vault.UserpassAuthBackendUser

HashiCorp Vault v7.11.1, Aug 11 26

Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-vault

Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-vault

API Behavior

This resource manages Userpass users via the POST /auth/<mount>/users/<username> endpoint for all create and update operations, including changes to passwords and token-related settings.

Example Usage

Password-Based User With Token Settings

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const userpass = new vault.AuthBackend("userpass", {
    type: "userpass",
    path: "userpass",
});
const user = new vault.UserpassAuthBackendUser("user", {
    mount: userpass.path,
    username: "example-user",
    passwordWo: "initial-password",
    passwordWoVersion: 1,
    tokenPolicies: [
        "default",
        "dev",
    ],
    tokenTtl: 3600,
    tokenMaxTtl: 7200,
});

import pulumi
import pulumi_vault as vault

userpass = vault.AuthBackend("userpass",
    type="userpass",
    path="userpass")
user = vault.UserpassAuthBackendUser("user",
    mount=userpass.path,
    username="example-user",
    password_wo="initial-password",
    password_wo_version=1,
    token_policies=[
        "default",
        "dev",
    ],
    token_ttl=3600,
    token_max_ttl=7200)

package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		userpass, err := vault.NewAuthBackend(ctx, "userpass", &vault.AuthBackendArgs{
			Type: pulumi.String("userpass"),
			Path: pulumi.String("userpass"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewUserpassAuthBackendUser(ctx, "user", &vault.UserpassAuthBackendUserArgs{
			Mount:             userpass.Path,
			Username:          pulumi.String("example-user"),
			PasswordWo:        pulumi.String("initial-password"),
			PasswordWoVersion: pulumi.Int(1),
			TokenPolicies: pulumi.StringArray{
				pulumi.String("default"),
				pulumi.String("dev"),
			},
			TokenTtl:    pulumi.Int(3600),
			TokenMaxTtl: pulumi.Int(7200),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var userpass = new Vault.AuthBackend("userpass", new()
    {
        Type = "userpass",
        Path = "userpass",
    });

    var user = new Vault.UserpassAuthBackendUser("user", new()
    {
        Mount = userpass.Path,
        Username = "example-user",
        PasswordWo = "initial-password",
        PasswordWoVersion = 1,
        TokenPolicies = new[]
        {
            "default",
            "dev",
        },
        TokenTtl = 3600,
        TokenMaxTtl = 7200,
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.UserpassAuthBackendUser;
import com.pulumi.vault.UserpassAuthBackendUserArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var userpass = new AuthBackend("userpass", AuthBackendArgs.builder()
            .type("userpass")
            .path("userpass")
            .build());

        var user = new UserpassAuthBackendUser("user", UserpassAuthBackendUserArgs.builder()
            .mount(userpass.path())
            .username("example-user")
            .passwordWo("initial-password")
            .passwordWoVersion(1)
            .tokenPolicies(            
                "default",
                "dev")
            .tokenTtl(3600)
            .tokenMaxTtl(7200)
            .build());

    }
}

resources:
  userpass:
    type: vault:AuthBackend
    properties:
      type: userpass
      path: userpass
  user:
    type: vault:UserpassAuthBackendUser
    properties:
      mount: ${userpass.path}
      username: example-user
      passwordWo: initial-password
      passwordWoVersion: 1
      tokenPolicies:
        - default
        - dev
      tokenTtl: 3600
      tokenMaxTtl: 7200

pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "userpass" {
  type = "userpass"
  path = "userpass"
}
resource "vault_userpassauthbackenduser" "user" {
  mount               = vault_authbackend.userpass.path
  username            = "example-user"
  password_wo         = "initial-password"
  password_wo_version = 1
  token_policies      = ["default", "dev"]
  token_ttl           = 3600
  token_max_ttl       = 7200
}

Bcrypt Password Hash User

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const userWithHash = new vault.UserpassAuthBackendUser("user_with_hash", {
    mount: userpass.path,
    username: "example-user-hash",
    passwordHashWo: "$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW",
    passwordHashWoVersion: 1,
    tokenPolicies: [
        "default",
        "dev",
    ],
    tokenTtl: 3600,
    tokenMaxTtl: 7200,
});

import pulumi
import pulumi_vault as vault

user_with_hash = vault.UserpassAuthBackendUser("user_with_hash",
    mount=userpass["path"],
    username="example-user-hash",
    password_hash_wo="$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW",
    password_hash_wo_version=1,
    token_policies=[
        "default",
        "dev",
    ],
    token_ttl=3600,
    token_max_ttl=7200)

package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vault.NewUserpassAuthBackendUser(ctx, "user_with_hash", &vault.UserpassAuthBackendUserArgs{
			Mount:                 pulumi.Any(userpass.Path),
			Username:              pulumi.String("example-user-hash"),
			PasswordHashWo:        pulumi.String("$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW"),
			PasswordHashWoVersion: pulumi.Int(1),
			TokenPolicies: pulumi.StringArray{
				pulumi.String("default"),
				pulumi.String("dev"),
			},
			TokenTtl:    pulumi.Int(3600),
			TokenMaxTtl: pulumi.Int(7200),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var userWithHash = new Vault.UserpassAuthBackendUser("user_with_hash", new()
    {
        Mount = userpass.Path,
        Username = "example-user-hash",
        PasswordHashWo = "$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW",
        PasswordHashWoVersion = 1,
        TokenPolicies = new[]
        {
            "default",
            "dev",
        },
        TokenTtl = 3600,
        TokenMaxTtl = 7200,
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.UserpassAuthBackendUser;
import com.pulumi.vault.UserpassAuthBackendUserArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var userWithHash = new UserpassAuthBackendUser("userWithHash", UserpassAuthBackendUserArgs.builder()
            .mount(userpass.path())
            .username("example-user-hash")
            .passwordHashWo("$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW")
            .passwordHashWoVersion(1)
            .tokenPolicies(            
                "default",
                "dev")
            .tokenTtl(3600)
            .tokenMaxTtl(7200)
            .build());

    }
}

resources:
  userWithHash:
    type: vault:UserpassAuthBackendUser
    name: user_with_hash
    properties:
      mount: ${userpass.path}
      username: example-user-hash
      passwordHashWo: $2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW
      passwordHashWoVersion: 1
      tokenPolicies:
        - default
        - dev
      tokenTtl: 3600
      tokenMaxTtl: 7200

pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_userpassauthbackenduser" "user_with_hash" {
  mount                    = userpass.path
  username                 = "example-user-hash"
  password_hash_wo         = "$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW"
  password_hash_wo_version = 1
  token_policies           = ["default", "dev"]
  token_ttl                = 3600
  token_max_ttl            = 7200
}

Namespaced User (Vault Enterprise)

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const test = new vault.Namespace("test", {path: "ns-team-a"});
const userpassNs = new vault.AuthBackend("userpass_ns", {
    type: "userpass",
    path: "userpass-ns",
    namespace: test.path,
});
const userNamespaced = new vault.UserpassAuthBackendUser("user_namespaced", {
    namespace: test.path,
    mount: userpassNs.path,
    username: "example-user-ns",
    passwordWo: "initial-password",
});

import pulumi
import pulumi_vault as vault

test = vault.Namespace("test", path="ns-team-a")
userpass_ns = vault.AuthBackend("userpass_ns",
    type="userpass",
    path="userpass-ns",
    namespace=test.path)
user_namespaced = vault.UserpassAuthBackendUser("user_namespaced",
    namespace=test.path,
    mount=userpass_ns.path,
    username="example-user-ns",
    password_wo="initial-password")

package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		test, err := vault.NewNamespace(ctx, "test", &vault.NamespaceArgs{
			Path: pulumi.String("ns-team-a"),
		})
		if err != nil {
			return err
		}
		userpassNs, err := vault.NewAuthBackend(ctx, "userpass_ns", &vault.AuthBackendArgs{
			Type:      pulumi.String("userpass"),
			Path:      pulumi.String("userpass-ns"),
			Namespace: test.Path,
		})
		if err != nil {
			return err
		}
		_, err = vault.NewUserpassAuthBackendUser(ctx, "user_namespaced", &vault.UserpassAuthBackendUserArgs{
			Namespace:  test.Path,
			Mount:      userpassNs.Path,
			Username:   pulumi.String("example-user-ns"),
			PasswordWo: pulumi.String("initial-password"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var test = new Vault.Namespace("test", new()
    {
        Path = "ns-team-a",
    });

    var userpassNs = new Vault.AuthBackend("userpass_ns", new()
    {
        Type = "userpass",
        Path = "userpass-ns",
        Namespace = test.Path,
    });

    var userNamespaced = new Vault.UserpassAuthBackendUser("user_namespaced", new()
    {
        Namespace = test.Path,
        Mount = userpassNs.Path,
        Username = "example-user-ns",
        PasswordWo = "initial-password",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Namespace;
import com.pulumi.vault.NamespaceArgs;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.UserpassAuthBackendUser;
import com.pulumi.vault.UserpassAuthBackendUserArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var test = new Namespace("test", NamespaceArgs.builder()
            .path("ns-team-a")
            .build());

        var userpassNs = new AuthBackend("userpassNs", AuthBackendArgs.builder()
            .type("userpass")
            .path("userpass-ns")
            .namespace(test.path())
            .build());

        var userNamespaced = new UserpassAuthBackendUser("userNamespaced", UserpassAuthBackendUserArgs.builder()
            .namespace(test.path())
            .mount(userpassNs.path())
            .username("example-user-ns")
            .passwordWo("initial-password")
            .build());

    }
}

resources:
  test:
    type: vault:Namespace
    properties:
      path: ns-team-a
  userpassNs:
    type: vault:AuthBackend
    name: userpass_ns
    properties:
      type: userpass
      path: userpass-ns
      namespace: ${test.path}
  userNamespaced:
    type: vault:UserpassAuthBackendUser
    name: user_namespaced
    properties:
      namespace: ${test.path}
      mount: ${userpassNs.path}
      username: example-user-ns
      passwordWo: initial-password

pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_namespace" "test" {
  path = "ns-team-a"
}
resource "vault_authbackend" "userpass_ns" {
  type      = "userpass"
  path      = "userpass-ns"
  namespace = vault_namespace.test.path
}
resource "vault_userpassauthbackenduser" "user_namespaced" {
  namespace   = vault_namespace.test.path
  mount       = vault_authbackend.userpass_ns.path
  username    = "example-user-ns"
  password_wo = "initial-password"
}

Invalid Configuration Examples (Do Not Apply)

import * as pulumi from "@pulumi/pulumi";

import pulumi

package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;

return await Deployment.RunAsync(() => 
{
});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
    }
}

{}

Example coming soon!

Create UserpassAuthBackendUser Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new UserpassAuthBackendUser(name: string, args: UserpassAuthBackendUserArgs, opts?: CustomResourceOptions);

@overload
def UserpassAuthBackendUser(resource_name: str,
                            args: UserpassAuthBackendUserArgs,
                            opts: Optional[ResourceOptions] = None)

@overload
def UserpassAuthBackendUser(resource_name: str,
                            opts: Optional[ResourceOptions] = None,
                            username: Optional[str] = None,
                            mount: Optional[str] = None,
                            token_explicit_max_ttl: Optional[int] = None,
                            token_max_ttl: Optional[int] = None,
                            password_hash_wo_version: Optional[int] = None,
                            password_wo: Optional[str] = None,
                            password_wo_version: Optional[int] = None,
                            token_bound_cidrs: Optional[Sequence[str]] = None,
                            alias_metadata: Optional[Mapping[str, str]] = None,
                            password_hash_wo: Optional[str] = None,
                            token_no_default_policy: Optional[bool] = None,
                            token_num_uses: Optional[int] = None,
                            token_period: Optional[int] = None,
                            token_policies: Optional[Sequence[str]] = None,
                            token_ttl: Optional[int] = None,
                            token_type: Optional[str] = None,
                            namespace: Optional[str] = None)

func NewUserpassAuthBackendUser(ctx *Context, name string, args UserpassAuthBackendUserArgs, opts ...ResourceOption) (*UserpassAuthBackendUser, error)

public UserpassAuthBackendUser(string name, UserpassAuthBackendUserArgs args, CustomResourceOptions? opts = null)

public UserpassAuthBackendUser(String name, UserpassAuthBackendUserArgs args)
public UserpassAuthBackendUser(String name, UserpassAuthBackendUserArgs args, CustomResourceOptions options)

type: vault:UserpassAuthBackendUser
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

resource "vault_userpass_auth_backend_user" "name" {
    # resource properties
}

Parameters

name string: The unique name of the resource.
args UserpassAuthBackendUserArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args UserpassAuthBackendUserArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args UserpassAuthBackendUserArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args UserpassAuthBackendUserArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args UserpassAuthBackendUserArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var userpassAuthBackendUserResource = new Vault.UserpassAuthBackendUser("userpassAuthBackendUserResource", new()
{
    Username = "string",
    Mount = "string",
    TokenExplicitMaxTtl = 0,
    TokenMaxTtl = 0,
    PasswordHashWoVersion = 0,
    PasswordWo = "string",
    PasswordWoVersion = 0,
    TokenBoundCidrs = new[]
    {
        "string",
    },
    AliasMetadata = 
    {
        { "string", "string" },
    },
    PasswordHashWo = "string",
    TokenNoDefaultPolicy = false,
    TokenNumUses = 0,
    TokenPeriod = 0,
    TokenPolicies = new[]
    {
        "string",
    },
    TokenTtl = 0,
    TokenType = "string",
    Namespace = "string",
});

example, err := vault.NewUserpassAuthBackendUser(ctx, "userpassAuthBackendUserResource", &vault.UserpassAuthBackendUserArgs{
	Username:              pulumi.String("string"),
	Mount:                 pulumi.String("string"),
	TokenExplicitMaxTtl:   pulumi.Int(0),
	TokenMaxTtl:           pulumi.Int(0),
	PasswordHashWoVersion: pulumi.Int(0),
	PasswordWo:            pulumi.String("string"),
	PasswordWoVersion:     pulumi.Int(0),
	TokenBoundCidrs: pulumi.StringArray{
		pulumi.String("string"),
	},
	AliasMetadata: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	PasswordHashWo:       pulumi.String("string"),
	TokenNoDefaultPolicy: pulumi.Bool(false),
	TokenNumUses:         pulumi.Int(0),
	TokenPeriod:          pulumi.Int(0),
	TokenPolicies: pulumi.StringArray{
		pulumi.String("string"),
	},
	TokenTtl:  pulumi.Int(0),
	TokenType: pulumi.String("string"),
	Namespace: pulumi.String("string"),
})

resource "vault_userpass_auth_backend_user" "userpassAuthBackendUserResource" {
  lifecycle {
    create_before_destroy = true
  }
  username                 = "string"
  mount                    = "string"
  token_explicit_max_ttl   = 0
  token_max_ttl            = 0
  password_hash_wo_version = 0
  password_wo              = "string"
  password_wo_version      = 0
  token_bound_cidrs        = ["string"]
  alias_metadata = {
    "string" = "string"
  }
  password_hash_wo        = "string"
  token_no_default_policy = false
  token_num_uses          = 0
  token_period            = 0
  token_policies          = ["string"]
  token_ttl               = 0
  token_type              = "string"
  namespace               = "string"
}

var userpassAuthBackendUserResource = new UserpassAuthBackendUser("userpassAuthBackendUserResource", UserpassAuthBackendUserArgs.builder()
    .username("string")
    .mount("string")
    .tokenExplicitMaxTtl(0)
    .tokenMaxTtl(0)
    .passwordHashWoVersion(0)
    .passwordWo("string")
    .passwordWoVersion(0)
    .tokenBoundCidrs("string")
    .aliasMetadata(Map.of("string", "string"))
    .passwordHashWo("string")
    .tokenNoDefaultPolicy(false)
    .tokenNumUses(0)
    .tokenPeriod(0)
    .tokenPolicies("string")
    .tokenTtl(0)
    .tokenType("string")
    .namespace("string")
    .build());

userpass_auth_backend_user_resource = vault.UserpassAuthBackendUser("userpassAuthBackendUserResource",
    username="string",
    mount="string",
    token_explicit_max_ttl=0,
    token_max_ttl=0,
    password_hash_wo_version=0,
    password_wo="string",
    password_wo_version=0,
    token_bound_cidrs=["string"],
    alias_metadata={
        "string": "string",
    },
    password_hash_wo="string",
    token_no_default_policy=False,
    token_num_uses=0,
    token_period=0,
    token_policies=["string"],
    token_ttl=0,
    token_type="string",
    namespace="string")

const userpassAuthBackendUserResource = new vault.UserpassAuthBackendUser("userpassAuthBackendUserResource", {
    username: "string",
    mount: "string",
    tokenExplicitMaxTtl: 0,
    tokenMaxTtl: 0,
    passwordHashWoVersion: 0,
    passwordWo: "string",
    passwordWoVersion: 0,
    tokenBoundCidrs: ["string"],
    aliasMetadata: {
        string: "string",
    },
    passwordHashWo: "string",
    tokenNoDefaultPolicy: false,
    tokenNumUses: 0,
    tokenPeriod: 0,
    tokenPolicies: ["string"],
    tokenTtl: 0,
    tokenType: "string",
    namespace: "string",
});

type: vault:UserpassAuthBackendUser
properties:
    aliasMetadata:
        string: string
    mount: string
    namespace: string
    passwordHashWo: string
    passwordHashWoVersion: 0
    passwordWo: string
    passwordWoVersion: 0
    tokenBoundCidrs:
        - string
    tokenExplicitMaxTtl: 0
    tokenMaxTtl: 0
    tokenNoDefaultPolicy: false
    tokenNumUses: 0
    tokenPeriod: 0
    tokenPolicies:
        - string
    tokenTtl: 0
    tokenType: string
    username: string

UserpassAuthBackendUser Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The UserpassAuthBackendUser resource accepts the following input properties:

Mount string

Mount path for the Userpass auth engine in Vault.

Username string

Username for this Userpass user.

AliasMetadata Dictionary<string, string>

A map of string to string that will be set as metadata on the identity alias

Namespace string

The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

PasswordHashWo string

NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-hashed password for this user in bcrypt format.Mutually exclusive with passwordWo. Available in Vault 1.17 and later.

PasswordHashWoVersion int

Version counter for the passwordHashWo field. Since write-only values are not stored in state, Terraform cannot detect when the password hash changes. Increment this value whenever you update passwordHashWo to ensure the new password hash is sent to Vault.Must be used with passwordHashWo.

Exactly one of passwordWo or passwordHashWo must be specified.

PasswordWo string

NOTE: This field is write-only and its value will not be updated in state as part of read operations. Password for this user. This value is never read back from Vault or stored in Terraform state.

PasswordWoVersion int

Version counter for the passwordWo field. Since write-only values are not stored in state, Terraform cannot detect when the password changes. Increment this value whenever you update passwordWo to ensure the new password is sent to Vault. Must be used with passwordWo.

TokenBoundCidrs List<string>

Specifies the blocks of IP addresses which are allowed to use the generated token

TokenExplicitMaxTtl int

Generated Token's Explicit Maximum TTL in seconds

TokenMaxTtl int

The maximum lifetime of the generated token

TokenNoDefaultPolicy bool

If true, the 'default' policy will not automatically be added to generated tokens

TokenNumUses int

The maximum number of times a token may be used, a value of zero means unlimited

TokenPeriod int

Generated Token's Period

TokenPolicies List<string>

Generated Token's Policies

TokenTtl int

The initial ttl of the token to generate in seconds

TokenType string

The type of token to generate, service or batch

Mount string

Mount path for the Userpass auth engine in Vault.

Username string

Username for this Userpass user.

AliasMetadata map[string]string

A map of string to string that will be set as metadata on the identity alias

Namespace string

PasswordHashWo string

PasswordHashWoVersion int

Exactly one of passwordWo or passwordHashWo must be specified.

PasswordWo string

PasswordWoVersion int

TokenBoundCidrs []string

Specifies the blocks of IP addresses which are allowed to use the generated token

TokenExplicitMaxTtl int

Generated Token's Explicit Maximum TTL in seconds

TokenMaxTtl int

The maximum lifetime of the generated token

TokenNoDefaultPolicy bool

If true, the 'default' policy will not automatically be added to generated tokens

TokenNumUses int

The maximum number of times a token may be used, a value of zero means unlimited

TokenPeriod int

Generated Token's Period

TokenPolicies []string

Generated Token's Policies

TokenTtl int

The initial ttl of the token to generate in seconds

TokenType string

The type of token to generate, service or batch

mount string

Mount path for the Userpass auth engine in Vault.

username string

Username for this Userpass user.

alias_metadata map(string)

A map of string to string that will be set as metadata on the identity alias

namespace string

password_hash_wo string

password_hash_wo_version number

Exactly one of passwordWo or passwordHashWo must be specified.

password_wo string

password_wo_version number

token_bound_cidrs list(string)

Specifies the blocks of IP addresses which are allowed to use the generated token

token_explicit_max_ttl number

Generated Token's Explicit Maximum TTL in seconds

token_max_ttl number

The maximum lifetime of the generated token

token_no_default_policy bool

If true, the 'default' policy will not automatically be added to generated tokens

token_num_uses number

The maximum number of times a token may be used, a value of zero means unlimited

token_period number

Generated Token's Period

token_policies list(string)

Generated Token's Policies

token_ttl number

The initial ttl of the token to generate in seconds

token_type string

The type of token to generate, service or batch

mount String

Mount path for the Userpass auth engine in Vault.

username String

Username for this Userpass user.

aliasMetadata Map<String,String>

A map of string to string that will be set as metadata on the identity alias

namespace String

passwordHashWo String

passwordHashWoVersion Integer

Exactly one of passwordWo or passwordHashWo must be specified.

passwordWo String

passwordWoVersion Integer

tokenBoundCidrs List<String>

Specifies the blocks of IP addresses which are allowed to use the generated token

tokenExplicitMaxTtl Integer

Generated Token's Explicit Maximum TTL in seconds

tokenMaxTtl Integer

The maximum lifetime of the generated token

tokenNoDefaultPolicy Boolean

If true, the 'default' policy will not automatically be added to generated tokens

tokenNumUses Integer

The maximum number of times a token may be used, a value of zero means unlimited

tokenPeriod Integer

Generated Token's Period

tokenPolicies List<String>

Generated Token's Policies

tokenTtl Integer

The initial ttl of the token to generate in seconds

tokenType String

The type of token to generate, service or batch

mount string

Mount path for the Userpass auth engine in Vault.

username string

Username for this Userpass user.

aliasMetadata {[key: string]: string}

A map of string to string that will be set as metadata on the identity alias

namespace string

passwordHashWo string

passwordHashWoVersion number

Exactly one of passwordWo or passwordHashWo must be specified.

passwordWo string

passwordWoVersion number

tokenBoundCidrs string[]

Specifies the blocks of IP addresses which are allowed to use the generated token

tokenExplicitMaxTtl number

Generated Token's Explicit Maximum TTL in seconds

tokenMaxTtl number

The maximum lifetime of the generated token

tokenNoDefaultPolicy boolean

If true, the 'default' policy will not automatically be added to generated tokens

tokenNumUses number

The maximum number of times a token may be used, a value of zero means unlimited

tokenPeriod number

Generated Token's Period

tokenPolicies string[]

Generated Token's Policies

tokenTtl number

The initial ttl of the token to generate in seconds

tokenType string

The type of token to generate, service or batch

mount str

Mount path for the Userpass auth engine in Vault.

username str

Username for this Userpass user.

alias_metadata Mapping[str, str]

A map of string to string that will be set as metadata on the identity alias

namespace str

password_hash_wo str

password_hash_wo_version int

Exactly one of passwordWo or passwordHashWo must be specified.

password_wo str

password_wo_version int

token_bound_cidrs Sequence[str]

Specifies the blocks of IP addresses which are allowed to use the generated token

token_explicit_max_ttl int

Generated Token's Explicit Maximum TTL in seconds

token_max_ttl int

The maximum lifetime of the generated token

token_no_default_policy bool

If true, the 'default' policy will not automatically be added to generated tokens

token_num_uses int

The maximum number of times a token may be used, a value of zero means unlimited

token_period int

Generated Token's Period

token_policies Sequence[str]

Generated Token's Policies

token_ttl int

The initial ttl of the token to generate in seconds

token_type str

The type of token to generate, service or batch

mount String

Mount path for the Userpass auth engine in Vault.

username String

Username for this Userpass user.

aliasMetadata Map<String>

A map of string to string that will be set as metadata on the identity alias

namespace String

passwordHashWo String

passwordHashWoVersion Number

Exactly one of passwordWo or passwordHashWo must be specified.

passwordWo String

passwordWoVersion Number

tokenBoundCidrs List<String>

Specifies the blocks of IP addresses which are allowed to use the generated token

tokenExplicitMaxTtl Number

Generated Token's Explicit Maximum TTL in seconds

tokenMaxTtl Number

The maximum lifetime of the generated token

tokenNoDefaultPolicy Boolean

If true, the 'default' policy will not automatically be added to generated tokens

tokenNumUses Number

The maximum number of times a token may be used, a value of zero means unlimited

tokenPeriod Number

Generated Token's Period

tokenPolicies List<String>

Generated Token's Policies

tokenTtl Number

The initial ttl of the token to generate in seconds

tokenType String

The type of token to generate, service or batch

Outputs

All input properties are implicitly available as output properties. Additionally, the UserpassAuthBackendUser resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing UserpassAuthBackendUser Resource

Get an existing UserpassAuthBackendUser resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: UserpassAuthBackendUserState, opts?: CustomResourceOptions): UserpassAuthBackendUser

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        alias_metadata: Optional[Mapping[str, str]] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        password_hash_wo: Optional[str] = None,
        password_hash_wo_version: Optional[int] = None,
        password_wo: Optional[str] = None,
        password_wo_version: Optional[int] = None,
        token_bound_cidrs: Optional[Sequence[str]] = None,
        token_explicit_max_ttl: Optional[int] = None,
        token_max_ttl: Optional[int] = None,
        token_no_default_policy: Optional[bool] = None,
        token_num_uses: Optional[int] = None,
        token_period: Optional[int] = None,
        token_policies: Optional[Sequence[str]] = None,
        token_ttl: Optional[int] = None,
        token_type: Optional[str] = None,
        username: Optional[str] = None) -> UserpassAuthBackendUser

func GetUserpassAuthBackendUser(ctx *Context, name string, id IDInput, state *UserpassAuthBackendUserState, opts ...ResourceOption) (*UserpassAuthBackendUser, error)

public static UserpassAuthBackendUser Get(string name, Input<string> id, UserpassAuthBackendUserState? state, CustomResourceOptions? opts = null)

public static UserpassAuthBackendUser get(String name, Output<String> id, UserpassAuthBackendUserState state, CustomResourceOptions options)

resources:  _:    type: vault:UserpassAuthBackendUser    get:      id: ${id}

import {
  to = vault_userpass_auth_backend_user.example
  id = "${id}"
}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AliasMetadata Dictionary<string, string>

A map of string to string that will be set as metadata on the identity alias

Mount string

Mount path for the Userpass auth engine in Vault.

Namespace string

PasswordHashWo string

PasswordHashWoVersion int

Exactly one of passwordWo or passwordHashWo must be specified.

PasswordWo string

PasswordWoVersion int

TokenBoundCidrs List<string>

Specifies the blocks of IP addresses which are allowed to use the generated token

TokenExplicitMaxTtl int

Generated Token's Explicit Maximum TTL in seconds

TokenMaxTtl int

The maximum lifetime of the generated token

TokenNoDefaultPolicy bool

If true, the 'default' policy will not automatically be added to generated tokens

TokenNumUses int

The maximum number of times a token may be used, a value of zero means unlimited

TokenPeriod int

Generated Token's Period

TokenPolicies List<string>

Generated Token's Policies

TokenTtl int

The initial ttl of the token to generate in seconds

TokenType string

The type of token to generate, service or batch

Username string

Username for this Userpass user.

AliasMetadata map[string]string

A map of string to string that will be set as metadata on the identity alias

Mount string

Mount path for the Userpass auth engine in Vault.

Namespace string

PasswordHashWo string

PasswordHashWoVersion int

Exactly one of passwordWo or passwordHashWo must be specified.

PasswordWo string

PasswordWoVersion int

TokenBoundCidrs []string

Specifies the blocks of IP addresses which are allowed to use the generated token

TokenExplicitMaxTtl int

Generated Token's Explicit Maximum TTL in seconds

TokenMaxTtl int

The maximum lifetime of the generated token

TokenNoDefaultPolicy bool

If true, the 'default' policy will not automatically be added to generated tokens

TokenNumUses int

The maximum number of times a token may be used, a value of zero means unlimited

TokenPeriod int

Generated Token's Period

TokenPolicies []string

Generated Token's Policies

TokenTtl int

The initial ttl of the token to generate in seconds

TokenType string

The type of token to generate, service or batch

Username string

Username for this Userpass user.

alias_metadata map(string)

A map of string to string that will be set as metadata on the identity alias

mount string

Mount path for the Userpass auth engine in Vault.

namespace string

password_hash_wo string

password_hash_wo_version number

Exactly one of passwordWo or passwordHashWo must be specified.

password_wo string

password_wo_version number

token_bound_cidrs list(string)

Specifies the blocks of IP addresses which are allowed to use the generated token

token_explicit_max_ttl number

Generated Token's Explicit Maximum TTL in seconds

token_max_ttl number

The maximum lifetime of the generated token

token_no_default_policy bool

If true, the 'default' policy will not automatically be added to generated tokens

token_num_uses number

The maximum number of times a token may be used, a value of zero means unlimited

token_period number

Generated Token's Period

token_policies list(string)

Generated Token's Policies

token_ttl number

The initial ttl of the token to generate in seconds

token_type string

The type of token to generate, service or batch

username string

Username for this Userpass user.

aliasMetadata Map<String,String>

A map of string to string that will be set as metadata on the identity alias

mount String

Mount path for the Userpass auth engine in Vault.

namespace String

passwordHashWo String

passwordHashWoVersion Integer

Exactly one of passwordWo or passwordHashWo must be specified.

passwordWo String

passwordWoVersion Integer

tokenBoundCidrs List<String>

Specifies the blocks of IP addresses which are allowed to use the generated token

tokenExplicitMaxTtl Integer

Generated Token's Explicit Maximum TTL in seconds

tokenMaxTtl Integer

The maximum lifetime of the generated token

tokenNoDefaultPolicy Boolean

If true, the 'default' policy will not automatically be added to generated tokens

tokenNumUses Integer

The maximum number of times a token may be used, a value of zero means unlimited

tokenPeriod Integer

Generated Token's Period

tokenPolicies List<String>

Generated Token's Policies

tokenTtl Integer

The initial ttl of the token to generate in seconds

tokenType String

The type of token to generate, service or batch

username String

Username for this Userpass user.

aliasMetadata {[key: string]: string}

A map of string to string that will be set as metadata on the identity alias

mount string

Mount path for the Userpass auth engine in Vault.

namespace string

passwordHashWo string

passwordHashWoVersion number

Exactly one of passwordWo or passwordHashWo must be specified.

passwordWo string

passwordWoVersion number

tokenBoundCidrs string[]

Specifies the blocks of IP addresses which are allowed to use the generated token

tokenExplicitMaxTtl number

Generated Token's Explicit Maximum TTL in seconds

tokenMaxTtl number

The maximum lifetime of the generated token

tokenNoDefaultPolicy boolean

If true, the 'default' policy will not automatically be added to generated tokens

tokenNumUses number

The maximum number of times a token may be used, a value of zero means unlimited

tokenPeriod number

Generated Token's Period

tokenPolicies string[]

Generated Token's Policies

tokenTtl number

The initial ttl of the token to generate in seconds

tokenType string

The type of token to generate, service or batch

username string

Username for this Userpass user.

alias_metadata Mapping[str, str]

A map of string to string that will be set as metadata on the identity alias

mount str

Mount path for the Userpass auth engine in Vault.

namespace str

password_hash_wo str

password_hash_wo_version int

Exactly one of passwordWo or passwordHashWo must be specified.

password_wo str

password_wo_version int

token_bound_cidrs Sequence[str]

Specifies the blocks of IP addresses which are allowed to use the generated token

token_explicit_max_ttl int

Generated Token's Explicit Maximum TTL in seconds

token_max_ttl int

The maximum lifetime of the generated token

token_no_default_policy bool

If true, the 'default' policy will not automatically be added to generated tokens

token_num_uses int

The maximum number of times a token may be used, a value of zero means unlimited

token_period int

Generated Token's Period

token_policies Sequence[str]

Generated Token's Policies

token_ttl int

The initial ttl of the token to generate in seconds

token_type str

The type of token to generate, service or batch

username str

Username for this Userpass user.

aliasMetadata Map<String>

A map of string to string that will be set as metadata on the identity alias

mount String

Mount path for the Userpass auth engine in Vault.

namespace String

passwordHashWo String

passwordHashWoVersion Number

Exactly one of passwordWo or passwordHashWo must be specified.

passwordWo String

passwordWoVersion Number

tokenBoundCidrs List<String>

Specifies the blocks of IP addresses which are allowed to use the generated token

tokenExplicitMaxTtl Number

Generated Token's Explicit Maximum TTL in seconds

tokenMaxTtl Number

The maximum lifetime of the generated token

tokenNoDefaultPolicy Boolean

If true, the 'default' policy will not automatically be added to generated tokens

tokenNumUses Number

The maximum number of times a token may be used, a value of zero means unlimited

tokenPeriod Number

Generated Token's Period

tokenPolicies List<String>

Generated Token's Policies

tokenTtl Number

The initial ttl of the token to generate in seconds

tokenType String

The type of token to generate, service or batch

username String

Username for this Userpass user.

Import

Userpass auth backend users can be imported using the path, e.g.

$ pulumi import vault:index/userpassAuthBackendUser:UserpassAuthBackendUser user auth/userpass/users/example-user

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: Vault pulumi/pulumi-vault
License: Apache-2.0
Notes: This Pulumi package is based on the vault Terraform Provider.

Viewing docs for HashiCorp Vault v7.11.1
published on Tuesday, Aug 11, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-vault

vault.UserpassAuthBackendUser

On this page

On this page

API Behavior

Example Usage

Password-Based User With Token Settings

Bcrypt Password Hash User

Namespaced User (Vault Enterprise)

Invalid Configuration Examples (Do Not Apply)

Create UserpassAuthBackendUser Resource

Constructor syntax

Parameters

Constructor example

UserpassAuthBackendUser Resource Properties

Inputs

Outputs

Look up Existing UserpassAuthBackendUser Resource

Import

Package Details

On this page

On this page

Try Pulumi Cloud free.
Your team will thank you.

vault.UserpassAuthBackendUser

On this page

On this page

API Behavior

Example Usage

Password-Based User With Token Settings

Bcrypt Password Hash User

Namespaced User (Vault Enterprise)

Invalid Configuration Examples (Do Not Apply)

Create UserpassAuthBackendUser Resource

Constructor syntax

Parameters

Constructor example

UserpassAuthBackendUser Resource Properties

Inputs

Outputs

Look up Existing UserpassAuthBackendUser Resource

Import

Package Details

On this page

On this page

Try Pulumi Cloud free.Your team will thank you.

Try Pulumi Cloud free.
Your team will thank you.