trust domain used by the backend.
    bundleRefreshHint string
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwtIssuerUrl string
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwtOidcCompatibilityMode boolean
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwtSigningAlgorithm string
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    keyLifetime string
    How often to generate a new signing key. Uses duration format strings.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount str
    The PKI secret backend the resource belongs to.
    trust_domain str
    The SPIFFE trust domain used by the backend.
    bundle_refresh_hint str
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwt_issuer_url str
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwt_oidc_compatibility_mode bool
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwt_signing_algorithm str
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    key_lifetime str
    How often to generate a new signing key. Uses duration format strings.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    mount String
    The PKI secret backend the resource belongs to.
    trustDomain String
    The SPIFFE trust domain used by the backend.
    bundleRefreshHint String
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwtIssuerUrl String
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwtOidcCompatibilityMode Boolean
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwtSigningAlgorithm String
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    keyLifetime String
    How often to generate a new signing key. Uses duration format strings.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendConfig resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecretBackendConfig Resource

    Get an existing SecretBackendConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendConfigState, opts?: CustomResourceOptions): SecretBackendConfig
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        bundle_refresh_hint: Optional[str] = None,
        jwt_issuer_url: Optional[str] = None,
        jwt_oidc_compatibility_mode: Optional[bool] = None,
        jwt_signing_algorithm: Optional[str] = None,
        key_lifetime: Optional[str] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        trust_domain: Optional[str] = None) -> SecretBackendConfig
    func GetSecretBackendConfig(ctx *Context, name string, id IDInput, state *SecretBackendConfigState, opts ...ResourceOption) (*SecretBackendConfig, error)
    public static SecretBackendConfig Get(string name, Input<string> id, SecretBackendConfigState? state, CustomResourceOptions? opts = null)
    public static SecretBackendConfig get(String name, Output<String> id, SecretBackendConfigState state, CustomResourceOptions options)
    resources:  _:    type: vault:spiffe:SecretBackendConfig    get:      id: ${id}
    import {
  to = vault_spiffe_secret_backend_config.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    BundleRefreshHint string
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    JwtIssuerUrl string
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    JwtOidcCompatibilityMode bool
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    JwtSigningAlgorithm string
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    KeyLifetime string
    How often to generate a new signing key. Uses duration format strings.
    Mount string
    The PKI secret backend the resource belongs to.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    TrustDomain string
    The SPIFFE trust domain used by the backend.
    BundleRefreshHint string
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    JwtIssuerUrl string
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    JwtOidcCompatibilityMode bool
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    JwtSigningAlgorithm string
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    KeyLifetime string
    How often to generate a new signing key. Uses duration format strings.
    Mount string
    The PKI secret backend the resource belongs to.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    TrustDomain string
    The SPIFFE trust domain used by the backend.
    bundle_refresh_hint string
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwt_issuer_url string
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwt_oidc_compatibility_mode bool
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwt_signing_algorithm string
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    key_lifetime string
    How often to generate a new signing key. Uses duration format strings.
    mount string
    The PKI secret backend the resource belongs to.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trust_domain string
    The SPIFFE trust domain used by the backend.
    bundleRefreshHint String
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwtIssuerUrl String
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwtOidcCompatibilityMode Boolean
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwtSigningAlgorithm String
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    keyLifetime String
    How often to generate a new signing key. Uses duration format strings.
    mount String
    The PKI secret backend the resource belongs to.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trustDomain String
    The SPIFFE trust domain used by the backend.
    bundleRefreshHint string
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwtIssuerUrl string
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwtOidcCompatibilityMode boolean
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwtSigningAlgorithm string
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    keyLifetime string
    How often to generate a new signing key. Uses duration format strings.
    mount string
    The PKI secret backend the resource belongs to.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trustDomain string
    The SPIFFE trust domain used by the backend.
    bundle_refresh_hint str
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwt_issuer_url str
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwt_oidc_compatibility_mode bool
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwt_signing_algorithm str
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    key_lifetime str
    How often to generate a new signing key. Uses duration format strings.
    mount str
    The PKI secret backend the resource belongs to.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trust_domain str
    The SPIFFE trust domain used by the backend.
    bundleRefreshHint String
    The value to put as the refresh hint in trust bundles we publish. May not exceed key_lifetime/10. Uses duration format strings.
    jwtIssuerUrl String
    The base URL to use for JWT issuer claims (iss), including https:// schema, host, and optional port. Must be reachable by whatever systems consume the JWTs.
    jwtOidcCompatibilityMode Boolean
    When set true, attempts to generate JWT SVIDs will fail if the resulting SPIFFEID exceeds 255 chars, the limit for JWT sub claims in OIDC.
    jwtSigningAlgorithm String
    Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512.
    keyLifetime String
    How often to generate a new signing key. Uses duration format strings.
    mount String
    The PKI secret backend the resource belongs to.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    trustDomain String
    The SPIFFE trust domain used by the backend.

    Import

    The SPIFFE config can be imported using the resource’s id. In the case of the example above the id would be spiffe/config, where the spiffe component is the resource’s mount, e.g.

    $ pulumi import vault:spiffe/secretBackendConfig:SecretBackendConfig spiffe_config spiffe/config

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.11.1
    published on Tuesday, Aug 11, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial