Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. spiffe
  6. SecretBackendRole
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.spiffe.SecretBackendRole

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manage a named role within a SPIFFE secrets backend. The role specifies the content of JWTs.

    Important All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform, and will appear in the console output when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const spiffeSecrets = new vault.Mount("spiffe_secrets", {
    path: "spiffe",
    type: "spiffe",
});
const spiffeConfig = new vault.spiffe.SecretBackendConfig("spiffe_config", {
    mount: spiffeSecrets.path,
    trustDomain: "example.com",
});
const spiffeRole = new vault.spiffe.SecretBackendRole("spiffe_role", {
    mount: spiffeSecrets.path,
    name: "example-role",
    template: JSON.stringify({
        sub: "spiffe://example.com/workload",
    }),
});

    import pulumi
import json
import pulumi_vault as vault

spiffe_secrets = vault.Mount("spiffe_secrets",
    path="spiffe",
    type="spiffe")
spiffe_config = vault.spiffe.SecretBackendConfig("spiffe_config",
    mount=spiffe_secrets.path,
    trust_domain="example.com")
spiffe_role = vault.spiffe.SecretBackendRole("spiffe_role",
    mount=spiffe_secrets.path,
    name="example-role",
    template=json.dumps({
        "sub": "spiffe://example.com/workload",
    }))

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/spiffe"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		spiffeSecrets, err := vault.NewMount(ctx, "spiffe_secrets", &vault.MountArgs{
			Path: pulumi.String("spiffe"),
			Type: pulumi.String("spiffe"),
		})
		if err != nil {
			return err
		}
		_, err = spiffe.NewSecretBackendConfig(ctx, "spiffe_config", &spiffe.SecretBackendConfigArgs{
			Mount:       spiffeSecrets.Path,
			TrustDomain: pulumi.String("example.com"),
		})
		if err != nil {
			return err
		}
		tmpJSON0, err := json.Marshal(map[string]string{
			"sub": "spiffe://example.com/workload",
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		_, err = spiffe.NewSecretBackendRole(ctx, "spiffe_role", &spiffe.SecretBackendRoleArgs{
			Mount:    spiffeSecrets.Path,
			Name:     pulumi.String("example-role"),
			Template: pulumi.String(json0),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var spiffeSecrets = new Vault.Mount("spiffe_secrets", new()
    {
        Path = "spiffe",
        Type = "spiffe",
    });

    var spiffeConfig = new Vault.Spiffe.SecretBackendConfig("spiffe_config", new()
    {
        Mount = spiffeSecrets.Path,
        TrustDomain = "example.com",
    });

    var spiffeRole = new Vault.Spiffe.SecretBackendRole("spiffe_role", new()
    {
        Mount = spiffeSecrets.Path,
        Name = "example-role",
        Template = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["sub"] = "spiffe://example.com/workload",
        }),
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.spiffe.SecretBackendConfig;
import com.pulumi.vault.spiffe.SecretBackendConfigArgs;
import com.pulumi.vault.spiffe.SecretBackendRole;
import com.pulumi.vault.spiffe.SecretBackendRoleArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var spiffeSecrets = new Mount("spiffeSecrets", MountArgs.builder()
            .path("spiffe")
            .type("spiffe")
            .build());

        var spiffeConfig = new SecretBackendConfig("spiffeConfig", SecretBackendConfigArgs.builder()
            .mount(spiffeSecrets.path())
            .trustDomain("example.com")
            .build());

        var spiffeRole = new SecretBackendRole("spiffeRole", SecretBackendRoleArgs.builder()
            .mount(spiffeSecrets.path())
            .name("example-role")
            .template(serializeJson(
                jsonObject(
                    jsonProperty("sub", "spiffe://example.com/workload")
                )))
            .build());

    }
}

    resources:
  spiffeSecrets:
    type: vault:Mount
    name: spiffe_secrets
    properties:
      path: spiffe
      type: spiffe
  spiffeConfig:
    type: vault:spiffe:SecretBackendConfig
    name: spiffe_config
    properties:
      mount: ${spiffeSecrets.path}
      trustDomain: example.com
  spiffeRole:
    type: vault:spiffe:SecretBackendRole
    name: spiffe_role
    properties:
      mount: ${spiffeSecrets.path}
      name: example-role
      template:
        fn::toJSON:
          sub: spiffe://example.com/workload

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "spiffe_secrets" {
  path = "spiffe"
  type = "spiffe"
}
resource "vault_spiffe_secretbackendconfig" "spiffe_config" {
  mount        = vault_mount.spiffe_secrets.path
  trust_domain = "example.com"
}
resource "vault_spiffe_secretbackendrole" "spiffe_role" {
  mount = vault_mount.spiffe_secrets.path
  name  = "example-role"
  template = jsonencode({
    "sub" = "spiffe://example.com/workload"
  })
}

    Create SecretBackendRole Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecretBackendRole(name: string, args: SecretBackendRoleArgs, opts?: CustomResourceOptions);
    @overload
def SecretBackendRole(resource_name: str,
                      args: SecretBackendRoleArgs,
                      opts: Optional[ResourceOptions] = None)

@overload
def SecretBackendRole(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      mount: Optional[str] = None,
                      template: Optional[str] = None,
                      name: Optional[str] = None,
                      namespace: Optional[str] = None,
                      ttl: Optional[str] = None,
                      use_jti_claim: Optional[bool] = None)
    func NewSecretBackendRole(ctx *Context, name string, args SecretBackendRoleArgs, opts ...ResourceOption) (*SecretBackendRole, error)
    public SecretBackendRole(string name, SecretBackendRoleArgs args, CustomResourceOptions? opts = null)
    public SecretBackendRole(String name, SecretBackendRoleArgs args)
public SecretBackendRole(String name, SecretBackendRoleArgs args, CustomResourceOptions options)

    type: vault:spiffe:SecretBackendRole
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_spiffe_secret_backend_role" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretBackendRoleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var examplesecretBackendRoleResourceResourceFromSpiffesecretBackendRole = new Vault.Spiffe.SecretBackendRole("examplesecretBackendRoleResourceResourceFromSpiffesecretBackendRole", new()
{
    Mount = "string",
    Template = "string",
    Name = "string",
    Namespace = "string",
    Ttl = "string",
    UseJtiClaim = false,
});

    example, err := spiffe.NewSecretBackendRole(ctx, "examplesecretBackendRoleResourceResourceFromSpiffesecretBackendRole", &spiffe.SecretBackendRoleArgs{
	Mount:       pulumi.String("string"),
	Template:    pulumi.String("string"),
	Name:        pulumi.String("string"),
	Namespace:   pulumi.String("string"),
	Ttl:         pulumi.String("string"),
	UseJtiClaim: pulumi.Bool(false),
})

    resource "vault_spiffe_secret_backend_role" "examplesecretBackendRoleResourceResourceFromSpiffesecretBackendRole" {
  lifecycle {
    create_before_destroy = true
  }
  mount         = "string"
  template      = "string"
  name          = "string"
  namespace     = "string"
  ttl           = "string"
  use_jti_claim = false
}

    var examplesecretBackendRoleResourceResourceFromSpiffesecretBackendRole = new com.pulumi.vault.spiffe.SecretBackendRole("examplesecretBackendRoleResourceResourceFromSpiffesecretBackendRole", com.pulumi.vault.spiffe.SecretBackendRoleArgs.builder()
    .mount("string")
    .template("string")
    .name("string")
    .namespace("string")
    .ttl("string")
    .useJtiClaim(false)
    .build());

    examplesecret_backend_role_resource_resource_from_spiffesecret_backend_role = vault.spiffe.SecretBackendRole("examplesecretBackendRoleResourceResourceFromSpiffesecretBackendRole",
    mount="string",
    template="string",
    name="string",
    namespace="string",
    ttl="string",
    use_jti_claim=False)

    const examplesecretBackendRoleResourceResourceFromSpiffesecretBackendRole = new vault.spiffe.SecretBackendRole("examplesecretBackendRoleResourceResourceFromSpiffesecretBackendRole", {
    mount: "string",
    template: "string",
    name: "string",
    namespace: "string",
    ttl: "string",
    useJtiClaim: false,
});

    type: vault:spiffe:SecretBackendRole
properties:
    mount: string
    name: string
    namespace: string
    template: string
    ttl: string
    useJtiClaim: false

    SecretBackendRole Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecretBackendRole resource accepts the following input properties:

    Mount string
    The SPIFFE secret backend the resource belongs to.
    Template string
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    Name string
    The unique name of the SPIFFE role you want to manage.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    Ttl string
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    UseJtiClaim bool
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    Mount string
    The SPIFFE secret backend the resource belongs to.
    Template string
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    Name string
    The unique name of the SPIFFE role you want to manage.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    Ttl string
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    UseJtiClaim bool
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount string
    The SPIFFE secret backend the resource belongs to.
    template string
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    name string
    The unique name of the SPIFFE role you want to manage.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    ttl string
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    use_jti_claim bool
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount String
    The SPIFFE secret backend the resource belongs to.
    template String
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    name String
    The unique name of the SPIFFE role you want to manage.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    ttl String
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    useJtiClaim Boolean
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount string
    The SPIFFE secret backend the resource belongs to.
    template string
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    name string
    The unique name of the SPIFFE role you want to manage.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    ttl string
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    useJtiClaim boolean
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount str
    The SPIFFE secret backend the resource belongs to.
    template str
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    name str
    The unique name of the SPIFFE role you want to manage.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    ttl str
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    use_jti_claim bool
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount String
    The SPIFFE secret backend the resource belongs to.
    template String
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    name String
    The unique name of the SPIFFE role you want to manage.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    ttl String
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    useJtiClaim Boolean
    If true, the jti claim will be included in JWTs, which may impact their reusability.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecretBackendRole resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SecretBackendRole Resource

    Get an existing SecretBackendRole resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretBackendRoleState, opts?: CustomResourceOptions): SecretBackendRole
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None,
        template: Optional[str] = None,
        ttl: Optional[str] = None,
        use_jti_claim: Optional[bool] = None) -> SecretBackendRole
    func GetSecretBackendRole(ctx *Context, name string, id IDInput, state *SecretBackendRoleState, opts ...ResourceOption) (*SecretBackendRole, error)
    public static SecretBackendRole Get(string name, Input<string> id, SecretBackendRoleState? state, CustomResourceOptions? opts = null)
    public static SecretBackendRole get(String name, Output<String> id, SecretBackendRoleState state, CustomResourceOptions options)
    resources:  _:    type: vault:spiffe:SecretBackendRole    get:      id: ${id}
    import {
  to = vault_spiffe_secret_backend_role.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Mount string
    The SPIFFE secret backend the resource belongs to.
    Name string
    The unique name of the SPIFFE role you want to manage.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    Template string
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    Ttl string
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    UseJtiClaim bool
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    Mount string
    The SPIFFE secret backend the resource belongs to.
    Name string
    The unique name of the SPIFFE role you want to manage.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    Template string
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    Ttl string
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    UseJtiClaim bool
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount string
    The SPIFFE secret backend the resource belongs to.
    name string
    The unique name of the SPIFFE role you want to manage.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    template string
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    ttl string
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    use_jti_claim bool
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount String
    The SPIFFE secret backend the resource belongs to.
    name String
    The unique name of the SPIFFE role you want to manage.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    template String
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    ttl String
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    useJtiClaim Boolean
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount string
    The SPIFFE secret backend the resource belongs to.
    name string
    The unique name of the SPIFFE role you want to manage.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    template string
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    ttl string
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    useJtiClaim boolean
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount str
    The SPIFFE secret backend the resource belongs to.
    name str
    The unique name of the SPIFFE role you want to manage.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    template str
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    ttl str
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    use_jti_claim bool
    If true, the jti claim will be included in JWTs, which may impact their reusability.
    mount String
    The SPIFFE secret backend the resource belongs to.
    name String
    The unique name of the SPIFFE role you want to manage.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    template String
    The template string to use for generating tokens. This may be in stringified JSON or base64 format.
    ttl String
    TTL of the tokens generated against the role. Uses duration format strings. TTLs of generated tokens will be capped by the lifespan of the current signing key.
    useJtiClaim Boolean
    If true, the jti claim will be included in JWTs, which may impact their reusability.

    Import

    The SPIFFE role can be imported using the resource’s id. In the case of the example above the id would be spiffe/role/example-role, where the spiffe component is the resource’s mount, e.g.

    $ pulumi import vault:spiffe/secretBackendRole:SecretBackendRole spiffe_role spiffe/role/example-role

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial