Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. SysConfigCors
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.SysConfigCors

vault logo vault logo
Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages the CORS (Cross-Origin Resource Sharing) configuration for Vault, controlling which origins can make cross-origin requests and which headers are allowed.

    Important This resource requires sudo capability and must be called from the root namespace. CORS configuration does not replicate across Performance Replication clusters in Vault Enterprise.

    Note This feature is available in Vault 1.14+

    Example Usage

    Enable CORS for specific origins

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const example = new vault.SysConfigCors("example", {
    allowedOrigins: [
        "http://www.example.com",
        "https://app.example.com",
    ],
    allowedHeaders: [
        "X-Custom-Header",
        "X-Application-ID",
    ],
});

    import pulumi
import pulumi_vault as vault

example = vault.SysConfigCors("example",
    allowed_origins=[
        "http://www.example.com",
        "https://app.example.com",
    ],
    allowed_headers=[
        "X-Custom-Header",
        "X-Application-ID",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vault.NewSysConfigCors(ctx, "example", &vault.SysConfigCorsArgs{
			AllowedOrigins: pulumi.StringArray{
				pulumi.String("http://www.example.com"),
				pulumi.String("https://app.example.com"),
			},
			AllowedHeaders: pulumi.StringArray{
				pulumi.String("X-Custom-Header"),
				pulumi.String("X-Application-ID"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var example = new Vault.SysConfigCors("example", new()
    {
        AllowedOrigins = new[]
        {
            "http://www.example.com",
            "https://app.example.com",
        },
        AllowedHeaders = new[]
        {
            "X-Custom-Header",
            "X-Application-ID",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.SysConfigCors;
import com.pulumi.vault.SysConfigCorsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new SysConfigCors("example", SysConfigCorsArgs.builder()
            .allowedOrigins(            
                "http://www.example.com",
                "https://app.example.com")
            .allowedHeaders(            
                "X-Custom-Header",
                "X-Application-ID")
            .build());

    }
}

    resources:
  example:
    type: vault:SysConfigCors
    properties:
      allowedOrigins:
        - http://www.example.com
        - https://app.example.com
      allowedHeaders:
        - X-Custom-Header
        - X-Application-ID

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_sysconfigcors" "example" {
  allowed_origins = ["http://www.example.com", "https://app.example.com"]
  allowed_headers = ["X-Custom-Header", "X-Application-ID"]
}

    Allow all origins (wildcard)

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const wildcard = new vault.SysConfigCors("wildcard", {allowedOrigins: ["*"]});

    import pulumi
import pulumi_vault as vault

wildcard = vault.SysConfigCors("wildcard", allowed_origins=["*"])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vault.NewSysConfigCors(ctx, "wildcard", &vault.SysConfigCorsArgs{
			AllowedOrigins: pulumi.StringArray{
				pulumi.String("*"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var wildcard = new Vault.SysConfigCors("wildcard", new()
    {
        AllowedOrigins = new[]
        {
            "*",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.SysConfigCors;
import com.pulumi.vault.SysConfigCorsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var wildcard = new SysConfigCors("wildcard", SysConfigCorsArgs.builder()
            .allowedOrigins("*")
            .build());

    }
}

    resources:
  wildcard:
    type: vault:SysConfigCors
    properties:
      allowedOrigins:
        - '*'

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_sysconfigcors" "wildcard" {
  allowed_origins = ["*"]
}

    Production environment configuration

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const production = new vault.SysConfigCors("production", {
    allowedOrigins: [
        "https://app.example.com",
        "https://admin.example.com",
        "https://api.example.com",
    ],
    allowedHeaders: [
        "X-Custom-Header",
        "X-Request-ID",
        "X-Application-Version",
    ],
});

    import pulumi
import pulumi_vault as vault

production = vault.SysConfigCors("production",
    allowed_origins=[
        "https://app.example.com",
        "https://admin.example.com",
        "https://api.example.com",
    ],
    allowed_headers=[
        "X-Custom-Header",
        "X-Request-ID",
        "X-Application-Version",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vault.NewSysConfigCors(ctx, "production", &vault.SysConfigCorsArgs{
			AllowedOrigins: pulumi.StringArray{
				pulumi.String("https://app.example.com"),
				pulumi.String("https://admin.example.com"),
				pulumi.String("https://api.example.com"),
			},
			AllowedHeaders: pulumi.StringArray{
				pulumi.String("X-Custom-Header"),
				pulumi.String("X-Request-ID"),
				pulumi.String("X-Application-Version"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var production = new Vault.SysConfigCors("production", new()
    {
        AllowedOrigins = new[]
        {
            "https://app.example.com",
            "https://admin.example.com",
            "https://api.example.com",
        },
        AllowedHeaders = new[]
        {
            "X-Custom-Header",
            "X-Request-ID",
            "X-Application-Version",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.SysConfigCors;
import com.pulumi.vault.SysConfigCorsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var production = new SysConfigCors("production", SysConfigCorsArgs.builder()
            .allowedOrigins(            
                "https://app.example.com",
                "https://admin.example.com",
                "https://api.example.com")
            .allowedHeaders(            
                "X-Custom-Header",
                "X-Request-ID",
                "X-Application-Version")
            .build());

    }
}

    resources:
  production:
    type: vault:SysConfigCors
    properties:
      allowedOrigins:
        - https://app.example.com
        - https://admin.example.com
        - https://api.example.com
      allowedHeaders:
        - X-Custom-Header
        - X-Request-ID
        - X-Application-Version

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_sysconfigcors" "production" {
  allowed_origins = ["https://app.example.com", "https://admin.example.com", "https://api.example.com"]
  allowed_headers = ["X-Custom-Header", "X-Request-ID", "X-Application-Version"]
}

    Security Considerations

    • The wildcard "*" origin should be used cautiously and typically only in development environments
    • Allowing all origins in production can expose Vault to cross-site request forgery attacks
    • Custom headers should be carefully reviewed to ensure they don’t expose sensitive information
    • CORS settings must be configured from the root namespace
    • In Vault Enterprise with Performance Replication, CORS configuration does not replicate across clusters - each secondary cluster must have its CORS configuration set independently
    • To disable CORS, delete the resource using terraform destroy or remove it from your configuration. There is no enabled = false option

    API Documentation

    For more information on the Vault CORS configuration API, see the Vault API documentation.

    Create SysConfigCors Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SysConfigCors(name: string, args: SysConfigCorsArgs, opts?: CustomResourceOptions);
    @overload
def SysConfigCors(resource_name: str,
                  args: SysConfigCorsArgs,
                  opts: Optional[ResourceOptions] = None)

@overload
def SysConfigCors(resource_name: str,
                  opts: Optional[ResourceOptions] = None,
                  allowed_origins: Optional[Sequence[str]] = None,
                  allowed_headers: Optional[Sequence[str]] = None)
    func NewSysConfigCors(ctx *Context, name string, args SysConfigCorsArgs, opts ...ResourceOption) (*SysConfigCors, error)
    public SysConfigCors(string name, SysConfigCorsArgs args, CustomResourceOptions? opts = null)
    public SysConfigCors(String name, SysConfigCorsArgs args)
public SysConfigCors(String name, SysConfigCorsArgs args, CustomResourceOptions options)

    type: vault:SysConfigCors
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_sys_config_cors" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SysConfigCorsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SysConfigCorsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SysConfigCorsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SysConfigCorsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SysConfigCorsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var sysConfigCorsResource = new Vault.SysConfigCors("sysConfigCorsResource", new()
{
    AllowedOrigins = new[]
    {
        "string",
    },
    AllowedHeaders = new[]
    {
        "string",
    },
});

    example, err := vault.NewSysConfigCors(ctx, "sysConfigCorsResource", &vault.SysConfigCorsArgs{
	AllowedOrigins: pulumi.StringArray{
		pulumi.String("string"),
	},
	AllowedHeaders: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "vault_sys_config_cors" "sysConfigCorsResource" {
  lifecycle {
    create_before_destroy = true
  }
  allowed_origins = ["string"]
  allowed_headers = ["string"]
}

    var sysConfigCorsResource = new SysConfigCors("sysConfigCorsResource", SysConfigCorsArgs.builder()
    .allowedOrigins("string")
    .allowedHeaders("string")
    .build());

    sys_config_cors_resource = vault.SysConfigCors("sysConfigCorsResource",
    allowed_origins=["string"],
    allowed_headers=["string"])

    const sysConfigCorsResource = new vault.SysConfigCors("sysConfigCorsResource", {
    allowedOrigins: ["string"],
    allowedHeaders: ["string"],
});

    type: vault:SysConfigCors
properties:
    allowedHeaders:
        - string
    allowedOrigins:
        - string

    SysConfigCors Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SysConfigCors resource accepts the following input properties:

    AllowedOrigins List<string>
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    AllowedHeaders List<string>
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    AllowedOrigins []string
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    AllowedHeaders []string
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowed_origins list(string)
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    allowed_headers list(string)
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowedOrigins List<String>
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    allowedHeaders List<String>
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowedOrigins string[]
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    allowedHeaders string[]
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowed_origins Sequence[str]
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    allowed_headers Sequence[str]
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowedOrigins List<String>
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    allowedHeaders List<String>
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SysConfigCors resource produces the following output properties:

    Enabled bool
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    Id string
    The provider-assigned unique ID for this managed resource.
    Enabled bool
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    Id string
    The provider-assigned unique ID for this managed resource.
    enabled bool
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    id string
    The provider-assigned unique ID for this managed resource.
    enabled Boolean
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    id String
    The provider-assigned unique ID for this managed resource.
    enabled boolean
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    id string
    The provider-assigned unique ID for this managed resource.
    enabled bool
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    id str
    The provider-assigned unique ID for this managed resource.
    enabled Boolean
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing SysConfigCors Resource

    Get an existing SysConfigCors resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SysConfigCorsState, opts?: CustomResourceOptions): SysConfigCors
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        allowed_headers: Optional[Sequence[str]] = None,
        allowed_origins: Optional[Sequence[str]] = None,
        enabled: Optional[bool] = None) -> SysConfigCors
    func GetSysConfigCors(ctx *Context, name string, id IDInput, state *SysConfigCorsState, opts ...ResourceOption) (*SysConfigCors, error)
    public static SysConfigCors Get(string name, Input<string> id, SysConfigCorsState? state, CustomResourceOptions? opts = null)
    public static SysConfigCors get(String name, Output<String> id, SysConfigCorsState state, CustomResourceOptions options)
    resources:  _:    type: vault:SysConfigCors    get:      id: ${id}
    import {
  to = vault_sys_config_cors.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AllowedHeaders List<string>
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    AllowedOrigins List<string>
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    Enabled bool
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    AllowedHeaders []string
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    AllowedOrigins []string
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    Enabled bool
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    allowed_headers list(string)
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowed_origins list(string)
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    enabled bool
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    allowedHeaders List<String>
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowedOrigins List<String>
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    enabled Boolean
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    allowedHeaders string[]
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowedOrigins string[]
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    enabled boolean
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    allowed_headers Sequence[str]
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowed_origins Sequence[str]
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    enabled bool
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.
    allowedHeaders List<String>
    Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:

    • Content-Type
    • X-Requested-With
    • X-Vault-AWS-IAM-Server-ID
    • X-Vault-MFA
    • X-Vault-No-Request-Forwarding
    • X-Vault-Wrap-Format
    • X-Vault-Wrap-TTL
    • X-Vault-Policy-Override
    • Authorization
    • X-Vault-Token
    allowedOrigins List<String>
    Set of origins permitted to make cross-origin requests. Use "*" as the only value to allow all origins. Must contain at least one origin.
    enabled Boolean
    (Computed) Whether CORS is currently enabled. Vault automatically sets this to true when allowedOrigins is configured, and false when CORS is deleted.

    Import

    CORS configuration can be imported using the fixed ID sys/config/cors:

    $ pulumi import vault:index/sysConfigCors:SysConfigCors example sys/config/cors

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.11.1
    published on Tuesday, Aug 11, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial