{ "name": "vault", "displayName": "HashiCorp Vault", "description": "A Pulumi package for creating and managing HashiCorp Vault cloud resources.", "keywords": [ "pulumi", "vault" ], "homepage": "https://pulumi.io", "license": "Apache-2.0", "attribution": "This Pulumi package is based on the [`vault` Terraform Provider](https://github.com/hashicorp/terraform-provider-vault).", "repository": "https://github.com/pulumi/pulumi-vault", "meta": { "moduleFormat": "(.*)(?:/[^/]*)" }, "language": { "csharp": { "packageReferences": { "Pulumi": "3.*" }, "namespaces": { "ad": "AD", "alicloud": "AliCloud", "appRole": "AppRole", "aws": "Aws", "azure": "Azure", "cf": "Cf", "config": "Config", "consul": "Consul", "database": "Database", "gcp": "Gcp", "generic": "Generic", "github": "GitHub", "identity": "Identity", "index": "index", "jwt": "Jwt", "keymgmt": "KeyMgmt", "kmip": "Kmip", "kubernetes": "Kubernetes", "kv": "kv", "ldap": "Ldap", "managed": "Managed", "mongodbatlas": "MongoDBAtlas", "okta": "Okta", "os": "Os", "pkiSecret": "PkiSecret", "pkiexternalca": "PkiExternalCa", "rabbitMq": "RabbitMQ", "radius": "Radius", "saml": "Saml", "secrets": "Secrets", "spiffe": "Spiffe", "ssh": "Ssh", "terraformcloud": "TerraformCloud", "tokenauth": "TokenAuth", "transform": "Transform", "transit": "Transit", "vault": "Vault" }, "compatibility": "tfbridge20", "respectSchemaVersion": true }, "go": { "importBasePath": "github.com/pulumi/pulumi-vault/sdk/v7/go/vault", "generateResourceContainerTypes": true, "generateExtraInputTypes": true, "respectSchemaVersion": true }, "nodejs": { "packageDescription": "A Pulumi package for creating and managing HashiCorp Vault cloud resources.", "readme": "\u003e This provider is a derived work of the [Terraform Provider](https://github.com/hashicorp/terraform-provider-vault)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-vault` repo](https://github.com/pulumi/pulumi-vault/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-vault` repo](https://github.com/hashicorp/terraform-provider-vault/issues).", "devDependencies": { "@types/mime": "^2.0.0", "@types/node": "^10.0.0" }, "compatibility": "tfbridge20", "disableUnionOutputTypes": true, "respectSchemaVersion": true }, "python": { "readme": "\u003e This provider is a derived work of the [Terraform Provider](https://github.com/hashicorp/terraform-provider-vault)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-vault` repo](https://github.com/pulumi/pulumi-vault/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-vault` repo](https://github.com/hashicorp/terraform-provider-vault/issues).", "compatibility": "tfbridge20", "respectSchemaVersion": true, "pyproject": { "enabled": true } } }, "config": { "variables": { "addAddressToEnv": { "type": "string", "description": "If true, adds the value of the \u003cspan pulumi-lang-nodejs=\"`address`\" pulumi-lang-dotnet=\"`Address`\" pulumi-lang-go=\"`address`\" pulumi-lang-python=\"`address`\" pulumi-lang-yaml=\"`address`\" pulumi-lang-java=\"`address`\" pulumi-lang-hcl=\"`address`\"\u003e`address`\u003c/span\u003e argument to the Terraform process environment." }, "address": { "type": "string", "description": "URL of the root of the target Vault server." }, "authLogin": { "$ref": "#/types/vault:config/authLogin:authLogin", "description": "Login to vault with an existing auth method using auth/\u003cmount\u003e/login" }, "authLoginAws": { "$ref": "#/types/vault:config/authLoginAws:authLoginAws", "description": "Login to vault using the AWS method" }, "authLoginAzure": { "$ref": "#/types/vault:config/authLoginAzure:authLoginAzure", "description": "Login to vault using the azure method" }, "authLoginCert": { "$ref": "#/types/vault:config/authLoginCert:authLoginCert", "description": "Login to vault using the cert method" }, "authLoginGcp": { "$ref": "#/types/vault:config/authLoginGcp:authLoginGcp", "description": "Login to vault using the gcp method" }, "authLoginJwt": { "$ref": "#/types/vault:config/authLoginJwt:authLoginJwt", "description": "Login to vault using the jwt method" }, "authLoginKerberos": { "$ref": "#/types/vault:config/authLoginKerberos:authLoginKerberos", "description": "Login to vault using the kerberos method" }, "authLoginOci": { "$ref": "#/types/vault:config/authLoginOci:authLoginOci", "description": "Login to vault using the OCI method" }, "authLoginOidc": { "$ref": "#/types/vault:config/authLoginOidc:authLoginOidc", "description": "Login to vault using the oidc method" }, "authLoginRadius": { "$ref": "#/types/vault:config/authLoginRadius:authLoginRadius", "description": "Login to vault using the radius method" }, "authLoginTokenFile": { "$ref": "#/types/vault:config/authLoginTokenFile:authLoginTokenFile", "description": "Login to vault using" }, "authLoginUserpass": { "$ref": "#/types/vault:config/authLoginUserpass:authLoginUserpass", "description": "Login to vault using the userpass method" }, "caCertDir": { "type": "string", "description": "Path to directory containing CA certificate files to validate the server's certificate." }, "caCertFile": { "type": "string", "description": "Path to a CA certificate file to validate the server's certificate." }, "clientAuth": { "$ref": "#/types/vault:config/clientAuth:clientAuth", "description": "Client authentication credentials." }, "headers": { "type": "array", "items": { "$ref": "#/types/vault:config/headers:headers" }, "description": "The headers to send with each Vault request." }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum TTL for secret leases requested by this provider.", "default": 1200, "defaultInfo": { "environment": [ "TERRAFORM_VAULT_MAX_TTL" ] } }, "maxRetries": { "type": "integer", "description": "Maximum number of retries when a 5xx error code is encountered.", "default": 2, "defaultInfo": { "environment": [ "VAULT_MAX_RETRIES" ] } }, "maxRetriesCcc": { "type": "integer", "description": "Maximum number of retries for Client Controlled Consistency related operations" }, "namespace": { "type": "string", "description": "The namespace to use. Available only for Vault Enterprise." }, "setNamespaceFromToken": { "type": "boolean", "description": "In the case where the Vault token is for a specific namespace and the provider namespace is not configured, use the token namespace as the root namespace for all resources." }, "skipChildToken": { "type": "boolean", "description": "Set this to true to prevent the creation of ephemeral child token used by this provider." }, "skipGetVaultVersion": { "type": "boolean", "description": "Skip the dynamic fetching of the Vault server version." }, "skipTlsVerify": { "type": "boolean", "description": "Set this to true only if the target Vault server is an insecure development instance.", "defaultInfo": { "environment": [ "VAULT_SKIP_VERIFY" ] } }, "tlsServerName": { "type": "string", "description": "Name to use as the SNI host when connecting via TLS." }, "token": { "type": "string", "description": "Token to use to authenticate to Vault." }, "tokenName": { "type": "string", "description": "Token name to use for creating the Vault child token." }, "vaultVersionOverride": { "type": "string", "description": "Override the Vault server version, which is normally determined dynamically from the target Vault server" } } }, "types": { "vault:alicloud/SecretBackendRoleInlinePolicy:SecretBackendRoleInlinePolicy": { "properties": { "policyDocument": { "type": "string", "description": "A JSON-encoded inline RAM policy document.\n" } }, "type": "object", "required": [ "policyDocument" ] }, "vault:alicloud/SecretBackendRoleRemotePolicy:SecretBackendRoleRemotePolicy": { "properties": { "name": { "type": "string", "description": "The name of the remote RAM policy.\n" }, "type": { "type": "string", "description": "The type of the remote policy. Must be `System` (for\nAliCloud managed policies) or `Custom` (for customer-managed policies).\n\n\u003e **Note:** You must specify either \u003cspan pulumi-lang-nodejs=\"`roleArn`\" pulumi-lang-dotnet=\"`RoleArn`\" pulumi-lang-go=\"`roleArn`\" pulumi-lang-python=\"`role_arn`\" pulumi-lang-yaml=\"`roleArn`\" pulumi-lang-java=\"`roleArn`\" pulumi-lang-hcl=\"`role_arn`\"\u003e`roleArn`\u003c/span\u003e or at least one \u003cspan pulumi-lang-nodejs=\"`inlinePolicies`\" pulumi-lang-dotnet=\"`InlinePolicies`\" pulumi-lang-go=\"`inlinePolicies`\" pulumi-lang-python=\"`inline_policies`\" pulumi-lang-yaml=\"`inlinePolicies`\" pulumi-lang-java=\"`inlinePolicies`\" pulumi-lang-hcl=\"`inline_policies`\"\u003e`inlinePolicies`\u003c/span\u003e block,\nor \u003cspan pulumi-lang-nodejs=\"`remotePolicies`\" pulumi-lang-dotnet=\"`RemotePolicies`\" pulumi-lang-go=\"`remotePolicies`\" pulumi-lang-python=\"`remote_policies`\" pulumi-lang-yaml=\"`remotePolicies`\" pulumi-lang-java=\"`remotePolicies`\" pulumi-lang-hcl=\"`remote_policies`\"\u003e`remotePolicies`\u003c/span\u003e block, or a combination of \u003cspan pulumi-lang-nodejs=\"`inlinePolicies`\" pulumi-lang-dotnet=\"`InlinePolicies`\" pulumi-lang-go=\"`inlinePolicies`\" pulumi-lang-python=\"`inline_policies`\" pulumi-lang-yaml=\"`inlinePolicies`\" pulumi-lang-java=\"`inlinePolicies`\" pulumi-lang-hcl=\"`inline_policies`\"\u003e`inlinePolicies`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`remotePolicies`\" pulumi-lang-dotnet=\"`RemotePolicies`\" pulumi-lang-go=\"`remotePolicies`\" pulumi-lang-python=\"`remote_policies`\" pulumi-lang-yaml=\"`remotePolicies`\" pulumi-lang-java=\"`remotePolicies`\" pulumi-lang-hcl=\"`remote_policies`\"\u003e`remotePolicies`\u003c/span\u003e. The role will fail validation if none is provided.\n\u003cspan pulumi-lang-nodejs=\"`roleArn`\" pulumi-lang-dotnet=\"`RoleArn`\" pulumi-lang-go=\"`roleArn`\" pulumi-lang-python=\"`role_arn`\" pulumi-lang-yaml=\"`roleArn`\" pulumi-lang-java=\"`roleArn`\" pulumi-lang-hcl=\"`role_arn`\"\u003e`roleArn`\u003c/span\u003e cannot be combined with \u003cspan pulumi-lang-nodejs=\"`inlinePolicies`\" pulumi-lang-dotnet=\"`InlinePolicies`\" pulumi-lang-go=\"`inlinePolicies`\" pulumi-lang-python=\"`inline_policies`\" pulumi-lang-yaml=\"`inlinePolicies`\" pulumi-lang-java=\"`inlinePolicies`\" pulumi-lang-hcl=\"`inline_policies`\"\u003e`inlinePolicies`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`remotePolicies`\" pulumi-lang-dotnet=\"`RemotePolicies`\" pulumi-lang-go=\"`remotePolicies`\" pulumi-lang-python=\"`remote_policies`\" pulumi-lang-yaml=\"`remotePolicies`\" pulumi-lang-java=\"`remotePolicies`\" pulumi-lang-hcl=\"`remote_policies`\"\u003e`remotePolicies`\u003c/span\u003e.\n" } }, "type": "object", "required": [ "name", "type" ] }, "vault:azure/BackendRoleAzureGroup:BackendRoleAzureGroup": { "properties": { "groupName": { "type": "string" }, "objectId": { "type": "string" } }, "type": "object", "required": [ "groupName" ], "language": { "nodejs": { "requiredOutputs": [ "groupName", "objectId" ] } } }, "vault:azure/BackendRoleAzureRole:BackendRoleAzureRole": { "properties": { "roleId": { "type": "string" }, "roleName": { "type": "string" }, "scope": { "type": "string" } }, "type": "object", "required": [ "scope" ], "language": { "nodejs": { "requiredOutputs": [ "roleId", "roleName", "scope" ] } } }, "vault:config/UiCustomMessageLink:UiCustomMessageLink": { "properties": { "href": { "type": "string", "description": "The URL of the hyperlink\n" }, "title": { "type": "string", "description": "The title of the hyperlink\n" } }, "type": "object", "required": [ "href", "title" ] }, "vault:config/authLogin:authLogin": { "properties": { "method": { "type": "string" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "parameters": { "type": "object", "additionalProperties": { "type": "string" }, "secret": true }, "path": { "type": "string" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "path" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:config/authLoginAws:authLoginAws": { "properties": { "awsAccessKeyId": { "type": "string", "description": "The AWS access key ID.\n" }, "awsIamEndpoint": { "type": "string", "description": "The IAM endpoint URL.\n" }, "awsProfile": { "type": "string", "description": "The name of the AWS profile.\n" }, "awsRegion": { "type": "string", "description": "The AWS region.\n" }, "awsRoleArn": { "type": "string", "description": "The ARN of the AWS Role to assume.Used during STS AssumeRole\n" }, "awsRoleSessionName": { "type": "string", "description": "Specifies the name to attach to the AWS role session. Used during STS AssumeRole\n" }, "awsSecretAccessKey": { "type": "string", "description": "The AWS secret access key.\n" }, "awsSessionToken": { "type": "string", "description": "The AWS session token.\n" }, "awsSharedCredentialsFile": { "type": "string", "description": "Path to the AWS shared credentials file.\n" }, "awsStsEndpoint": { "type": "string", "description": "The STS endpoint URL.\n" }, "awsWebIdentityTokenFile": { "type": "string", "description": "Path to the file containing an OAuth 2.0 access token or OpenID Connect ID token.\n" }, "headerValue": { "type": "string", "description": "The Vault header value to include in the STS signing request.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "The Vault role to use when logging into Vault.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "role" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:config/authLoginAzure:authLoginAzure": { "properties": { "clientId": { "type": "string", "description": "The identity's client ID.\n" }, "jwt": { "type": "string", "description": "A signed JSON Web Token. If not specified on will be created automatically\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "resourceGroupName": { "type": "string", "description": "The resource group for the machine that generated the MSI token. This information can be obtained through instance metadata.\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "scope": { "type": "string", "description": "The scopes to include in the token request.\n" }, "subscriptionId": { "type": "string", "description": "The subscription ID for the machine that generated the MSI token. This information can be obtained through instance metadata.\n" }, "tenantId": { "type": "string", "description": "Provides the tenant ID to use in a multi-tenant authentication scenario.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" }, "vmName": { "type": "string", "description": "The virtual machine name for the machine that generated the MSI token. This information can be obtained through instance metadata.\n" }, "vmssName": { "type": "string", "description": "The virtual machine scale set name for the machine that generated the MSI token. This information can be obtained through instance metadata.\n" } }, "type": "object", "required": [ "resourceGroupName", "role", "subscriptionId" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:config/authLoginCert:authLoginCert": { "properties": { "certFile": { "type": "string", "description": "Path to a file containing the client certificate.\n" }, "keyFile": { "type": "string", "description": "Path to a file containing the private key that the certificate was issued for.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "name": { "type": "string", "description": "Name of the certificate's role\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "certFile", "keyFile" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:config/authLoginGcp:authLoginGcp": { "properties": { "credentials": { "type": "string", "description": "Path to the Google Cloud credentials file.\n" }, "jwt": { "type": "string", "description": "A signed JSON Web Token.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "serviceAccount": { "type": "string", "description": "IAM service account.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "role" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:config/authLoginJwt:authLoginJwt": { "properties": { "distributedClaimAccessToken": { "type": "string", "description": "An optional token used to fetch group memberships specified by the distributed claim source in the jwt. This is supported only on Azure/Entra ID. Requires Vault 1.18+.\n" }, "jwt": { "type": "string", "description": "A signed JSON Web Token.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "role" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:config/authLoginKerberos:authLoginKerberos": { "properties": { "disableFastNegotiation": { "type": "boolean", "description": "Disable the Kerberos FAST negotiation.\n" }, "keytabPath": { "type": "string", "description": "The Kerberos keytab file containing the entry of the login entity.\n" }, "krb5confPath": { "type": "string", "description": "A valid Kerberos configuration file e.g. /etc/krb5.conf.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "realm": { "type": "string", "description": "The Kerberos server's authoritative authentication domain\n" }, "removeInstanceName": { "type": "boolean", "description": "Strip the host from the username found in the keytab.\n" }, "service": { "type": "string", "description": "The service principle name.\n" }, "token": { "type": "string", "description": "Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) token\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" }, "username": { "type": "string", "description": "The username to login into Kerberos with.\n" } }, "type": "object" }, "vault:config/authLoginOci:authLoginOci": { "properties": { "authType": { "type": "string", "description": "Authentication type to use when getting OCI credentials.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "authType", "role" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:config/authLoginOidc:authLoginOidc": { "properties": { "callbackAddress": { "type": "string", "description": "The callback address. Must be a valid URI without the path.\n" }, "callbackListenerAddress": { "type": "string", "description": "The callback listener's address. Must be a valid URI without the path.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "role" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:config/authLoginRadius:authLoginRadius": { "properties": { "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "password": { "type": "string", "description": "The Radius password for username.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" }, "username": { "type": "string", "description": "The Radius username.\n" } }, "type": "object" }, "vault:config/authLoginTokenFile:authLoginTokenFile": { "properties": { "filename": { "type": "string", "description": "The name of a file containing a single line that is a valid Vault token\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object" }, "vault:config/authLoginUserpass:authLoginUserpass": { "properties": { "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "password": { "type": "string", "description": "Login with password\n" }, "passwordFile": { "type": "string", "description": "Login with password from a file\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" }, "username": { "type": "string", "description": "Login with username\n" } }, "type": "object" }, "vault:config/clientAuth:clientAuth": { "properties": { "certFile": { "type": "string", "description": "Path to a file containing the client certificate.\n" }, "keyFile": { "type": "string", "description": "Path to a file containing the private key that the certificate was issued for.\n" } }, "type": "object", "required": [ "certFile", "keyFile" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:config/headers:headers": { "properties": { "name": { "type": "string", "description": "The header name\n", "secret": true }, "value": { "type": "string", "description": "The header value\n", "secret": true } }, "type": "object", "required": [ "name", "value" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:database/SecretBackendConnectionCassandra:SecretBackendConnectionCassandra": { "properties": { "connectTimeout": { "type": "integer", "description": "The number of seconds to use as a connection timeout.\n" }, "consistency": { "type": "string", "description": "Cassandra consistency level.\n" }, "hosts": { "type": "array", "items": { "type": "string" }, "description": "Cassandra hosts to connect to.\n" }, "insecureTls": { "type": "boolean", "description": "Whether to skip verification of the server certificate when using TLS.\n" }, "localDatacenter": { "type": "string", "description": "Cassandra local datacenter name.\n" }, "password": { "type": "string", "description": "The password to use when authenticating with Cassandra.\n", "secret": true }, "pemBundle": { "type": "string", "description": "Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.\n", "secret": true }, "pemJson": { "type": "string", "description": "Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.\n", "secret": true }, "port": { "type": "integer", "description": "The transport port to use to connect to Cassandra.\n" }, "protocolVersion": { "type": "integer", "description": "The CQL protocol version to use.\n" }, "skipVerification": { "type": "boolean", "description": "Skip permissions checks when a connection to Cassandra is first created. These checks ensure that Vault is able to create roles, but can be resource intensive in clusters with many roles.\n" }, "socketKeepAlive": { "type": "string", "description": "Enable TCP keepalive for Cassandra connections.\n" }, "tls": { "type": "boolean", "description": "Whether to use TLS when connecting to Cassandra.\n" }, "tlsServerName": { "type": "string", "description": "SNI host for TLS connections.\n" }, "username": { "type": "string", "description": "The username to use when authenticating with Cassandra.\n" }, "usernameTemplate": { "type": "string", "description": "Template for dynamic Cassandra usernames.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionCouchbase:SecretBackendConnectionCouchbase": { "properties": { "base64Pem": { "type": "string", "description": "Required if \u003cspan pulumi-lang-nodejs=\"`tls`\" pulumi-lang-dotnet=\"`Tls`\" pulumi-lang-go=\"`tls`\" pulumi-lang-python=\"`tls`\" pulumi-lang-yaml=\"`tls`\" pulumi-lang-java=\"`tls`\" pulumi-lang-hcl=\"`tls`\"\u003e`tls`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.\n", "secret": true }, "bucketName": { "type": "string", "description": "Required for Couchbase versions prior to 6.5.0. This is only used to verify vault's connection to the server.\n" }, "hosts": { "type": "array", "items": { "type": "string" }, "description": "A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if \u003cspan pulumi-lang-nodejs=\"`tls`\" pulumi-lang-dotnet=\"`Tls`\" pulumi-lang-go=\"`tls`\" pulumi-lang-python=\"`tls`\" pulumi-lang-yaml=\"`tls`\" pulumi-lang-java=\"`tls`\" pulumi-lang-hcl=\"`tls`\"\u003e`tls`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "insecureTls": { "type": "boolean", "description": "Specifies whether to skip verification of the server certificate when using TLS.\n" }, "password": { "type": "string", "description": "Specifies the password corresponding to the given username.\n", "secret": true }, "tls": { "type": "boolean", "description": "Specifies whether to use TLS when connecting to Couchbase.\n" }, "username": { "type": "string", "description": "Specifies the username for Vault to use.\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n" } }, "type": "object", "required": [ "hosts", "password", "username" ] }, "vault:database/SecretBackendConnectionElasticsearch:SecretBackendConnectionElasticsearch": { "properties": { "caCert": { "type": "string", "description": "The path to a PEM-encoded CA cert file to use to verify the Elasticsearch server's identity\n" }, "caPath": { "type": "string", "description": "The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity\n" }, "clientCert": { "type": "string", "description": "The path to the certificate for the Elasticsearch client to present for communication\n" }, "clientKey": { "type": "string", "description": "The path to the key for the Elasticsearch client to use for communication\n" }, "insecure": { "type": "boolean", "description": "Whether to disable certificate verification\n" }, "password": { "type": "string", "description": "The password to be used in the connection URL\n", "secret": true }, "tlsServerName": { "type": "string", "description": "This, if set, is used to set the SNI host when connecting via TLS\n" }, "url": { "type": "string", "description": "The URL for Elasticsearch's API\n" }, "username": { "type": "string", "description": "The username to be used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n" } }, "type": "object", "required": [ "password", "url", "username" ] }, "vault:database/SecretBackendConnectionHana:SecretBackendConnectionHana": { "properties": { "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "disableEscaping": { "type": "boolean", "description": "Disable special character escaping in username and password\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionInfluxdb:SecretBackendConnectionInfluxdb": { "properties": { "connectTimeout": { "type": "integer", "description": "The number of seconds to use as a connection timeout.\n" }, "host": { "type": "string", "description": "Influxdb host to connect to.\n" }, "insecureTls": { "type": "boolean", "description": "Whether to skip verification of the server certificate when using TLS.\n" }, "password": { "type": "string", "description": "Specifies the password corresponding to the given username.\n", "secret": true }, "pemBundle": { "type": "string", "description": "Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.\n", "secret": true }, "pemJson": { "type": "string", "description": "Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.\n", "secret": true }, "port": { "type": "integer", "description": "The transport port to use to connect to Influxdb.\n" }, "tls": { "type": "boolean", "description": "Whether to use TLS when connecting to Influxdb.\n" }, "username": { "type": "string", "description": "Specifies the username to use for superuser access.\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n" } }, "type": "object", "required": [ "host", "password", "username" ] }, "vault:database/SecretBackendConnectionMongodb:SecretBackendConnectionMongodb": { "properties": { "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "tlsCa": { "type": "string", "description": "The x509 CA file for validating the certificate presented by the MongoDB server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "The x509 certificate and private key bundle for connecting to the database. Must be PEM encoded.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "writeConcern": { "type": "string", "description": "Specifies the MongoDB write concern for Vault management operations.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionMongodbatlas:SecretBackendConnectionMongodbatlas": { "properties": { "privateKey": { "type": "string", "description": "The Private Programmatic API Key used to connect with MongoDB Atlas API.\n", "secret": true }, "projectId": { "type": "string", "description": "The Project ID the Database User should be created within.\n" }, "publicKey": { "type": "string", "description": "The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n" } }, "type": "object", "required": [ "privateKey", "projectId", "publicKey" ] }, "vault:database/SecretBackendConnectionMssql:SecretBackendConnectionMssql": { "properties": { "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "containedDb": { "type": "boolean", "description": "Set to true when the target is a Contained Database, e.g. AzureSQL.\n" }, "disableEscaping": { "type": "boolean", "description": "Disable special character escaping in username and password\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionMysql:SecretBackendConnectionMysql": { "properties": { "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "tlsCa": { "type": "string", "description": "x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionMysqlAurora:SecretBackendConnectionMysqlAurora": { "properties": { "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "tlsCa": { "type": "string", "description": "x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionMysqlLegacy:SecretBackendConnectionMysqlLegacy": { "properties": { "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "tlsCa": { "type": "string", "description": "x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionMysqlRds:SecretBackendConnectionMysqlRds": { "properties": { "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "tlsCa": { "type": "string", "description": "x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionOracle:SecretBackendConnectionOracle": { "properties": { "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "disconnectSessions": { "type": "boolean", "description": "Set to true to disconnect any open sessions prior to running the revocation statements.\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "selfManaged": { "type": "boolean", "description": "If set, allows onboarding static roles with a rootless connection configuration.\n" }, "splitStatements": { "type": "boolean", "description": "Set to true in order to split statements after semi-colons.\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionPostgresql:SecretBackendConnectionPostgresql": { "properties": { "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "disableEscaping": { "type": "boolean", "description": "Disable special character escaping in username and password\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordAuthentication": { "type": "string", "description": "When set to `scram-sha-256`, passwords will be hashed by Vault before being sent to PostgreSQL.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "privateKey": { "type": "string", "description": "The secret key used for the x509 client certificate. Must be PEM encoded.\n", "secret": true }, "selfManaged": { "type": "boolean", "description": "If set, allows onboarding static roles with a rootless connection configuration.\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "tlsCa": { "type": "string", "description": "The x509 CA file for validating the certificate presented by the PostgreSQL server. Must be PEM encoded.\n" }, "tlsCertificate": { "type": "string", "description": "The x509 client certificate for connecting to the database. Must be PEM encoded.\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionRedis:SecretBackendConnectionRedis": { "properties": { "caCert": { "type": "string", "description": "The contents of a PEM-encoded CA cert file to use to verify the Redis server's identity.\n" }, "host": { "type": "string", "description": "Specifies the host to connect to\n" }, "insecureTls": { "type": "boolean", "description": "Specifies whether to skip verification of the server certificate when using TLS.\n" }, "password": { "type": "string", "description": "Specifies the password corresponding to the given username.\n", "secret": true }, "port": { "type": "integer", "description": "The transport port to use to connect to Redis.\n" }, "tls": { "type": "boolean", "description": "Specifies whether to use TLS when connecting to Redis.\n" }, "username": { "type": "string", "description": "Specifies the username for Vault to use.\n" } }, "type": "object", "required": [ "host", "password", "username" ] }, "vault:database/SecretBackendConnectionRedisElasticache:SecretBackendConnectionRedisElasticache": { "properties": { "password": { "type": "string", "description": "The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.\n", "secret": true }, "region": { "type": "string", "description": "The AWS region where the ElastiCache cluster is hosted. If omitted the plugin tries to infer the region from the environment.\n" }, "url": { "type": "string", "description": "The configuration endpoint for the ElastiCache cluster to connect to.\n" }, "username": { "type": "string", "description": "The AWS access key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.\n", "secret": true } }, "type": "object", "required": [ "url" ] }, "vault:database/SecretBackendConnectionRedshift:SecretBackendConnectionRedshift": { "properties": { "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "disableEscaping": { "type": "boolean", "description": "Disable special character escaping in username and password\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretBackendConnectionSnowflake:SecretBackendConnectionSnowflake": { "properties": { "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "deprecationMessage": "Snowflake is ending support for single-factor password authentication by November 2025. Refer to the documentation for more information on migrating to key-pair authentication.", "secret": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "privateKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe private key configured for the admin user in Snowflake.\n", "secret": true }, "privateKeyWoVersion": { "type": "integer", "description": "Version counter for the private key key-pair credentials write-only field\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" } }, "type": "object" }, "vault:database/SecretsMountCassandra:SecretsMountCassandra": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "connectTimeout": { "type": "integer", "description": "The number of seconds to use as a connection timeout.\n" }, "consistency": { "type": "string", "description": "Cassandra consistency level.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "hosts": { "type": "array", "items": { "type": "string" }, "description": "Cassandra hosts to connect to.\n" }, "insecureTls": { "type": "boolean", "description": "Whether to skip verification of the server certificate when using TLS.\n" }, "localDatacenter": { "type": "string", "description": "Cassandra local datacenter name.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The password to use when authenticating with Cassandra.\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pemBundle": { "type": "string", "description": "Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.\n", "secret": true }, "pemJson": { "type": "string", "description": "Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.\n", "secret": true }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "port": { "type": "integer", "description": "The transport port to use to connect to Cassandra.\n" }, "protocolVersion": { "type": "integer", "description": "The CQL protocol version to use.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "skipVerification": { "type": "boolean", "description": "Skip permissions checks when a connection to Cassandra is first created. These checks ensure that Vault is able to create roles, but can be resource intensive in clusters with many roles.\n" }, "socketKeepAlive": { "type": "string", "description": "Enable TCP keepalive for Cassandra connections.\n" }, "tls": { "type": "boolean", "description": "Whether to use TLS when connecting to Cassandra.\n" }, "tlsServerName": { "type": "string", "description": "SNI host for TLS connections.\n" }, "username": { "type": "string", "description": "The username to use when authenticating with Cassandra.\n" }, "usernameTemplate": { "type": "string", "description": "Template for dynamic Cassandra usernames.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountCouchbase:SecretsMountCouchbase": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "base64Pem": { "type": "string", "description": "Required if \u003cspan pulumi-lang-nodejs=\"`tls`\" pulumi-lang-dotnet=\"`Tls`\" pulumi-lang-go=\"`tls`\" pulumi-lang-python=\"`tls`\" pulumi-lang-yaml=\"`tls`\" pulumi-lang-java=\"`tls`\" pulumi-lang-hcl=\"`tls`\"\u003e`tls`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.\n", "secret": true }, "bucketName": { "type": "string", "description": "Required for Couchbase versions prior to 6.5.0. This is only used to verify vault's connection to the server.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "hosts": { "type": "array", "items": { "type": "string" }, "description": "A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if \u003cspan pulumi-lang-nodejs=\"`tls`\" pulumi-lang-dotnet=\"`Tls`\" pulumi-lang-go=\"`tls`\" pulumi-lang-python=\"`tls`\" pulumi-lang-yaml=\"`tls`\" pulumi-lang-java=\"`tls`\" pulumi-lang-hcl=\"`tls`\"\u003e`tls`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "insecureTls": { "type": "boolean", "description": "Specifies whether to skip verification of the server certificate when using TLS.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "Specifies the password corresponding to the given username.\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tls": { "type": "boolean", "description": "Specifies whether to use TLS when connecting to Couchbase.\n" }, "username": { "type": "string", "description": "Specifies the username for Vault to use.\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "hosts", "name", "password", "username" ], "language": { "nodejs": { "requiredOutputs": [ "hosts", "name", "password", "pluginName", "skipStaticRoleImportRotation", "username" ] } } }, "vault:database/SecretsMountElasticsearch:SecretsMountElasticsearch": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "caCert": { "type": "string", "description": "The path to a PEM-encoded CA cert file to use to verify the Elasticsearch server's identity\n" }, "caPath": { "type": "string", "description": "The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity\n" }, "clientCert": { "type": "string", "description": "The path to the certificate for the Elasticsearch client to present for communication\n" }, "clientKey": { "type": "string", "description": "The path to the key for the Elasticsearch client to use for communication\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "insecure": { "type": "boolean", "description": "Whether to disable certificate verification\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The password to be used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tlsServerName": { "type": "string", "description": "This, if set, is used to set the SNI host when connecting via TLS\n" }, "url": { "type": "string", "description": "The URL for Elasticsearch's API\n" }, "username": { "type": "string", "description": "The username to be used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name", "password", "url", "username" ], "language": { "nodejs": { "requiredOutputs": [ "name", "password", "pluginName", "skipStaticRoleImportRotation", "url", "username" ] } } }, "vault:database/SecretsMountHana:SecretsMountHana": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "disableEscaping": { "type": "boolean", "description": "Disable special character escaping in username and password\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountInfluxdb:SecretsMountInfluxdb": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "connectTimeout": { "type": "integer", "description": "The number of seconds to use as a connection timeout.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "host": { "type": "string", "description": "Influxdb host to connect to.\n" }, "insecureTls": { "type": "boolean", "description": "Whether to skip verification of the server certificate when using TLS.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "Specifies the password corresponding to the given username.\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pemBundle": { "type": "string", "description": "Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.\n", "secret": true }, "pemJson": { "type": "string", "description": "Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.\n", "secret": true }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "port": { "type": "integer", "description": "The transport port to use to connect to Influxdb.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tls": { "type": "boolean", "description": "Whether to use TLS when connecting to Influxdb.\n" }, "username": { "type": "string", "description": "Specifies the username to use for superuser access.\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "host", "name", "password", "username" ], "language": { "nodejs": { "requiredOutputs": [ "host", "name", "password", "pluginName", "skipStaticRoleImportRotation", "username" ] } } }, "vault:database/SecretsMountMongodb:SecretsMountMongodb": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tlsCa": { "type": "string", "description": "The x509 CA file for validating the certificate presented by the MongoDB server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "The x509 certificate and private key bundle for connecting to the database. Must be PEM encoded.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" }, "writeConcern": { "type": "string", "description": "Specifies the MongoDB write concern for Vault management operations.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountMongodbatla:SecretsMountMongodbatla": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "privateKey": { "type": "string", "description": "The Private Programmatic API Key used to connect with MongoDB Atlas API.\n", "secret": true }, "projectId": { "type": "string", "description": "The Project ID the Database User should be created within.\n" }, "publicKey": { "type": "string", "description": "The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name", "privateKey", "projectId", "publicKey" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "privateKey", "projectId", "publicKey", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountMssql:SecretsMountMssql": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "containedDb": { "type": "boolean", "description": "Set to true when the target is a Contained Database, e.g. AzureSQL.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "disableEscaping": { "type": "boolean", "description": "Disable special character escaping in username and password\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountMysql:SecretsMountMysql": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tlsCa": { "type": "string", "description": "x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountMysqlAurora:SecretsMountMysqlAurora": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tlsCa": { "type": "string", "description": "x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountMysqlLegacy:SecretsMountMysqlLegacy": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tlsCa": { "type": "string", "description": "x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountMysqlRd:SecretsMountMysqlRd": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tlsCa": { "type": "string", "description": "x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded.\n" }, "tlsCertificateKey": { "type": "string", "description": "x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.\n", "secret": true }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountOracle:SecretsMountOracle": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "disconnectSessions": { "type": "boolean", "description": "Set to true to disconnect any open sessions prior to running the revocation statements.\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "selfManaged": { "type": "boolean", "description": "If set, allows onboarding static roles with a rootless connection configuration.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "splitStatements": { "type": "boolean", "description": "Set to true in order to split statements after semi-colons.\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountPostgresql:SecretsMountPostgresql": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "authType": { "type": "string", "description": "Specify alternative authorization type. (Only 'gcp_iam' is valid currently)\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "disableEscaping": { "type": "boolean", "description": "Disable special character escaping in username and password\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordAuthentication": { "type": "string", "description": "When set to `scram-sha-256`, passwords will be hashed by Vault before being sent to PostgreSQL.\n" }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "privateKey": { "type": "string", "description": "The secret key used for the x509 client certificate. Must be PEM encoded.\n", "secret": true }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "selfManaged": { "type": "boolean", "description": "If set, allows onboarding static roles with a rootless connection configuration.\n" }, "serviceAccountJson": { "type": "string", "description": "A JSON encoded credential for use with IAM authorization\n", "secret": true }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tlsCa": { "type": "string", "description": "The x509 CA file for validating the certificate presented by the PostgreSQL server. Must be PEM encoded.\n" }, "tlsCertificate": { "type": "string", "description": "The x509 client certificate for connecting to the database. Must be PEM encoded.\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountRedi:SecretsMountRedi": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "caCert": { "type": "string", "description": "The contents of a PEM-encoded CA cert file to use to verify the Redis server's identity.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "host": { "type": "string", "description": "Specifies the host to connect to\n" }, "insecureTls": { "type": "boolean", "description": "Specifies whether to skip verification of the server certificate when using TLS.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "Specifies the password corresponding to the given username.\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "port": { "type": "integer", "description": "The transport port to use to connect to Redis.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "tls": { "type": "boolean", "description": "Specifies whether to use TLS when connecting to Redis.\n" }, "username": { "type": "string", "description": "Specifies the username for Vault to use.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "host", "name", "password", "username" ], "language": { "nodejs": { "requiredOutputs": [ "host", "name", "password", "pluginName", "skipStaticRoleImportRotation", "username" ] } } }, "vault:database/SecretsMountRedisElasticache:SecretsMountRedisElasticache": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "region": { "type": "string", "description": "The AWS region where the ElastiCache cluster is hosted. If omitted the plugin tries to infer the region from the environment.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "url": { "type": "string", "description": "The configuration endpoint for the ElastiCache cluster to connect to.\n" }, "username": { "type": "string", "description": "The AWS access key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.\n", "secret": true }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name", "url" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation", "url" ] } } }, "vault:database/SecretsMountRedshift:SecretsMountRedshift": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "disableEscaping": { "type": "boolean", "description": "Disable special character escaping in username and password\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:database/SecretsMountSnowflake:SecretsMountSnowflake": { "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "connectionUrl": { "type": "string", "description": "Connection string to use to connect to the database.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n\nSupported list of database secrets engines that can be configured:\n" }, "maxConnectionLifetime": { "type": "integer", "description": "Maximum number of seconds a connection may be reused.\n" }, "maxIdleConnections": { "type": "integer", "description": "Maximum number of idle connections to the database.\n" }, "maxOpenConnections": { "type": "integer", "description": "Maximum number of open connections to the database.\n" }, "name": { "type": "string", "description": "Name of the database connection.\n" }, "password": { "type": "string", "description": "The root credential password used in the connection URL\n", "deprecationMessage": "Snowflake is ending support for single-factor password authentication by November 2025. Refer to the documentation for more information on migrating to key-pair authentication.", "secret": true }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only field for the root credential password used in the connection URL\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for root credential password write-only field\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "privateKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe private key configured for the admin user in Snowflake.\n", "secret": true }, "privateKeyWoVersion": { "type": "integer", "description": "Version counter for the private key key-pair credentials write-only field\n" }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "username": { "type": "string", "description": "The root credential username used in the connection URL\n" }, "usernameTemplate": { "type": "string", "description": "Username generation template.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object", "required": [ "name" ], "language": { "nodejs": { "requiredOutputs": [ "name", "pluginName", "skipStaticRoleImportRotation" ] } } }, "vault:gcp/AuthBackendCustomEndpoint:AuthBackendCustomEndpoint": { "properties": { "api": { "type": "string", "description": "Replaces the service endpoint used in API requests to `https://www.googleapis.com`.\n" }, "compute": { "type": "string", "description": "Replaces the service endpoint used in API requests to `https://compute.googleapis.com`.\n\nThe endpoint value provided for a given key has the form of `scheme://host:port`.\nThe `scheme://` and `:port` portions of the endpoint value are optional.\n" }, "crm": { "type": "string", "description": "Replaces the service endpoint used in API requests to `https://cloudresourcemanager.googleapis.com`.\n" }, "iam": { "type": "string", "description": "Replaces the service endpoint used in API requests to `https://iam.googleapis.com`.\n" } }, "type": "object" }, "vault:gcp/AuthBackendTune:AuthBackendTune": { "properties": { "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and allowing\na plugin to include them in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtl": { "type": "string", "description": "Specifies the default time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in\nthe UI-specific listing endpoint. Valid values are \"unauth\" or \"hidden\".\n" }, "maxLeaseTtl": { "type": "string", "description": "Specifies the maximum time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and\npass from the request to the backend.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n\n\nFor more details on the usage of each argument consult the [Vault GCP API documentation](https://www.vaultproject.io/api-docs/auth/gcp#configure).\n" } }, "type": "object" }, "vault:gcp/SecretRolesetBinding:SecretRolesetBinding": { "properties": { "resource": { "type": "string", "description": "Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different [formats](https://www.vaultproject.io/docs/secrets/gcp/index.html#roleset-bindings).\n" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "List of [GCP IAM roles](https://cloud.google.com/iam/docs/understanding-roles) for the resource.\n" } }, "type": "object", "required": [ "resource", "roles" ] }, "vault:gcp/SecretStaticAccountBinding:SecretStaticAccountBinding": { "properties": { "resource": { "type": "string", "description": "Resource or resource path for which IAM policy information will be bound. The resource path may be specified in a few different [formats](https://www.vaultproject.io/docs/secrets/gcp/index.html#bindings).\n" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "List of [GCP IAM roles](https://cloud.google.com/iam/docs/understanding-roles) for the resource.\n" } }, "type": "object", "required": [ "resource", "roles" ] }, "vault:github/AuthBackendTune:AuthBackendTune": { "properties": { "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and allowing\na plugin to include them in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtl": { "type": "string", "description": "Specifies the default time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in\nthe UI-specific listing endpoint. Valid values are \"unauth\" or \"hidden\".\n" }, "maxLeaseTtl": { "type": "string", "description": "Specifies the maximum time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and\npass from the request to the backend.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" } }, "type": "object" }, "vault:identity/getEntityAlias:getEntityAlias": { "properties": { "canonicalId": { "type": "string", "description": "Canonical ID of the Alias\n" }, "creationTime": { "type": "string", "description": "Creation time of the Alias\n" }, "id": { "type": "string", "description": "ID of the alias\n" }, "lastUpdateTime": { "type": "string", "description": "Last update time of the alias\n" }, "mergedFromCanonicalIds": { "type": "array", "items": { "type": "string" }, "description": "List of canonical IDs merged with this alias\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Arbitrary metadata\n" }, "mountAccessor": { "type": "string", "description": "Authentication mount acccessor which this alias belongs to\n" }, "mountPath": { "type": "string", "description": "Authentication mount path which this alias belongs to\n" }, "mountType": { "type": "string", "description": "Authentication mount type which this alias belongs to\n" }, "name": { "type": "string", "description": "Name of the alias\n" } }, "type": "object", "required": [ "canonicalId", "creationTime", "id", "lastUpdateTime", "mergedFromCanonicalIds", "metadata", "mountAccessor", "mountPath", "mountType", "name" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:index/AuthBackendTune:AuthBackendTune": { "properties": { "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and allowing\na plugin to include them in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtl": { "type": "string", "description": "Specifies the default time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in\nthe UI-specific listing endpoint. Valid values are \"unauth\" or \"hidden\".\n" }, "maxLeaseTtl": { "type": "string", "description": "Specifies the maximum time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and\npass from the request to the backend.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" } }, "type": "object" }, "vault:index/OauthResourceServerConfigProfilePublicKey:OauthResourceServerConfigProfilePublicKey": { "properties": { "keyId": { "type": "string", "description": "The key ID (kid) for this public key. Must be unique within the profile.\n" }, "pem": { "type": "string", "description": "The PEM-encoded public key.\n" } }, "type": "object", "required": [ "keyId", "pem" ] }, "vault:index/OciAuthBackendTune:OciAuthBackendTune": { "properties": { "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and allowing\na plugin to include them in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtl": { "type": "string", "description": "Specifies the default time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in\nthe UI-specific listing endpoint. Valid values are \"unauth\" or \"hidden\".\n" }, "maxLeaseTtl": { "type": "string", "description": "Specifies the maximum time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and\npass from the request to the backend.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n\n\nFor more details on the usage of each argument, consult the [Vault OCI API documentation](https://developer.hashicorp.com/vault/api-docs/auth/oci#configure-home-tenancy-method).\n" } }, "type": "object" }, "vault:index/ProviderAuthLogin:ProviderAuthLogin": { "properties": { "method": { "type": "string" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "parameters": { "type": "object", "additionalProperties": { "type": "string" }, "secret": true }, "path": { "type": "string" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "path" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/ProviderAuthLoginAws:ProviderAuthLoginAws": { "properties": { "awsAccessKeyId": { "type": "string", "description": "The AWS access key ID.\n" }, "awsIamEndpoint": { "type": "string", "description": "The IAM endpoint URL.\n" }, "awsProfile": { "type": "string", "description": "The name of the AWS profile.\n" }, "awsRegion": { "type": "string", "description": "The AWS region.\n" }, "awsRoleArn": { "type": "string", "description": "The ARN of the AWS Role to assume.Used during STS AssumeRole\n" }, "awsRoleSessionName": { "type": "string", "description": "Specifies the name to attach to the AWS role session. Used during STS AssumeRole\n" }, "awsSecretAccessKey": { "type": "string", "description": "The AWS secret access key.\n" }, "awsSessionToken": { "type": "string", "description": "The AWS session token.\n" }, "awsSharedCredentialsFile": { "type": "string", "description": "Path to the AWS shared credentials file.\n" }, "awsStsEndpoint": { "type": "string", "description": "The STS endpoint URL.\n" }, "awsWebIdentityTokenFile": { "type": "string", "description": "Path to the file containing an OAuth 2.0 access token or OpenID Connect ID token.\n" }, "headerValue": { "type": "string", "description": "The Vault header value to include in the STS signing request.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "The Vault role to use when logging into Vault.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "role" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/ProviderAuthLoginAzure:ProviderAuthLoginAzure": { "properties": { "clientId": { "type": "string", "description": "The identity's client ID.\n" }, "jwt": { "type": "string", "description": "A signed JSON Web Token. If not specified on will be created automatically\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "resourceGroupName": { "type": "string", "description": "The resource group for the machine that generated the MSI token. This information can be obtained through instance metadata.\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "scope": { "type": "string", "description": "The scopes to include in the token request.\n" }, "subscriptionId": { "type": "string", "description": "The subscription ID for the machine that generated the MSI token. This information can be obtained through instance metadata.\n" }, "tenantId": { "type": "string", "description": "Provides the tenant ID to use in a multi-tenant authentication scenario.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" }, "vmName": { "type": "string", "description": "The virtual machine name for the machine that generated the MSI token. This information can be obtained through instance metadata.\n" }, "vmssName": { "type": "string", "description": "The virtual machine scale set name for the machine that generated the MSI token. This information can be obtained through instance metadata.\n" } }, "type": "object", "required": [ "resourceGroupName", "role", "subscriptionId" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/ProviderAuthLoginCert:ProviderAuthLoginCert": { "properties": { "certFile": { "type": "string", "description": "Path to a file containing the client certificate.\n" }, "keyFile": { "type": "string", "description": "Path to a file containing the private key that the certificate was issued for.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "name": { "type": "string", "description": "Name of the certificate's role\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "certFile", "keyFile" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/ProviderAuthLoginGcp:ProviderAuthLoginGcp": { "properties": { "credentials": { "type": "string", "description": "Path to the Google Cloud credentials file.\n" }, "jwt": { "type": "string", "description": "A signed JSON Web Token.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "serviceAccount": { "type": "string", "description": "IAM service account.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "role" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/ProviderAuthLoginJwt:ProviderAuthLoginJwt": { "properties": { "distributedClaimAccessToken": { "type": "string", "description": "An optional token used to fetch group memberships specified by the distributed claim source in the jwt. This is supported only on Azure/Entra ID. Requires Vault 1.18+.\n" }, "jwt": { "type": "string", "description": "A signed JSON Web Token.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "role" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/ProviderAuthLoginKerberos:ProviderAuthLoginKerberos": { "properties": { "disableFastNegotiation": { "type": "boolean", "description": "Disable the Kerberos FAST negotiation.\n" }, "keytabPath": { "type": "string", "description": "The Kerberos keytab file containing the entry of the login entity.\n" }, "krb5confPath": { "type": "string", "description": "A valid Kerberos configuration file e.g. /etc/krb5.conf.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "realm": { "type": "string", "description": "The Kerberos server's authoritative authentication domain\n" }, "removeInstanceName": { "type": "boolean", "description": "Strip the host from the username found in the keytab.\n" }, "service": { "type": "string", "description": "The service principle name.\n" }, "token": { "type": "string", "description": "Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) token\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" }, "username": { "type": "string", "description": "The username to login into Kerberos with.\n" } }, "type": "object" }, "vault:index/ProviderAuthLoginOci:ProviderAuthLoginOci": { "properties": { "authType": { "type": "string", "description": "Authentication type to use when getting OCI credentials.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "authType", "role" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/ProviderAuthLoginOidc:ProviderAuthLoginOidc": { "properties": { "callbackAddress": { "type": "string", "description": "The callback address. Must be a valid URI without the path.\n" }, "callbackListenerAddress": { "type": "string", "description": "The callback listener's address. Must be a valid URI without the path.\n" }, "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "role": { "type": "string", "description": "Name of the login role.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object", "required": [ "role" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/ProviderAuthLoginRadius:ProviderAuthLoginRadius": { "properties": { "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "password": { "type": "string", "description": "The Radius password for username.\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" }, "username": { "type": "string", "description": "The Radius username.\n" } }, "type": "object" }, "vault:index/ProviderAuthLoginTokenFile:ProviderAuthLoginTokenFile": { "properties": { "filename": { "type": "string", "description": "The name of a file containing a single line that is a valid Vault token\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" } }, "type": "object" }, "vault:index/ProviderAuthLoginUserpass:ProviderAuthLoginUserpass": { "properties": { "mount": { "type": "string", "description": "The path where the authentication engine is mounted.\n" }, "namespace": { "type": "string", "description": "The authentication engine's namespace. Conflicts with use_root_namespace\n" }, "password": { "type": "string", "description": "Login with password\n" }, "passwordFile": { "type": "string", "description": "Login with password from a file\n" }, "useRootNamespace": { "type": "boolean", "description": "Authenticate to the root Vault namespace. Conflicts with namespace\n" }, "username": { "type": "string", "description": "Login with username\n" } }, "type": "object" }, "vault:index/ProviderClientAuth:ProviderClientAuth": { "properties": { "certFile": { "type": "string", "description": "Path to a file containing the client certificate.\n" }, "keyFile": { "type": "string", "description": "Path to a file containing the private key that the certificate was issued for.\n" } }, "type": "object", "required": [ "certFile", "keyFile" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/ProviderHeader:ProviderHeader": { "properties": { "name": { "type": "string", "description": "The header name\n", "secret": true }, "value": { "type": "string", "description": "The header value\n", "secret": true } }, "type": "object", "required": [ "name", "value" ], "language": { "nodejs": { "requiredOutputs": [] } } }, "vault:index/getPluginRuntimesRuntime:getPluginRuntimesRuntime": { "properties": { "cgroupParent": { "type": "string", "description": "The parent cgroup for plugin containers, when set.\n" }, "cpuNanos": { "type": "integer", "description": "CPU quota in nanoseconds per second, when set.\n" }, "memoryBytes": { "type": "integer", "description": "Memory limit in bytes, when set.\n" }, "name": { "type": "string", "description": "The runtime name.\n" }, "ociRuntime": { "type": "string", "description": "The OCI runtime used for plugin containers, when set.\n" }, "rootless": { "type": "boolean", "description": "Whether the runtime runs as a non-root user.\n" }, "type": { "type": "string", "description": "The plugin runtime type to list. Currently only \u003cspan pulumi-lang-nodejs=\"`container`\" pulumi-lang-dotnet=\"`Container`\" pulumi-lang-go=\"`container`\" pulumi-lang-python=\"`container`\" pulumi-lang-yaml=\"`container`\" pulumi-lang-java=\"`container`\" pulumi-lang-hcl=\"`container`\"\u003e`container`\u003c/span\u003e is supported.\n" } }, "type": "object", "required": [ "cgroupParent", "cpuNanos", "memoryBytes", "name", "ociRuntime", "rootless", "type" ], "language": { "nodejs": { "requiredInputs": [] } } }, "vault:index/getPolicyDocumentRule:getPolicyDocumentRule": { "properties": { "allowedParameters": { "type": "array", "items": { "$ref": "#/types/vault:index/getPolicyDocumentRuleAllowedParameter:getPolicyDocumentRuleAllowedParameter" }, "description": "Whitelists a list of keys and values that are permitted on the given path. See Parameters below.\n" }, "capabilities": { "type": "array", "items": { "type": "string" }, "description": "A list of capabilities that this rule apply to \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e. For example, [\"read\", \"write\"].\n" }, "deniedParameters": { "type": "array", "items": { "$ref": "#/types/vault:index/getPolicyDocumentRuleDeniedParameter:getPolicyDocumentRuleDeniedParameter" }, "description": "Blacklists a list of parameter and values. Any values specified here take precedence over \u003cspan pulumi-lang-nodejs=\"`allowedParameter`\" pulumi-lang-dotnet=\"`AllowedParameter`\" pulumi-lang-go=\"`allowedParameter`\" pulumi-lang-python=\"`allowed_parameter`\" pulumi-lang-yaml=\"`allowedParameter`\" pulumi-lang-java=\"`allowedParameter`\" pulumi-lang-hcl=\"`allowed_parameter`\"\u003e`allowedParameter`\u003c/span\u003e. See Parameters below.\n" }, "description": { "type": "string", "description": "Description of the rule. Will be added as a comment to rendered rule.\n" }, "maxWrappingTtl": { "type": "string", "description": "The maximum allowed TTL that clients can specify for a wrapped response.\n" }, "minWrappingTtl": { "type": "string", "description": "The minimum allowed TTL that clients can specify for a wrapped response.\n" }, "path": { "type": "string", "description": "A path in Vault that this rule applies to.\n" }, "requiredParameters": { "type": "array", "items": { "type": "string" }, "description": "A list of parameters that must be specified.\n" }, "subscribeEventTypes": { "type": "array", "items": { "type": "string" }, "description": "A list of event types to subscribe to when using \u003cspan pulumi-lang-nodejs=\"`subscribe`\" pulumi-lang-dotnet=\"`Subscribe`\" pulumi-lang-go=\"`subscribe`\" pulumi-lang-python=\"`subscribe`\" pulumi-lang-yaml=\"`subscribe`\" pulumi-lang-java=\"`subscribe`\" pulumi-lang-hcl=\"`subscribe`\"\u003e`subscribe`\u003c/span\u003e capability.\n" } }, "type": "object", "required": [ "capabilities", "path" ] }, "vault:index/getPolicyDocumentRuleAllowedParameter:getPolicyDocumentRuleAllowedParameter": { "properties": { "key": { "type": "string", "description": "Name of permitted key.\n" }, "values": { "type": "array", "items": { "type": "string" }, "description": "A list of values what are permitted by policy rule.\n" } }, "type": "object", "required": [ "key", "values" ] }, "vault:index/getPolicyDocumentRuleDeniedParameter:getPolicyDocumentRuleDeniedParameter": { "properties": { "key": { "type": "string", "description": "Name of denied key.\n" }, "values": { "type": "array", "items": { "type": "string" }, "description": "A list of values what are denied by policy rule.\n" } }, "type": "object", "required": [ "key", "values" ] }, "vault:jwt/AuthBackendTune:AuthBackendTune": { "properties": { "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and allowing\na plugin to include them in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtl": { "type": "string", "description": "Specifies the default time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in\nthe UI-specific listing endpoint. Valid values are \"unauth\" or \"hidden\".\n" }, "maxLeaseTtl": { "type": "string", "description": "Specifies the maximum time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and\npass from the request to the backend.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" } }, "type": "object" }, "vault:kv/SecretV2CustomMetadata:SecretV2CustomMetadata": { "properties": { "casRequired": { "type": "boolean", "description": "If true, all keys will require the cas parameter to be set on all write requests.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**Deprecated. Please use new ephemeral resource \u003cspan pulumi-lang-nodejs=\"`vault.kv.SecretV2`\" pulumi-lang-dotnet=\"`vault.kv.SecretV2`\" pulumi-lang-go=\"`kv.SecretV2`\" pulumi-lang-python=\"`kv.SecretV2`\" pulumi-lang-yaml=\"`vault.kv.SecretV2`\" pulumi-lang-java=\"`vault.kv.SecretV2`\" pulumi-lang-hcl=\"`vault_kv_secret_v2`\"\u003e`vault.kv.SecretV2`\u003c/span\u003e to read back\nsecret data from Vault**. A mapping whose keys are the top-level data keys returned from\nVault and whose values are the corresponding values. This map can only represent string data,\nso any non-string values returned from Vault are serialized as JSON.\n" }, "deleteVersionAfter": { "type": "integer", "description": "If set, specifies the length of time before a version is deleted.\n" }, "maxVersions": { "type": "integer", "description": "The number of versions to keep per key.\n" } }, "type": "object" }, "vault:ldap/AuthBackendTune:AuthBackendTune": { "properties": { "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and allowing\na plugin to include them in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtl": { "type": "string", "description": "Specifies the default time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in\nthe UI-specific listing endpoint. Valid values are \"unauth\" or \"hidden\".\n" }, "maxLeaseTtl": { "type": "string", "description": "Specifies the maximum time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and\npass from the request to the backend.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" } }, "type": "object" }, "vault:managed/KeysAw:KeysAw": { "properties": { "accessKey": { "type": "string", "description": "The AWS access key to use\n" }, "allowGenerateKey": { "type": "boolean", "description": "If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend\n" }, "allowReplaceKey": { "type": "boolean", "description": "Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.\n" }, "allowStoreKey": { "type": "boolean", "description": "Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden\n" }, "anyMount": { "type": "boolean", "description": "Allow usage from any mount point within the namespace if 'true'\n" }, "curve": { "type": "string", "description": "The curve to use for an ECDSA key. Used when\u003cspan pulumi-lang-nodejs=\" keyType \" pulumi-lang-dotnet=\" KeyType \" pulumi-lang-go=\" keyType \" pulumi-lang-python=\" key_type \" pulumi-lang-yaml=\" keyType \" pulumi-lang-java=\" keyType \" pulumi-lang-hcl=\" key_type \"\u003e keyType \u003c/span\u003eis 'ECDSA'. Required if 'allow_generate_key' is true\n" }, "endpoint": { "type": "string", "description": "Used to specify a custom AWS endpoint\n" }, "keyBits": { "type": "string", "description": "The size in bits for an RSA key. This field is required when 'key_type' is 'RSA'\n" }, "keyType": { "type": "string", "description": "The type of key to use\n" }, "kmsKey": { "type": "string", "description": "An identifier for the key\n" }, "name": { "type": "string", "description": "A unique lowercase name that serves as identifying the key\n" }, "region": { "type": "string", "description": "The AWS region where the keys are stored (or will be stored)\n" }, "secretKey": { "type": "string", "description": "The AWS secret key to use\n" }, "usages": { "type": "array", "items": { "type": "string" }, "description": "A list of the allowed usages of this key. Valid values are encrypt, decrypt, sign, verify, wrap, unwrap, mac, and generate_random. Default values are sign and verify.\n" }, "uuid": { "type": "string", "description": "ID of the managed key read from Vault\n" } }, "type": "object", "required": [ "accessKey", "keyBits", "keyType", "kmsKey", "name", "secretKey" ], "language": { "nodejs": { "requiredOutputs": [ "accessKey", "allowGenerateKey", "allowReplaceKey", "allowStoreKey", "anyMount", "keyBits", "keyType", "kmsKey", "name", "region", "secretKey", "usages", "uuid" ] } } }, "vault:managed/KeysAzure:KeysAzure": { "properties": { "allowGenerateKey": { "type": "boolean", "description": "If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend\n" }, "allowReplaceKey": { "type": "boolean", "description": "Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.\n" }, "allowStoreKey": { "type": "boolean", "description": "Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden\n" }, "anyMount": { "type": "boolean", "description": "Allow usage from any mount point within the namespace if 'true'\n" }, "clientId": { "type": "string", "description": "The client id for credentials to query the Azure APIs\n" }, "clientSecret": { "type": "string", "description": "The client secret for credentials to query the Azure APIs\n" }, "environment": { "type": "string", "description": "The Azure Cloud environment API endpoints to use\n" }, "keyBits": { "type": "string", "description": "The size in bits for an RSA key. This field is required when 'key_type' is 'RSA' or when 'allow_generate_key' is true\n" }, "keyName": { "type": "string", "description": "The Key Vault key to use for encryption and decryption\n" }, "keyType": { "type": "string", "description": "The type of key to use\n" }, "name": { "type": "string", "description": "A unique lowercase name that serves as identifying the key\n" }, "resource": { "type": "string", "description": "The Azure Key Vault resource's DNS Suffix to connect to\n" }, "tenantId": { "type": "string", "description": "The tenant id for the Azure Active Directory organization\n" }, "usages": { "type": "array", "items": { "type": "string" }, "description": "A list of the allowed usages of this key. Valid values are encrypt, decrypt, sign, verify, wrap, unwrap, mac, and generate_random. Default values are sign and verify.\n" }, "uuid": { "type": "string", "description": "ID of the managed key read from Vault\n" }, "vaultName": { "type": "string", "description": "The Key Vault vault to use the encryption keys for encryption and decryption\n" } }, "type": "object", "required": [ "clientId", "clientSecret", "keyName", "keyType", "name", "tenantId", "vaultName" ], "language": { "nodejs": { "requiredOutputs": [ "allowGenerateKey", "allowReplaceKey", "allowStoreKey", "anyMount", "clientId", "clientSecret", "environment", "keyName", "keyType", "name", "resource", "tenantId", "usages", "uuid", "vaultName" ] } } }, "vault:managed/KeysGcp:KeysGcp": { "properties": { "algorithm": { "type": "string", "description": "The signature algorithm to be used with the key. Supported values: ec_sign_p256_sha256, ec_sign_p384_sha384, rsa_sign_pss_2048_sha256, rsa_sign_pss_3072_sha256, rsa_sign_pss_4096_sha256, rsa_sign_pss_4096_sha512, rsa_sign_pkcs1_2048_sha256, rsa_sign_pkcs1_3072_sha256, rsa_sign_pkcs1_4096_sha256, rsa_sign_pkcs1_4096_sha512\n" }, "allowGenerateKey": { "type": "boolean", "description": "If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend\n" }, "allowReplaceKey": { "type": "boolean", "description": "Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.\n" }, "allowStoreKey": { "type": "boolean", "description": "Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden\n" }, "anyMount": { "type": "boolean", "description": "Allow usage from any mount point within the namespace if 'true'\n" }, "credentials": { "type": "string", "description": "The GCP service account credentials JSON to use for authenticating to GCP.\n" }, "cryptoKey": { "type": "string", "description": "The name of the GCP Cloud KMS key. If no existing key exists and\u003cspan pulumi-lang-nodejs=\" allowGenerateKey \" pulumi-lang-dotnet=\" AllowGenerateKey \" pulumi-lang-go=\" allowGenerateKey \" pulumi-lang-python=\" allow_generate_key \" pulumi-lang-yaml=\" allowGenerateKey \" pulumi-lang-java=\" allowGenerateKey \" pulumi-lang-hcl=\" allow_generate_key \"\u003e allowGenerateKey \u003c/span\u003eis true, Vault will generate a key with this name\n" }, "cryptoKeyVersion": { "type": "string", "description": "The version of the key to use. (Default: 1)\n" }, "keyRing": { "type": "string", "description": "The name of the key ring in GCP Cloud KMS. This needs to be created prior to key creation\n" }, "name": { "type": "string", "description": "A unique lowercase name that serves as identifying the key\n" }, "project": { "type": "string", "description": "The GCP project ID.\n" }, "region": { "type": "string", "description": "The GCP region where the key ring was created.\n" }, "usages": { "type": "array", "items": { "type": "string" }, "description": "A list of the allowed usages of this key. Valid values are encrypt, decrypt, sign, verify, wrap, unwrap, mac, and generate_random. Default values are sign and verify.\n" }, "uuid": { "type": "string", "description": "ID of the managed key read from Vault\n" } }, "type": "object", "required": [ "algorithm", "credentials", "cryptoKey", "keyRing", "name", "project", "region" ], "language": { "nodejs": { "requiredOutputs": [ "algorithm", "allowGenerateKey", "allowReplaceKey", "allowStoreKey", "anyMount", "credentials", "cryptoKey", "cryptoKeyVersion", "keyRing", "name", "project", "region", "usages", "uuid" ] } } }, "vault:managed/KeysPkc:KeysPkc": { "properties": { "allowGenerateKey": { "type": "boolean", "description": "If no existing key can be found in the referenced backend, instructs Vault to generate a key within the backend\n" }, "allowReplaceKey": { "type": "boolean", "description": "Controls the ability for Vault to replace through generation or importing a key into the configured backend even if a key is present, if set to false those operations are forbidden if a key exists.\n" }, "allowStoreKey": { "type": "boolean", "description": "Controls the ability for Vault to import a key to the configured backend, if 'false', those operations will be forbidden\n" }, "anyMount": { "type": "boolean", "description": "Allow usage from any mount point within the namespace if 'true'\n" }, "curve": { "type": "string", "description": "Supplies the curve value when using the 'CKM_ECDSA' mechanism. Required if 'allow_generate_key' is true\n" }, "forceRwSession": { "type": "string", "description": "Force all operations to open up a read-write session to the HSM\n" }, "keyBits": { "type": "string", "description": "Supplies the size in bits of the key when using 'CKM_RSA_PKCS_PSS', 'CKM_RSA_PKCS_OAEP' or 'CKM_RSA_PKCS' as a value for 'mechanism'. Required if 'allow_generate_key' is true\n" }, "keyId": { "type": "string", "description": "The id of a PKCS#11 key to use\n" }, "keyLabel": { "type": "string", "description": "The label of the key to use\n" }, "library": { "type": "string", "description": "The name of the\u003cspan pulumi-lang-nodejs=\" kmsLibrary \" pulumi-lang-dotnet=\" KmsLibrary \" pulumi-lang-go=\" kmsLibrary \" pulumi-lang-python=\" kms_library \" pulumi-lang-yaml=\" kmsLibrary \" pulumi-lang-java=\" kmsLibrary \" pulumi-lang-hcl=\" kms_library \"\u003e kmsLibrary \u003c/span\u003estanza to use from Vault's config to lookup the local library path\n" }, "maxParallel": { "type": "integer", "description": "The number of concurrent requests that may be in flight to the HSM at any given time. Default is 1\n" }, "mechanism": { "type": "string", "description": "The encryption/decryption mechanism to use, specified as a hexadecimal (prefixed by 0x) string.\n" }, "name": { "type": "string", "description": "A unique lowercase name that serves as identifying the key\n" }, "pin": { "type": "string", "description": "The PIN for login\n" }, "slot": { "type": "string", "description": "The slot number to use, specified as a string in a decimal format (e.g. '2305843009213693953')\n" }, "tokenLabel": { "type": "string", "description": "The slot token label to use\n" }, "usages": { "type": "array", "items": { "type": "string" }, "description": "A list of the allowed usages of this key. Valid values are encrypt, decrypt, sign, verify, wrap, unwrap, mac, and generate_random. Default values are sign and verify.\n" }, "uuid": { "type": "string", "description": "ID of the managed key read from Vault\n" } }, "type": "object", "required": [ "library", "mechanism", "name", "pin" ], "language": { "nodejs": { "requiredOutputs": [ "allowGenerateKey", "allowReplaceKey", "allowStoreKey", "anyMount", "library", "maxParallel", "mechanism", "name", "pin", "usages", "uuid" ] } } }, "vault:okta/AuthBackendGroup:AuthBackendGroup": { "properties": { "groupName": { "type": "string", "description": "Name of the Okta group\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Policies to associate with this group\n" } }, "type": "object", "required": [ "groupName", "policies" ] }, "vault:okta/AuthBackendTune:AuthBackendTune": { "properties": { "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and allowing a plugin to include them in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtl": { "type": "string", "description": "Specifies the default time-to-live duration. This overrides the global default. A value of 0 is equivalent to the system default TTL\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint. Valid values are \"unauth\" or \"hidden\". If not set, behaves like \"hidden\".\n" }, "maxLeaseTtl": { "type": "string", "description": "Specifies the maximum time-to-live duration. This overrides the global default. A value of 0 are equivalent and set to the system max TTL.\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and pass from the request to the backend.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by the mount.\n" } }, "type": "object" }, "vault:okta/AuthBackendUser:AuthBackendUser": { "properties": { "groups": { "type": "array", "items": { "type": "string" }, "description": "Groups within the Okta auth backend to associate with this user\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Policies to associate with this user\n" }, "username": { "type": "string", "description": "Name of the user within Okta\n" } }, "type": "object", "required": [ "username" ] }, "vault:pkiSecret/BackendConfigCmpv2Authenticators:BackendConfigCmpv2Authenticators": { "properties": { "cert": { "type": "object", "additionalProperties": { "type": "string" }, "description": "\"The accessor (required) and\u003cspan pulumi-lang-nodejs=\" certRole \" pulumi-lang-dotnet=\" CertRole \" pulumi-lang-go=\" certRole \" pulumi-lang-python=\" cert_role \" pulumi-lang-yaml=\" certRole \" pulumi-lang-java=\" certRole \" pulumi-lang-hcl=\" cert_role \"\u003e certRole \u003c/span\u003e(optional) properties for cert auth backends\".\n" } }, "type": "object" }, "vault:pkiSecret/BackendConfigEstAuthenticators:BackendConfigEstAuthenticators": { "properties": { "cert": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The accessor (required) and\u003cspan pulumi-lang-nodejs=\" certRole \" pulumi-lang-dotnet=\" CertRole \" pulumi-lang-go=\" certRole \" pulumi-lang-python=\" cert_role \" pulumi-lang-yaml=\" certRole \" pulumi-lang-java=\" certRole \" pulumi-lang-hcl=\" cert_role \"\u003e certRole \u003c/span\u003e(optional) properties for cert auth backends.\n" }, "userpass": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The accessor (required) property for user pass auth backends.\n" } }, "type": "object" }, "vault:pkiSecret/BackendConfigScepAuthenticators:BackendConfigScepAuthenticators": { "properties": { "cert": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The accessor and\u003cspan pulumi-lang-nodejs=\" certRole \" pulumi-lang-dotnet=\" CertRole \" pulumi-lang-go=\" certRole \" pulumi-lang-python=\" cert_role \" pulumi-lang-yaml=\" certRole \" pulumi-lang-java=\" certRole \" pulumi-lang-hcl=\" cert_role \"\u003e certRole \u003c/span\u003eproperties for cert auth backends\n" }, "scep": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The accessor property for SCEP auth backends\n" } }, "type": "object" }, "vault:pkiSecret/BackendConfigScepExternalValidation:BackendConfigScepExternalValidation": { "properties": { "intune": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The credentials to enable Microsoft Intune validation of SCEP requests\n" } }, "type": "object" }, "vault:pkiSecret/SecretBackendRolePolicyIdentifier:SecretBackendRolePolicyIdentifier": { "properties": { "cps": { "type": "string", "description": "The URL of the CPS for the policy identifier\n" }, "notice": { "type": "string", "description": "A notice for the policy identifier\n" }, "oid": { "type": "string", "description": "The OID for the policy identifier\n" } }, "type": "object", "required": [ "oid" ] }, "vault:pkiSecret/getBackendConfigCmpv2Authenticator:getBackendConfigCmpv2Authenticator": { "properties": { "cert": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The accessor and\u003cspan pulumi-lang-nodejs=\" certRole \" pulumi-lang-dotnet=\" CertRole \" pulumi-lang-go=\" certRole \" pulumi-lang-python=\" cert_role \" pulumi-lang-yaml=\" certRole \" pulumi-lang-java=\" certRole \" pulumi-lang-hcl=\" cert_role \"\u003e certRole \u003c/span\u003eproperties for cert auth backends\n" } }, "type": "object" }, "vault:pkiSecret/getBackendConfigEstAuthenticator:getBackendConfigEstAuthenticator": { "properties": { "cert": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The accessor and\u003cspan pulumi-lang-nodejs=\" certRole \" pulumi-lang-dotnet=\" CertRole \" pulumi-lang-go=\" certRole \" pulumi-lang-python=\" cert_role \" pulumi-lang-yaml=\" certRole \" pulumi-lang-java=\" certRole \" pulumi-lang-hcl=\" cert_role \"\u003e certRole \u003c/span\u003eproperties for cert auth backends.\n" }, "userpass": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The accessor property for user pass auth backends.\n" } }, "type": "object" }, "vault:pkiSecret/getBackendConfigScepAuthenticator:getBackendConfigScepAuthenticator": { "properties": { "cert": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The accessor and\u003cspan pulumi-lang-nodejs=\" certRole \" pulumi-lang-dotnet=\" CertRole \" pulumi-lang-go=\" certRole \" pulumi-lang-python=\" cert_role \" pulumi-lang-yaml=\" certRole \" pulumi-lang-java=\" certRole \" pulumi-lang-hcl=\" cert_role \"\u003e certRole \u003c/span\u003eproperties for cert auth backends.\n" }, "scep": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The accessor property for scep auth backends.\n" } }, "type": "object" }, "vault:pkiSecret/getBackendConfigScepExternalValidation:getBackendConfigScepExternalValidation": { "properties": { "intune": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The tenant_id, client_id,\u003cspan pulumi-lang-nodejs=\" clientSecret \" pulumi-lang-dotnet=\" ClientSecret \" pulumi-lang-go=\" clientSecret \" pulumi-lang-python=\" client_secret \" pulumi-lang-yaml=\" clientSecret \" pulumi-lang-java=\" clientSecret \" pulumi-lang-hcl=\" client_secret \"\u003e clientSecret \u003c/span\u003eand environment properties for Microsoft Intune validation of SCEP requests.\n" } }, "type": "object" }, "vault:rabbitMq/SecretBackendRoleVhost:SecretBackendRoleVhost": { "properties": { "configure": { "type": "string", "description": "The configure permissions for this vhost.\n" }, "host": { "type": "string", "description": "The vhost to set permissions for.\n" }, "read": { "type": "string", "description": "The read permissions for this vhost.\n" }, "write": { "type": "string", "description": "The write permissions for this vhost.\n" } }, "type": "object", "required": [ "configure", "host", "read", "write" ] }, "vault:rabbitMq/SecretBackendRoleVhostTopic:SecretBackendRoleVhostTopic": { "properties": { "host": { "type": "string", "description": "The vhost to set permissions for.\n" }, "vhosts": { "type": "array", "items": { "$ref": "#/types/vault:rabbitMq/SecretBackendRoleVhostTopicVhost:SecretBackendRoleVhostTopicVhost" }, "description": "Specifies a map of virtual hosts to permissions.\n" } }, "type": "object", "required": [ "host" ] }, "vault:rabbitMq/SecretBackendRoleVhostTopicVhost:SecretBackendRoleVhostTopicVhost": { "properties": { "read": { "type": "string", "description": "The read permissions for this vhost.\n" }, "topic": { "type": "string", "description": "The vhost to set permissions for.\n" }, "write": { "type": "string", "description": "The write permissions for this vhost.\n" } }, "type": "object", "required": [ "read", "topic", "write" ] }, "vault:saml/AuthBackendTune:AuthBackendTune": { "properties": { "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and allowing\na plugin to include them in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will\nnot be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtl": { "type": "string", "description": "Specifies the default time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in\nthe UI-specific listing endpoint. Valid values are \"unauth\" or \"hidden\".\n" }, "maxLeaseTtl": { "type": "string", "description": "Specifies the maximum time-to-live.\nIf set, this overrides the global default.\nMust be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to whitelist and\npass from the request to the backend.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" } }, "type": "object" }, "vault:secrets/SyncAssociationMetadata:SyncAssociationMetadata": { "properties": { "subKey": { "type": "string", "description": "Subkey of the associated secret.\n" }, "syncStatus": { "type": "string", "description": "A map of sync statuses for each subkey of the associated secret\n(for ex. `{kv_624bea/aws-token/dev: \"SYNCED\", kv_624bea/aws-token/prod: \"SYNCED\"}`).\n" }, "updatedAt": { "type": "string", "description": "A map of duration strings specifying when each subkey of the associated\nsecret was last updated.\n(for ex.\n`{kv_624bea/aws-token/dev: \"2024-03-21T12:42:02.558533-07:00\",\nkv_624bea/aws-token/prod: \"2024-03-21T12:42:02.558533-07:00\"}`).\n" } }, "type": "object", "language": { "nodejs": { "requiredOutputs": [ "subKey", "syncStatus", "updatedAt" ] } } }, "vault:ssh/SecretBackendRoleAllowedUserKeyConfig:SecretBackendRoleAllowedUserKeyConfig": { "properties": { "lengths": { "type": "array", "items": { "type": "integer" }, "description": "List of allowed key lengths, vault-1.10 and above\n" }, "type": { "type": "string", "description": "Key type, choices:\nrsa, ecdsa, ec, dsa, ed25519, ssh-rsa, ssh-dss, ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521\n" } }, "type": "object", "required": [ "lengths", "type" ] } }, "provider": { "description": "The provider type for the vault package. By default, resources use package-wide configuration\nsettings, however an explicit `Provider` instance may be created and passed during resource\nconstruction to achieve fine-grained programmatic control over provider settings. See the\n[documentation](https://www.pulumi.com/docs/reference/programming-model/#providers) for more information.\n", "properties": { "addAddressToEnv": { "type": "string", "description": "If true, adds the value of the \u003cspan pulumi-lang-nodejs=\"`address`\" pulumi-lang-dotnet=\"`Address`\" pulumi-lang-go=\"`address`\" pulumi-lang-python=\"`address`\" pulumi-lang-yaml=\"`address`\" pulumi-lang-java=\"`address`\" pulumi-lang-hcl=\"`address`\"\u003e`address`\u003c/span\u003e argument to the Terraform process environment." }, "address": { "type": "string", "description": "URL of the root of the target Vault server." }, "authLogin": { "$ref": "#/types/vault:index/ProviderAuthLogin:ProviderAuthLogin", "description": "Login to vault with an existing auth method using auth/\u003cmount\u003e/login" }, "authLoginAws": { "$ref": "#/types/vault:index/ProviderAuthLoginAws:ProviderAuthLoginAws", "description": "Login to vault using the AWS method" }, "authLoginAzure": { "$ref": "#/types/vault:index/ProviderAuthLoginAzure:ProviderAuthLoginAzure", "description": "Login to vault using the azure method" }, "authLoginCert": { "$ref": "#/types/vault:index/ProviderAuthLoginCert:ProviderAuthLoginCert", "description": "Login to vault using the cert method" }, "authLoginGcp": { "$ref": "#/types/vault:index/ProviderAuthLoginGcp:ProviderAuthLoginGcp", "description": "Login to vault using the gcp method" }, "authLoginJwt": { "$ref": "#/types/vault:index/ProviderAuthLoginJwt:ProviderAuthLoginJwt", "description": "Login to vault using the jwt method" }, "authLoginKerberos": { "$ref": "#/types/vault:index/ProviderAuthLoginKerberos:ProviderAuthLoginKerberos", "description": "Login to vault using the kerberos method" }, "authLoginOci": { "$ref": "#/types/vault:index/ProviderAuthLoginOci:ProviderAuthLoginOci", "description": "Login to vault using the OCI method" }, "authLoginOidc": { "$ref": "#/types/vault:index/ProviderAuthLoginOidc:ProviderAuthLoginOidc", "description": "Login to vault using the oidc method" }, "authLoginRadius": { "$ref": "#/types/vault:index/ProviderAuthLoginRadius:ProviderAuthLoginRadius", "description": "Login to vault using the radius method" }, "authLoginTokenFile": { "$ref": "#/types/vault:index/ProviderAuthLoginTokenFile:ProviderAuthLoginTokenFile", "description": "Login to vault using" }, "authLoginUserpass": { "$ref": "#/types/vault:index/ProviderAuthLoginUserpass:ProviderAuthLoginUserpass", "description": "Login to vault using the userpass method" }, "caCertDir": { "type": "string", "description": "Path to directory containing CA certificate files to validate the server's certificate." }, "caCertFile": { "type": "string", "description": "Path to a CA certificate file to validate the server's certificate." }, "clientAuth": { "$ref": "#/types/vault:index/ProviderClientAuth:ProviderClientAuth", "description": "Client authentication credentials." }, "headers": { "type": "array", "items": { "$ref": "#/types/vault:index/ProviderHeader:ProviderHeader" }, "description": "The headers to send with each Vault request." }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum TTL for secret leases requested by this provider." }, "maxRetries": { "type": "integer", "description": "Maximum number of retries when a 5xx error code is encountered." }, "maxRetriesCcc": { "type": "integer", "description": "Maximum number of retries for Client Controlled Consistency related operations" }, "namespace": { "type": "string", "description": "The namespace to use. Available only for Vault Enterprise." }, "setNamespaceFromToken": { "type": "boolean", "description": "In the case where the Vault token is for a specific namespace and the provider namespace is not configured, use the token namespace as the root namespace for all resources." }, "skipChildToken": { "type": "boolean", "description": "Set this to true to prevent the creation of ephemeral child token used by this provider." }, "skipGetVaultVersion": { "type": "boolean", "description": "Skip the dynamic fetching of the Vault server version." }, "skipTlsVerify": { "type": "boolean", "description": "Set this to true only if the target Vault server is an insecure development instance." }, "tlsServerName": { "type": "string", "description": "Name to use as the SNI host when connecting via TLS." }, "token": { "type": "string", "description": "Token to use to authenticate to Vault." }, "tokenName": { "type": "string", "description": "Token name to use for creating the Vault child token." }, "vaultVersionOverride": { "type": "string", "description": "Override the Vault server version, which is normally determined dynamically from the target Vault server" } }, "inputProperties": { "addAddressToEnv": { "type": "string", "description": "If true, adds the value of the \u003cspan pulumi-lang-nodejs=\"`address`\" pulumi-lang-dotnet=\"`Address`\" pulumi-lang-go=\"`address`\" pulumi-lang-python=\"`address`\" pulumi-lang-yaml=\"`address`\" pulumi-lang-java=\"`address`\" pulumi-lang-hcl=\"`address`\"\u003e`address`\u003c/span\u003e argument to the Terraform process environment." }, "address": { "type": "string", "description": "URL of the root of the target Vault server." }, "authLogin": { "$ref": "#/types/vault:index/ProviderAuthLogin:ProviderAuthLogin", "description": "Login to vault with an existing auth method using auth/\u003cmount\u003e/login" }, "authLoginAws": { "$ref": "#/types/vault:index/ProviderAuthLoginAws:ProviderAuthLoginAws", "description": "Login to vault using the AWS method" }, "authLoginAzure": { "$ref": "#/types/vault:index/ProviderAuthLoginAzure:ProviderAuthLoginAzure", "description": "Login to vault using the azure method" }, "authLoginCert": { "$ref": "#/types/vault:index/ProviderAuthLoginCert:ProviderAuthLoginCert", "description": "Login to vault using the cert method" }, "authLoginGcp": { "$ref": "#/types/vault:index/ProviderAuthLoginGcp:ProviderAuthLoginGcp", "description": "Login to vault using the gcp method" }, "authLoginJwt": { "$ref": "#/types/vault:index/ProviderAuthLoginJwt:ProviderAuthLoginJwt", "description": "Login to vault using the jwt method" }, "authLoginKerberos": { "$ref": "#/types/vault:index/ProviderAuthLoginKerberos:ProviderAuthLoginKerberos", "description": "Login to vault using the kerberos method" }, "authLoginOci": { "$ref": "#/types/vault:index/ProviderAuthLoginOci:ProviderAuthLoginOci", "description": "Login to vault using the OCI method" }, "authLoginOidc": { "$ref": "#/types/vault:index/ProviderAuthLoginOidc:ProviderAuthLoginOidc", "description": "Login to vault using the oidc method" }, "authLoginRadius": { "$ref": "#/types/vault:index/ProviderAuthLoginRadius:ProviderAuthLoginRadius", "description": "Login to vault using the radius method" }, "authLoginTokenFile": { "$ref": "#/types/vault:index/ProviderAuthLoginTokenFile:ProviderAuthLoginTokenFile", "description": "Login to vault using" }, "authLoginUserpass": { "$ref": "#/types/vault:index/ProviderAuthLoginUserpass:ProviderAuthLoginUserpass", "description": "Login to vault using the userpass method" }, "caCertDir": { "type": "string", "description": "Path to directory containing CA certificate files to validate the server's certificate." }, "caCertFile": { "type": "string", "description": "Path to a CA certificate file to validate the server's certificate." }, "clientAuth": { "$ref": "#/types/vault:index/ProviderClientAuth:ProviderClientAuth", "description": "Client authentication credentials." }, "headers": { "type": "array", "items": { "$ref": "#/types/vault:index/ProviderHeader:ProviderHeader" }, "description": "The headers to send with each Vault request." }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum TTL for secret leases requested by this provider.", "default": 1200, "defaultInfo": { "environment": [ "TERRAFORM_VAULT_MAX_TTL" ] } }, "maxRetries": { "type": "integer", "description": "Maximum number of retries when a 5xx error code is encountered.", "default": 2, "defaultInfo": { "environment": [ "VAULT_MAX_RETRIES" ] } }, "maxRetriesCcc": { "type": "integer", "description": "Maximum number of retries for Client Controlled Consistency related operations" }, "namespace": { "type": "string", "description": "The namespace to use. Available only for Vault Enterprise." }, "setNamespaceFromToken": { "type": "boolean", "description": "In the case where the Vault token is for a specific namespace and the provider namespace is not configured, use the token namespace as the root namespace for all resources." }, "skipChildToken": { "type": "boolean", "description": "Set this to true to prevent the creation of ephemeral child token used by this provider." }, "skipGetVaultVersion": { "type": "boolean", "description": "Skip the dynamic fetching of the Vault server version." }, "skipTlsVerify": { "type": "boolean", "description": "Set this to true only if the target Vault server is an insecure development instance.", "defaultInfo": { "environment": [ "VAULT_SKIP_VERIFY" ] } }, "tlsServerName": { "type": "string", "description": "Name to use as the SNI host when connecting via TLS." }, "token": { "type": "string", "description": "Token to use to authenticate to Vault." }, "tokenName": { "type": "string", "description": "Token name to use for creating the Vault child token." }, "vaultVersionOverride": { "type": "string", "description": "Override the Vault server version, which is normally determined dynamically from the target Vault server" } }, "methods": { "terraformConfig": "pulumi:providers:vault/terraformConfig" } }, "resources": { "vault:ad/secretBackend:SecretBackend": { "description": "\u003e **Note** This resource is replaced by \u003cspan pulumi-lang-nodejs=\"\"vault.ldap.SecretBackend\"\" pulumi-lang-dotnet=\"\"vault.ldap.SecretBackend\"\" pulumi-lang-go=\"\"ldap.SecretBackend\"\" pulumi-lang-python=\"\"ldap.SecretBackend\"\" pulumi-lang-yaml=\"\"vault.ldap.SecretBackend\"\" pulumi-lang-java=\"\"vault.ldap.SecretBackend\"\" pulumi-lang-hcl=\"\"vault_ldap_secret_backend\"\"\u003e\"vault.ldap.SecretBackend\"\u003c/span\u003e and will\nbe removed in the next major release.\n\nCreates an Active Directory Secret Backend for Vault. Active Directory secret backend\nrotates existing Active Directory service account passwords based on the TTL of the role.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.ad.SecretBackend(\"config\", {\n backend: \"ad\",\n binddn: \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass: \"SuperSecretPassw0rd\",\n url: \"ldaps://ad\",\n insecureTls: true,\n userdn: \"CN=Users,DC=corp,DC=example,DC=net\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.ad.SecretBackend(\"config\",\n backend=\"ad\",\n binddn=\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass=\"SuperSecretPassw0rd\",\n url=\"ldaps://ad\",\n insecure_tls=True,\n userdn=\"CN=Users,DC=corp,DC=example,DC=net\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.AD.SecretBackend(\"config\", new()\n {\n Backend = \"ad\",\n Binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n Bindpass = \"SuperSecretPassw0rd\",\n Url = \"ldaps://ad\",\n InsecureTls = true,\n Userdn = \"CN=Users,DC=corp,DC=example,DC=net\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ad\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := ad.NewSecretBackend(ctx, \"config\", \u0026ad.SecretBackendArgs{\n\t\t\tBackend: pulumi.String(\"ad\"),\n\t\t\tBinddn: pulumi.String(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t\tBindpass: pulumi.String(\"SuperSecretPassw0rd\"),\n\t\t\tUrl: pulumi.String(\"ldaps://ad\"),\n\t\t\tInsecureTls: pulumi.Bool(true),\n\t\t\tUserdn: pulumi.String(\"CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ad_secretbackend\" \"config\" {\n backend = \"ad\"\n binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"\n bindpass = \"SuperSecretPassw0rd\"\n url = \"ldaps://ad\"\n insecure_tls = \"true\"\n userdn = \"CN=Users,DC=corp,DC=example,DC=net\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ad.SecretBackend;\nimport com.pulumi.vault.ad.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .backend(\"ad\")\n .binddn(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\")\n .bindpass(\"SuperSecretPassw0rd\")\n .url(\"ldaps://ad\")\n .insecureTls(true)\n .userdn(\"CN=Users,DC=corp,DC=example,DC=net\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:ad:SecretBackend\n properties:\n backend: ad\n binddn: CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\n bindpass: SuperSecretPassw0rd\n url: ldaps://ad\n insecureTls: 'true'\n userdn: CN=Users,DC=corp,DC=example,DC=net\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAD secret backend can be imported using the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:ad/secretBackend:SecretBackend ad ad\n```\n\n", "properties": { "anonymousGroupSearch": { "type": "boolean", "description": "Use anonymous binds when performing LDAP group searches\n(if true the initial credentials will still be used for the initial connection test).\n" }, "backend": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ad`\" pulumi-lang-dotnet=\"`Ad`\" pulumi-lang-go=\"`ad`\" pulumi-lang-python=\"`ad`\" pulumi-lang-yaml=\"`ad`\" pulumi-lang-java=\"`ad`\" pulumi-lang-hcl=\"`ad`\"\u003e`ad`\u003c/span\u003e.\n" }, "binddn": { "type": "string", "description": "Distinguished name of object to bind when performing user and group search.\n" }, "bindpass": { "type": "string", "description": "Password to use along with binddn when performing user search.\n", "secret": true }, "caseSensitiveNames": { "type": "boolean", "description": "If set, user and group names assigned to policies within the\nbackend will be case sensitive. Otherwise, names will be normalized to lower case.\n" }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be\nx509 PEM encoded.\n" }, "clientTlsCert": { "type": "string", "description": "Client certificate to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "clientTlsKey": { "type": "string", "description": "Client certificate key to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds.\n" }, "denyNullBind": { "type": "boolean", "description": "Denies an unauthenticated LDAP bind request if the user's password is empty;\ndefaults to true.\n" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the Active Directory backend.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover the bind Distinguished Name of a user.\n" }, "groupattr": { "type": "string", "description": "LDAP attribute to follow on objects returned by \u003cgroupfilter\u003e in order to enumerate\nuser group membership. Examples: \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e or `memberOf`, etc. Defaults to \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e.\n" }, "groupdn": { "type": "string", "description": "LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org).\n" }, "groupfilter": { "type": "string", "description": "Go template for querying group membership of user (optional) The template can access\nthe following context variables: UserDN, Username. Defaults to `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))`\n" }, "insecureTls": { "type": "boolean", "description": "Skip LDAP server SSL Certificate verification. This is not recommended for production.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "lastRotationTolerance": { "type": "integer", "description": "The number of seconds after a Vault rotation where, if Active Directory\nshows a later rotation, it should be considered out-of-band\n" }, "local": { "type": "boolean", "description": "Mark the secrets engine as local-only. Local engines are not replicated or removed by\nreplication.Tolerance duration to use when checking the last rotation time.\n" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds.\n" }, "maxTtl": { "type": "integer", "description": "In seconds, the maximum password time-to-live.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords.\n" }, "requestTimeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server\nbefore returning back an error.\n" }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing unencrypted connection.\n" }, "tlsMaxVersion": { "type": "string", "description": "Maximum TLS version to use. Accepted values are \u003cspan pulumi-lang-nodejs=\"`tls10`\" pulumi-lang-dotnet=\"`Tls10`\" pulumi-lang-go=\"`tls10`\" pulumi-lang-python=\"`tls10`\" pulumi-lang-yaml=\"`tls10`\" pulumi-lang-java=\"`tls10`\" pulumi-lang-hcl=\"`tls10`\"\u003e`tls10`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`tls11`\" pulumi-lang-dotnet=\"`Tls11`\" pulumi-lang-go=\"`tls11`\" pulumi-lang-python=\"`tls11`\" pulumi-lang-yaml=\"`tls11`\" pulumi-lang-java=\"`tls11`\" pulumi-lang-hcl=\"`tls11`\"\u003e`tls11`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e.\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to use. Accepted values are \u003cspan pulumi-lang-nodejs=\"`tls10`\" pulumi-lang-dotnet=\"`Tls10`\" pulumi-lang-go=\"`tls10`\" pulumi-lang-python=\"`tls10`\" pulumi-lang-yaml=\"`tls10`\" pulumi-lang-java=\"`tls10`\" pulumi-lang-hcl=\"`tls10`\"\u003e`tls10`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`tls11`\" pulumi-lang-dotnet=\"`Tls11`\" pulumi-lang-go=\"`tls11`\" pulumi-lang-python=\"`tls11`\" pulumi-lang-yaml=\"`tls11`\" pulumi-lang-java=\"`tls11`\" pulumi-lang-hcl=\"`tls11`\"\u003e`tls11`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "In seconds, the default password time-to-live.\n" }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain.\n" }, "url": { "type": "string", "description": "LDAP URL to connect to. Multiple URLs can be specified by concatenating\nthem with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.\n" }, "usePre111GroupCnBehavior": { "type": "boolean", "description": "In Vault 1.1.1 a fix for handling group CN values of\ndifferent cases unfortunately introduced a regression that could cause previously defined groups\nto not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for\nmatching group CNs will be used. This is only needed in some upgrade scenarios for backwards\ncompatibility. It is enabled by default if the config is upgraded but disabled by default on\nnew configurations.\n" }, "useTokenGroups": { "type": "boolean", "description": "If true, use the Active Directory tokenGroups constructed attribute of the\nuser to find the group memberships. This will find all security groups including nested ones.\n" }, "userattr": { "type": "string", "description": "Attribute used when searching users. Defaults to \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e.\n" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.\n" } }, "required": [ "binddn", "bindpass", "defaultLeaseTtlSeconds", "lastRotationTolerance", "maxLeaseTtlSeconds", "maxTtl", "starttls", "tlsMaxVersion", "tlsMinVersion", "ttl", "upndomain", "usePre111GroupCnBehavior" ], "inputProperties": { "anonymousGroupSearch": { "type": "boolean", "description": "Use anonymous binds when performing LDAP group searches\n(if true the initial credentials will still be used for the initial connection test).\n" }, "backend": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ad`\" pulumi-lang-dotnet=\"`Ad`\" pulumi-lang-go=\"`ad`\" pulumi-lang-python=\"`ad`\" pulumi-lang-yaml=\"`ad`\" pulumi-lang-java=\"`ad`\" pulumi-lang-hcl=\"`ad`\"\u003e`ad`\u003c/span\u003e.\n" }, "binddn": { "type": "string", "description": "Distinguished name of object to bind when performing user and group search.\n" }, "bindpass": { "type": "string", "description": "Password to use along with binddn when performing user search.\n", "secret": true }, "caseSensitiveNames": { "type": "boolean", "description": "If set, user and group names assigned to policies within the\nbackend will be case sensitive. Otherwise, names will be normalized to lower case.\n" }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be\nx509 PEM encoded.\n" }, "clientTlsCert": { "type": "string", "description": "Client certificate to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "clientTlsKey": { "type": "string", "description": "Client certificate key to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds.\n" }, "denyNullBind": { "type": "boolean", "description": "Denies an unauthenticated LDAP bind request if the user's password is empty;\ndefaults to true.\n" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the Active Directory backend.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover the bind Distinguished Name of a user.\n" }, "groupattr": { "type": "string", "description": "LDAP attribute to follow on objects returned by \u003cgroupfilter\u003e in order to enumerate\nuser group membership. Examples: \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e or `memberOf`, etc. Defaults to \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e.\n" }, "groupdn": { "type": "string", "description": "LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org).\n" }, "groupfilter": { "type": "string", "description": "Go template for querying group membership of user (optional) The template can access\nthe following context variables: UserDN, Username. Defaults to `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))`\n" }, "insecureTls": { "type": "boolean", "description": "Skip LDAP server SSL Certificate verification. This is not recommended for production.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "lastRotationTolerance": { "type": "integer", "description": "The number of seconds after a Vault rotation where, if Active Directory\nshows a later rotation, it should be considered out-of-band\n" }, "local": { "type": "boolean", "description": "Mark the secrets engine as local-only. Local engines are not replicated or removed by\nreplication.Tolerance duration to use when checking the last rotation time.\n" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds.\n" }, "maxTtl": { "type": "integer", "description": "In seconds, the maximum password time-to-live.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords.\n" }, "requestTimeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server\nbefore returning back an error.\n" }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing unencrypted connection.\n" }, "tlsMaxVersion": { "type": "string", "description": "Maximum TLS version to use. Accepted values are \u003cspan pulumi-lang-nodejs=\"`tls10`\" pulumi-lang-dotnet=\"`Tls10`\" pulumi-lang-go=\"`tls10`\" pulumi-lang-python=\"`tls10`\" pulumi-lang-yaml=\"`tls10`\" pulumi-lang-java=\"`tls10`\" pulumi-lang-hcl=\"`tls10`\"\u003e`tls10`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`tls11`\" pulumi-lang-dotnet=\"`Tls11`\" pulumi-lang-go=\"`tls11`\" pulumi-lang-python=\"`tls11`\" pulumi-lang-yaml=\"`tls11`\" pulumi-lang-java=\"`tls11`\" pulumi-lang-hcl=\"`tls11`\"\u003e`tls11`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e.\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to use. Accepted values are \u003cspan pulumi-lang-nodejs=\"`tls10`\" pulumi-lang-dotnet=\"`Tls10`\" pulumi-lang-go=\"`tls10`\" pulumi-lang-python=\"`tls10`\" pulumi-lang-yaml=\"`tls10`\" pulumi-lang-java=\"`tls10`\" pulumi-lang-hcl=\"`tls10`\"\u003e`tls10`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`tls11`\" pulumi-lang-dotnet=\"`Tls11`\" pulumi-lang-go=\"`tls11`\" pulumi-lang-python=\"`tls11`\" pulumi-lang-yaml=\"`tls11`\" pulumi-lang-java=\"`tls11`\" pulumi-lang-hcl=\"`tls11`\"\u003e`tls11`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "In seconds, the default password time-to-live.\n" }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain.\n" }, "url": { "type": "string", "description": "LDAP URL to connect to. Multiple URLs can be specified by concatenating\nthem with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.\n" }, "usePre111GroupCnBehavior": { "type": "boolean", "description": "In Vault 1.1.1 a fix for handling group CN values of\ndifferent cases unfortunately introduced a regression that could cause previously defined groups\nto not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for\nmatching group CNs will be used. This is only needed in some upgrade scenarios for backwards\ncompatibility. It is enabled by default if the config is upgraded but disabled by default on\nnew configurations.\n" }, "useTokenGroups": { "type": "boolean", "description": "If true, use the Active Directory tokenGroups constructed attribute of the\nuser to find the group memberships. This will find all security groups including nested ones.\n" }, "userattr": { "type": "string", "description": "Attribute used when searching users. Defaults to \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e.\n" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.\n" } }, "requiredInputs": [ "binddn", "bindpass" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "anonymousGroupSearch": { "type": "boolean", "description": "Use anonymous binds when performing LDAP group searches\n(if true the initial credentials will still be used for the initial connection test).\n" }, "backend": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ad`\" pulumi-lang-dotnet=\"`Ad`\" pulumi-lang-go=\"`ad`\" pulumi-lang-python=\"`ad`\" pulumi-lang-yaml=\"`ad`\" pulumi-lang-java=\"`ad`\" pulumi-lang-hcl=\"`ad`\"\u003e`ad`\u003c/span\u003e.\n" }, "binddn": { "type": "string", "description": "Distinguished name of object to bind when performing user and group search.\n" }, "bindpass": { "type": "string", "description": "Password to use along with binddn when performing user search.\n", "secret": true }, "caseSensitiveNames": { "type": "boolean", "description": "If set, user and group names assigned to policies within the\nbackend will be case sensitive. Otherwise, names will be normalized to lower case.\n" }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be\nx509 PEM encoded.\n" }, "clientTlsCert": { "type": "string", "description": "Client certificate to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "clientTlsKey": { "type": "string", "description": "Client certificate key to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds.\n" }, "denyNullBind": { "type": "boolean", "description": "Denies an unauthenticated LDAP bind request if the user's password is empty;\ndefaults to true.\n" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the Active Directory backend.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover the bind Distinguished Name of a user.\n" }, "groupattr": { "type": "string", "description": "LDAP attribute to follow on objects returned by \u003cgroupfilter\u003e in order to enumerate\nuser group membership. Examples: \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e or `memberOf`, etc. Defaults to \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e.\n" }, "groupdn": { "type": "string", "description": "LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org).\n" }, "groupfilter": { "type": "string", "description": "Go template for querying group membership of user (optional) The template can access\nthe following context variables: UserDN, Username. Defaults to `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))`\n" }, "insecureTls": { "type": "boolean", "description": "Skip LDAP server SSL Certificate verification. This is not recommended for production.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "lastRotationTolerance": { "type": "integer", "description": "The number of seconds after a Vault rotation where, if Active Directory\nshows a later rotation, it should be considered out-of-band\n" }, "local": { "type": "boolean", "description": "Mark the secrets engine as local-only. Local engines are not replicated or removed by\nreplication.Tolerance duration to use when checking the last rotation time.\n" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds.\n" }, "maxTtl": { "type": "integer", "description": "In seconds, the maximum password time-to-live.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords.\n" }, "requestTimeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server\nbefore returning back an error.\n" }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing unencrypted connection.\n" }, "tlsMaxVersion": { "type": "string", "description": "Maximum TLS version to use. Accepted values are \u003cspan pulumi-lang-nodejs=\"`tls10`\" pulumi-lang-dotnet=\"`Tls10`\" pulumi-lang-go=\"`tls10`\" pulumi-lang-python=\"`tls10`\" pulumi-lang-yaml=\"`tls10`\" pulumi-lang-java=\"`tls10`\" pulumi-lang-hcl=\"`tls10`\"\u003e`tls10`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`tls11`\" pulumi-lang-dotnet=\"`Tls11`\" pulumi-lang-go=\"`tls11`\" pulumi-lang-python=\"`tls11`\" pulumi-lang-yaml=\"`tls11`\" pulumi-lang-java=\"`tls11`\" pulumi-lang-hcl=\"`tls11`\"\u003e`tls11`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e.\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to use. Accepted values are \u003cspan pulumi-lang-nodejs=\"`tls10`\" pulumi-lang-dotnet=\"`Tls10`\" pulumi-lang-go=\"`tls10`\" pulumi-lang-python=\"`tls10`\" pulumi-lang-yaml=\"`tls10`\" pulumi-lang-java=\"`tls10`\" pulumi-lang-hcl=\"`tls10`\"\u003e`tls10`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`tls11`\" pulumi-lang-dotnet=\"`Tls11`\" pulumi-lang-go=\"`tls11`\" pulumi-lang-python=\"`tls11`\" pulumi-lang-yaml=\"`tls11`\" pulumi-lang-java=\"`tls11`\" pulumi-lang-hcl=\"`tls11`\"\u003e`tls11`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "In seconds, the default password time-to-live.\n" }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain.\n" }, "url": { "type": "string", "description": "LDAP URL to connect to. Multiple URLs can be specified by concatenating\nthem with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.\n" }, "usePre111GroupCnBehavior": { "type": "boolean", "description": "In Vault 1.1.1 a fix for handling group CN values of\ndifferent cases unfortunately introduced a regression that could cause previously defined groups\nto not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for\nmatching group CNs will be used. This is only needed in some upgrade scenarios for backwards\ncompatibility. It is enabled by default if the config is upgraded but disabled by default on\nnew configurations.\n" }, "useTokenGroups": { "type": "boolean", "description": "If true, use the Active Directory tokenGroups constructed attribute of the\nuser to find the group memberships. This will find all security groups including nested ones.\n" }, "userattr": { "type": "string", "description": "Attribute used when searching users. Defaults to \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e.\n" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.\n" } }, "type": "object" } }, "vault:ad/secretLibrary:SecretLibrary": { "description": "\u003e **Note** This resource is replaced by \u003cspan pulumi-lang-nodejs=\"\"vault.ldap.SecretBackendLibrarySet\"\" pulumi-lang-dotnet=\"\"vault.ldap.SecretBackendLibrarySet\"\" pulumi-lang-go=\"\"ldap.SecretBackendLibrarySet\"\" pulumi-lang-python=\"\"ldap.SecretBackendLibrarySet\"\" pulumi-lang-yaml=\"\"vault.ldap.SecretBackendLibrarySet\"\" pulumi-lang-java=\"\"vault.ldap.SecretBackendLibrarySet\"\" pulumi-lang-hcl=\"\"vault_ldap_secret_backend_library_set\"\"\u003e\"vault.ldap.SecretBackendLibrarySet\"\u003c/span\u003e\nand will be removed in the next major release.\n\nCreates a library on an Active Directory Secret Backend for Vault. Libraries create\na pool of existing Active Directory service accounts which can be checked out\nby users.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.ad.SecretBackend(\"config\", {\n backend: \"ad\",\n binddn: \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass: \"SuperSecretPassw0rd\",\n url: \"ldaps://ad\",\n insecureTls: true,\n userdn: \"CN=Users,DC=corp,DC=example,DC=net\",\n});\nconst qa = new vault.ad.SecretLibrary(\"qa\", {\n backend: config.backend,\n name: \"qa\",\n serviceAccountNames: [\n \"Bob\",\n \"Mary\",\n ],\n ttl: 60,\n disableCheckInEnforcement: true,\n maxTtl: 120,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.ad.SecretBackend(\"config\",\n backend=\"ad\",\n binddn=\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass=\"SuperSecretPassw0rd\",\n url=\"ldaps://ad\",\n insecure_tls=True,\n userdn=\"CN=Users,DC=corp,DC=example,DC=net\")\nqa = vault.ad.SecretLibrary(\"qa\",\n backend=config.backend,\n name=\"qa\",\n service_account_names=[\n \"Bob\",\n \"Mary\",\n ],\n ttl=60,\n disable_check_in_enforcement=True,\n max_ttl=120)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.AD.SecretBackend(\"config\", new()\n {\n Backend = \"ad\",\n Binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n Bindpass = \"SuperSecretPassw0rd\",\n Url = \"ldaps://ad\",\n InsecureTls = true,\n Userdn = \"CN=Users,DC=corp,DC=example,DC=net\",\n });\n\n var qa = new Vault.AD.SecretLibrary(\"qa\", new()\n {\n Backend = config.Backend,\n Name = \"qa\",\n ServiceAccountNames = new[]\n {\n \"Bob\",\n \"Mary\",\n },\n Ttl = 60,\n DisableCheckInEnforcement = true,\n MaxTtl = 120,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ad\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tconfig, err := ad.NewSecretBackend(ctx, \"config\", \u0026ad.SecretBackendArgs{\n\t\t\tBackend: pulumi.String(\"ad\"),\n\t\t\tBinddn: pulumi.String(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t\tBindpass: pulumi.String(\"SuperSecretPassw0rd\"),\n\t\t\tUrl: pulumi.String(\"ldaps://ad\"),\n\t\t\tInsecureTls: pulumi.Bool(true),\n\t\t\tUserdn: pulumi.String(\"CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = ad.NewSecretLibrary(ctx, \"qa\", \u0026ad.SecretLibraryArgs{\n\t\t\tBackend: config.Backend,\n\t\t\tName: pulumi.String(\"qa\"),\n\t\t\tServiceAccountNames: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"Bob\"),\n\t\t\t\tpulumi.String(\"Mary\"),\n\t\t\t},\n\t\t\tTtl: pulumi.Int(60),\n\t\t\tDisableCheckInEnforcement: pulumi.Bool(true),\n\t\t\tMaxTtl: pulumi.Int(120),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ad_secretbackend\" \"config\" {\n backend = \"ad\"\n binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"\n bindpass = \"SuperSecretPassw0rd\"\n url = \"ldaps://ad\"\n insecure_tls = \"true\"\n userdn = \"CN=Users,DC=corp,DC=example,DC=net\"\n}\nresource \"vault_ad_secretlibrary\" \"qa\" {\n backend = vault_ad_secretbackend.config.backend\n name = \"qa\"\n service_account_names = [\"Bob\", \"Mary\"]\n ttl = 60\n disable_check_in_enforcement = true\n max_ttl = 120\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ad.SecretBackend;\nimport com.pulumi.vault.ad.SecretBackendArgs;\nimport com.pulumi.vault.ad.SecretLibrary;\nimport com.pulumi.vault.ad.SecretLibraryArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .backend(\"ad\")\n .binddn(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\")\n .bindpass(\"SuperSecretPassw0rd\")\n .url(\"ldaps://ad\")\n .insecureTls(true)\n .userdn(\"CN=Users,DC=corp,DC=example,DC=net\")\n .build());\n\n var qa = new SecretLibrary(\"qa\", SecretLibraryArgs.builder()\n .backend(config.backend())\n .name(\"qa\")\n .serviceAccountNames( \n \"Bob\",\n \"Mary\")\n .ttl(60)\n .disableCheckInEnforcement(true)\n .maxTtl(120)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:ad:SecretBackend\n properties:\n backend: ad\n binddn: CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\n bindpass: SuperSecretPassw0rd\n url: ldaps://ad\n insecureTls: 'true'\n userdn: CN=Users,DC=corp,DC=example,DC=net\n qa:\n type: vault:ad:SecretLibrary\n properties:\n backend: ${config.backend}\n name: qa\n serviceAccountNames:\n - Bob\n - Mary\n ttl: 60\n disableCheckInEnforcement: true\n maxTtl: 120\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAD secret backend libraries can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:ad/secretLibrary:SecretLibrary role ad/library/bob\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the AD secret backend is mounted at,\nwith no leading or trailing `/`s.\n" }, "disableCheckInEnforcement": { "type": "boolean", "description": "Disable enforcing that service accounts must be checked in by the entity or client token that checked them out." }, "maxTtl": { "type": "integer", "description": "The maximum password time-to-live in seconds. Defaults to the configuration\u003cspan pulumi-lang-nodejs=\"\nmaxTtl \" pulumi-lang-dotnet=\"\nMaxTtl \" pulumi-lang-go=\"\nmaxTtl \" pulumi-lang-python=\"\nmax_ttl \" pulumi-lang-yaml=\"\nmaxTtl \" pulumi-lang-java=\"\nmaxTtl \" pulumi-lang-hcl=\"\nmax_ttl \"\u003e\nmaxTtl \u003c/span\u003eif not provided.\n" }, "name": { "type": "string", "description": "The name to identify this set of service accounts.\nMust be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "serviceAccountNames": { "type": "array", "items": { "type": "string" }, "description": "Specifies the slice of service accounts mapped to this set.\n" }, "ttl": { "type": "integer", "description": "The password time-to-live in seconds. Defaults to the configuration\nttl if not provided.\n" } }, "required": [ "backend", "maxTtl", "name", "serviceAccountNames", "ttl" ], "inputProperties": { "backend": { "type": "string", "description": "The path the AD secret backend is mounted at,\nwith no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "disableCheckInEnforcement": { "type": "boolean", "description": "Disable enforcing that service accounts must be checked in by the entity or client token that checked them out." }, "maxTtl": { "type": "integer", "description": "The maximum password time-to-live in seconds. Defaults to the configuration\u003cspan pulumi-lang-nodejs=\"\nmaxTtl \" pulumi-lang-dotnet=\"\nMaxTtl \" pulumi-lang-go=\"\nmaxTtl \" pulumi-lang-python=\"\nmax_ttl \" pulumi-lang-yaml=\"\nmaxTtl \" pulumi-lang-java=\"\nmaxTtl \" pulumi-lang-hcl=\"\nmax_ttl \"\u003e\nmaxTtl \u003c/span\u003eif not provided.\n" }, "name": { "type": "string", "description": "The name to identify this set of service accounts.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "serviceAccountNames": { "type": "array", "items": { "type": "string" }, "description": "Specifies the slice of service accounts mapped to this set.\n", "willReplaceOnChanges": true }, "ttl": { "type": "integer", "description": "The password time-to-live in seconds. Defaults to the configuration\nttl if not provided.\n" } }, "requiredInputs": [ "backend", "serviceAccountNames" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretLibrary resources.\n", "properties": { "backend": { "type": "string", "description": "The path the AD secret backend is mounted at,\nwith no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "disableCheckInEnforcement": { "type": "boolean", "description": "Disable enforcing that service accounts must be checked in by the entity or client token that checked them out." }, "maxTtl": { "type": "integer", "description": "The maximum password time-to-live in seconds. Defaults to the configuration\u003cspan pulumi-lang-nodejs=\"\nmaxTtl \" pulumi-lang-dotnet=\"\nMaxTtl \" pulumi-lang-go=\"\nmaxTtl \" pulumi-lang-python=\"\nmax_ttl \" pulumi-lang-yaml=\"\nmaxTtl \" pulumi-lang-java=\"\nmaxTtl \" pulumi-lang-hcl=\"\nmax_ttl \"\u003e\nmaxTtl \u003c/span\u003eif not provided.\n" }, "name": { "type": "string", "description": "The name to identify this set of service accounts.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "serviceAccountNames": { "type": "array", "items": { "type": "string" }, "description": "Specifies the slice of service accounts mapped to this set.\n", "willReplaceOnChanges": true }, "ttl": { "type": "integer", "description": "The password time-to-live in seconds. Defaults to the configuration\nttl if not provided.\n" } }, "type": "object" } }, "vault:ad/secretRole:SecretRole": { "description": "\u003e **Note** This resource is replaced by \u003cspan pulumi-lang-nodejs=\"\"vault.ldap.SecretBackendStaticRole\"\" pulumi-lang-dotnet=\"\"vault.ldap.SecretBackendStaticRole\"\" pulumi-lang-go=\"\"ldap.SecretBackendStaticRole\"\" pulumi-lang-python=\"\"ldap.SecretBackendStaticRole\"\" pulumi-lang-yaml=\"\"vault.ldap.SecretBackendStaticRole\"\" pulumi-lang-java=\"\"vault.ldap.SecretBackendStaticRole\"\" pulumi-lang-hcl=\"\"vault_ldap_secret_backend_static_role\"\"\u003e\"vault.ldap.SecretBackendStaticRole\"\u003c/span\u003e\nand will be removed in the next major release.\n\nCreates a role on an Active Directory Secret Backend for Vault. Roles are\nused to map credentials to existing Active Directory service accounts.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.ad.SecretBackend(\"config\", {\n backend: \"ad\",\n binddn: \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass: \"SuperSecretPassw0rd\",\n url: \"ldaps://ad\",\n insecureTls: true,\n userdn: \"CN=Users,DC=corp,DC=example,DC=net\",\n});\nconst role = new vault.ad.SecretRole(\"role\", {\n backend: config.backend,\n role: \"bob\",\n serviceAccountName: \"Bob\",\n ttl: 60,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.ad.SecretBackend(\"config\",\n backend=\"ad\",\n binddn=\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass=\"SuperSecretPassw0rd\",\n url=\"ldaps://ad\",\n insecure_tls=True,\n userdn=\"CN=Users,DC=corp,DC=example,DC=net\")\nrole = vault.ad.SecretRole(\"role\",\n backend=config.backend,\n role=\"bob\",\n service_account_name=\"Bob\",\n ttl=60)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.AD.SecretBackend(\"config\", new()\n {\n Backend = \"ad\",\n Binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n Bindpass = \"SuperSecretPassw0rd\",\n Url = \"ldaps://ad\",\n InsecureTls = true,\n Userdn = \"CN=Users,DC=corp,DC=example,DC=net\",\n });\n\n var role = new Vault.AD.SecretRole(\"role\", new()\n {\n Backend = config.Backend,\n Role = \"bob\",\n ServiceAccountName = \"Bob\",\n Ttl = 60,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ad\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tconfig, err := ad.NewSecretBackend(ctx, \"config\", \u0026ad.SecretBackendArgs{\n\t\t\tBackend: pulumi.String(\"ad\"),\n\t\t\tBinddn: pulumi.String(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t\tBindpass: pulumi.String(\"SuperSecretPassw0rd\"),\n\t\t\tUrl: pulumi.String(\"ldaps://ad\"),\n\t\t\tInsecureTls: pulumi.Bool(true),\n\t\t\tUserdn: pulumi.String(\"CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = ad.NewSecretRole(ctx, \"role\", \u0026ad.SecretRoleArgs{\n\t\t\tBackend: config.Backend,\n\t\t\tRole: pulumi.String(\"bob\"),\n\t\t\tServiceAccountName: pulumi.String(\"Bob\"),\n\t\t\tTtl: pulumi.Int(60),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ad_secretbackend\" \"config\" {\n backend = \"ad\"\n binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"\n bindpass = \"SuperSecretPassw0rd\"\n url = \"ldaps://ad\"\n insecure_tls = \"true\"\n userdn = \"CN=Users,DC=corp,DC=example,DC=net\"\n}\nresource \"vault_ad_secretrole\" \"role\" {\n backend = vault_ad_secretbackend.config.backend\n role = \"bob\"\n service_account_name = \"Bob\"\n ttl = 60\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ad.SecretBackend;\nimport com.pulumi.vault.ad.SecretBackendArgs;\nimport com.pulumi.vault.ad.SecretRole;\nimport com.pulumi.vault.ad.SecretRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .backend(\"ad\")\n .binddn(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\")\n .bindpass(\"SuperSecretPassw0rd\")\n .url(\"ldaps://ad\")\n .insecureTls(true)\n .userdn(\"CN=Users,DC=corp,DC=example,DC=net\")\n .build());\n\n var role = new SecretRole(\"role\", SecretRoleArgs.builder()\n .backend(config.backend())\n .role(\"bob\")\n .serviceAccountName(\"Bob\")\n .ttl(60)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:ad:SecretBackend\n properties:\n backend: ad\n binddn: CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\n bindpass: SuperSecretPassw0rd\n url: ldaps://ad\n insecureTls: 'true'\n userdn: CN=Users,DC=corp,DC=example,DC=net\n role:\n type: vault:ad:SecretRole\n properties:\n backend: ${config.backend}\n role: bob\n serviceAccountName: Bob\n ttl: 60\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAD secret backend roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:ad/secretRole:SecretRole role ad/roles/bob\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the AD secret backend is mounted at,\nwith no leading or trailing `/`s.\n" }, "lastVaultRotation": { "type": "string", "description": "Timestamp of the last password rotation by Vault.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordLastSet": { "type": "string", "description": "Timestamp of the last password set by Vault.\n" }, "role": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n" }, "serviceAccountName": { "type": "string", "description": "Specifies the name of the Active Directory service\naccount mapped to this role.\n" }, "ttl": { "type": "integer", "description": "The password time-to-live in seconds. Defaults to the configuration\nttl if not provided.\n" } }, "required": [ "backend", "lastVaultRotation", "passwordLastSet", "role", "serviceAccountName" ], "inputProperties": { "backend": { "type": "string", "description": "The path the AD secret backend is mounted at,\nwith no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "serviceAccountName": { "type": "string", "description": "Specifies the name of the Active Directory service\naccount mapped to this role.\n" }, "ttl": { "type": "integer", "description": "The password time-to-live in seconds. Defaults to the configuration\nttl if not provided.\n" } }, "requiredInputs": [ "backend", "role", "serviceAccountName" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretRole resources.\n", "properties": { "backend": { "type": "string", "description": "The path the AD secret backend is mounted at,\nwith no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "lastVaultRotation": { "type": "string", "description": "Timestamp of the last password rotation by Vault.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "passwordLastSet": { "type": "string", "description": "Timestamp of the last password set by Vault.\n" }, "role": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "serviceAccountName": { "type": "string", "description": "Specifies the name of the Active Directory service\naccount mapped to this role.\n" }, "ttl": { "type": "integer", "description": "The password time-to-live in seconds. Defaults to the configuration\nttl if not provided.\n" } }, "type": "object" } }, "vault:alicloud/authBackendRole:AuthBackendRole": { "description": "Provides a resource to create a role in an [AliCloud auth backend within Vault](https://www.vaultproject.io/docs/auth/alicloud.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst alicloud = new vault.AuthBackend(\"alicloud\", {\n type: \"alicloud\",\n path: \"alicloud\",\n});\nconst alicloudAuthBackendRole = new vault.alicloud.AuthBackendRole(\"alicloud\", {\n backend: alicloud.path,\n role: \"example\",\n arn: \"acs:ram:123456:tf:role/foobar\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nalicloud = vault.AuthBackend(\"alicloud\",\n type=\"alicloud\",\n path=\"alicloud\")\nalicloud_auth_backend_role = vault.alicloud.AuthBackendRole(\"alicloud\",\n backend=alicloud.path,\n role=\"example\",\n arn=\"acs:ram:123456:tf:role/foobar\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var alicloud = new Vault.AuthBackend(\"alicloud\", new()\n {\n Type = \"alicloud\",\n Path = \"alicloud\",\n });\n\n var alicloudAuthBackendRole = new Vault.AliCloud.AuthBackendRole(\"alicloud\", new()\n {\n Backend = alicloud.Path,\n Role = \"example\",\n Arn = \"acs:ram:123456:tf:role/foobar\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/alicloud\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\talicloud2, err := vault.NewAuthBackend(ctx, \"alicloud\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"alicloud\"),\n\t\t\tPath: pulumi.String(\"alicloud\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = alicloud.NewAuthBackendRole(ctx, \"alicloud\", \u0026alicloud.AuthBackendRoleArgs{\n\t\t\tBackend: alicloud2.Path,\n\t\t\tRole: pulumi.String(\"example\"),\n\t\t\tArn: pulumi.String(\"acs:ram:123456:tf:role/foobar\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"alicloud\" {\n type = \"alicloud\"\n path = \"alicloud\"\n}\nresource \"vault_alicloud_authbackendrole\" \"alicloud\" {\n backend = vault_authbackend.alicloud.path\n role = \"example\"\n arn = \"acs:ram:123456:tf:role/foobar\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.alicloud.AuthBackendRole;\nimport com.pulumi.vault.alicloud.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var alicloud = new AuthBackend(\"alicloud\", AuthBackendArgs.builder()\n .type(\"alicloud\")\n .path(\"alicloud\")\n .build());\n\n var alicloudAuthBackendRole = new AuthBackendRole(\"alicloudAuthBackendRole\", AuthBackendRoleArgs.builder()\n .backend(alicloud.path())\n .role(\"example\")\n .arn(\"acs:ram:123456:tf:role/foobar\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n alicloud:\n type: vault:AuthBackend\n properties:\n type: alicloud\n path: alicloud\n alicloudAuthBackendRole:\n type: vault:alicloud:AuthBackendRole\n name: alicloud\n properties:\n backend: ${alicloud.path}\n role: example\n arn: acs:ram:123456:tf:role/foobar\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAlicloud authentication roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:alicloud/authBackendRole:AuthBackendRole my_role auth/alicloud/role/my_role\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "arn": { "type": "string", "description": "The role's arn.\n" }, "backend": { "type": "string", "description": "Path to the mounted AliCloud auth backend.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`alicloud`\" pulumi-lang-dotnet=\"`Alicloud`\" pulumi-lang-go=\"`alicloud`\" pulumi-lang-python=\"`alicloud`\" pulumi-lang-yaml=\"`alicloud`\" pulumi-lang-java=\"`alicloud`\" pulumi-lang-hcl=\"`alicloud`\"\u003e`alicloud`\u003c/span\u003e\n\nFor more details on the usage of each argument consult the [Vault AliCloud API documentation](https://www.vaultproject.io/api-docs/auth/alicloud).\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n" }, "role": { "type": "string", "description": "Name of the role. Must correspond with the name of\nthe role reflected in the arn.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "arn", "role" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "arn": { "type": "string", "description": "The role's arn.\n" }, "backend": { "type": "string", "description": "Path to the mounted AliCloud auth backend.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`alicloud`\" pulumi-lang-dotnet=\"`Alicloud`\" pulumi-lang-go=\"`alicloud`\" pulumi-lang-python=\"`alicloud`\" pulumi-lang-yaml=\"`alicloud`\" pulumi-lang-java=\"`alicloud`\" pulumi-lang-hcl=\"`alicloud`\"\u003e`alicloud`\u003c/span\u003e\n\nFor more details on the usage of each argument consult the [Vault AliCloud API documentation](https://www.vaultproject.io/api-docs/auth/alicloud).\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "Name of the role. Must correspond with the name of\nthe role reflected in the arn.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "requiredInputs": [ "arn", "role" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "arn": { "type": "string", "description": "The role's arn.\n" }, "backend": { "type": "string", "description": "Path to the mounted AliCloud auth backend.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`alicloud`\" pulumi-lang-dotnet=\"`Alicloud`\" pulumi-lang-go=\"`alicloud`\" pulumi-lang-python=\"`alicloud`\" pulumi-lang-yaml=\"`alicloud`\" pulumi-lang-java=\"`alicloud`\" pulumi-lang-hcl=\"`alicloud`\"\u003e`alicloud`\u003c/span\u003e\n\nFor more details on the usage of each argument consult the [Vault AliCloud API documentation](https://www.vaultproject.io/api-docs/auth/alicloud).\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "Name of the role. Must correspond with the name of\nthe role reflected in the arn.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:alicloud/secretBackend:SecretBackend": { "description": "Manages the AliCloud secrets engine in Vault. The AliCloud secrets engine dynamically generates AliCloud \naccess credentials based on RAM policies. This allows Vault users to gain access to AliCloud resources \nwithout needing to create or manage AliCloud credentials manually.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n### Recommended Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst alicloud = new vault.Mount(\"alicloud\", {\n path: \"alicloud\",\n type: \"alicloud\",\n});\nconst config = new pulumi.Config();\n// AliCloud Access Key ID\nconst alicloudAccessKey = config.require(\"alicloudAccessKey\");\n// AliCloud Secret Access Key\nconst alicloudSecretKey = config.require(\"alicloudSecretKey\");\nconst alicloudSecretBackend = new vault.alicloud.SecretBackend(\"alicloud\", {\n mount: alicloud.path,\n accessKey: alicloudAccessKey,\n secretKeyWo: alicloudSecretKey,\n secretKeyWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nalicloud = vault.Mount(\"alicloud\",\n path=\"alicloud\",\n type=\"alicloud\")\nconfig = pulumi.Config()\n# AliCloud Access Key ID\nalicloud_access_key = config.require(\"alicloudAccessKey\")\n# AliCloud Secret Access Key\nalicloud_secret_key = config.require(\"alicloudSecretKey\")\nalicloud_secret_backend = vault.alicloud.SecretBackend(\"alicloud\",\n mount=alicloud.path,\n access_key=alicloud_access_key,\n secret_key_wo=alicloud_secret_key,\n secret_key_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var alicloud = new Vault.Mount(\"alicloud\", new()\n {\n Path = \"alicloud\",\n Type = \"alicloud\",\n });\n\n var config = new Config();\n // AliCloud Access Key ID\n var alicloudAccessKey = config.Require(\"alicloudAccessKey\");\n // AliCloud Secret Access Key\n var alicloudSecretKey = config.Require(\"alicloudSecretKey\");\n var alicloudSecretBackend = new Vault.AliCloud.SecretBackend(\"alicloud\", new()\n {\n Mount = alicloud.Path,\n AccessKey = alicloudAccessKey,\n SecretKeyWo = alicloudSecretKey,\n SecretKeyWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/alicloud\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\talicloud2, err := vault.NewMount(ctx, \"alicloud\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"alicloud\"),\n\t\t\tType: pulumi.String(\"alicloud\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tcfg := config.New(ctx, \"\")\n\t\t// AliCloud Access Key ID\n\t\talicloudAccessKey := cfg.Require(\"alicloudAccessKey\")\n\t\t// AliCloud Secret Access Key\n\t\talicloudSecretKey := cfg.Require(\"alicloudSecretKey\")\n\t\t_, err = alicloud.NewSecretBackend(ctx, \"alicloud\", \u0026alicloud.SecretBackendArgs{\n\t\t\tMount: alicloud2.Path,\n\t\t\tAccessKey: pulumi.String(alicloudAccessKey),\n\t\t\tSecretKeyWo: pulumi.String(alicloudSecretKey),\n\t\t\tSecretKeyWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"alicloud\" {\n path = \"alicloud\"\n type = \"alicloud\"\n}\nresource \"vault_alicloud_secretbackend\" \"alicloud\" {\n mount = vault_mount.alicloud.path\n access_key = var.alicloudAccessKey\n secret_key_wo = var.alicloudSecretKey\n secret_key_wo_version = 1\n}\nvariable \"alicloudAccessKey\" {\n type = string\n description = \"AliCloud Access Key ID\"\n}\nvariable \"alicloudSecretKey\" {\n type = string\n description = \"AliCloud Secret Access Key\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.alicloud.SecretBackend;\nimport com.pulumi.vault.alicloud.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n final var config = ctx.config();\n var alicloud = new Mount(\"alicloud\", MountArgs.builder()\n .path(\"alicloud\")\n .type(\"alicloud\")\n .build());\n\n final var alicloudAccessKey = config.require(\"alicloudAccessKey\");\n final var alicloudSecretKey = config.require(\"alicloudSecretKey\");\n var alicloudSecretBackend = new SecretBackend(\"alicloudSecretBackend\", SecretBackendArgs.builder()\n .mount(alicloud.path())\n .accessKey(alicloudAccessKey)\n .secretKeyWo(alicloudSecretKey)\n .secretKeyWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nconfiguration:\n alicloudAccessKey:\n type: string\n alicloudSecretKey:\n type: string\nresources:\n alicloud:\n type: vault:Mount\n properties:\n path: alicloud\n type: alicloud\n alicloudSecretBackend:\n type: vault:alicloud:SecretBackend\n name: alicloud\n properties:\n mount: ${alicloud.path}\n accessKey: ${alicloudAccessKey}\n secretKeyWo: ${alicloudSecretKey}\n secretKeyWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following attributes are write-only and will never be read back from Vault or stored in Terraform state:\n\n* \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e - (Write-Only) The AliCloud Secret Access Key. This value is only written to Vault and never read back.\n\n## Understanding the Write-Only Pattern\n\nThe \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field is write-only and required. It will not be stored in Terraform state or read back from Vault.\n\n### Recommended Policy\n\n```json\n{\n \"Version\": \"1\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"ram:CreateUser\",\n \"ram:DeleteUser\",\n \"ram:AttachPolicyToUser\",\n \"ram:DetachPolicyFromUser\",\n \"ram:CreateAccessKey\",\n \"ram:DeleteAccessKey\",\n \"ram:GetUser\",\n \"ram:ListAccessKeys\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}\n```\n\n## References\n\n- [AliCloud Secrets Engine API Documentation](https://developer.hashicorp.com/vault/api-docs/secret/alicloud)\n- [AliCloud RAM Documentation](https://www.alibabacloud.com/help/en/ram)\n\n## Import\n\nAliCloud secrets engines can be imported using the \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e path, e.g.\n\n```sh\n$ pulumi import vault:alicloud/secretBackend:SecretBackend alicloud alicloud\n```\n\n\u003e **Note:** When importing, the \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field will not be populated as it is \nwrite-only and not returned by the Vault API. You will need to provide this value in your \nconfiguration after import.\n\n", "properties": { "accessKey": { "type": "string", "description": "The AliCloud Access Key ID with permissions to manage RAM users and policies.\nThis credential is used by Vault to create and manage dynamic AliCloud credentials.\n", "secret": true }, "mount": { "type": "string", "description": "Path of the AliCloud secrets engine mount. Must match the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"alicloud\"`. Use `vault_mount.alicloud.path` here. Cannot be changed after creation (forces replacement).\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "secretKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only AliCloud Secret Access Key. This value will never be read back from Vault.", "secret": true }, "secretKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field. Incrementing this value will trigger an update to the secret key in Vault. This is required to enable Terraform to detect changes to the write-only field.\n" } }, "required": [ "accessKey", "mount", "secretKeyWo", "secretKeyWoVersion" ], "inputProperties": { "accessKey": { "type": "string", "description": "The AliCloud Access Key ID with permissions to manage RAM users and policies.\nThis credential is used by Vault to create and manage dynamic AliCloud credentials.\n", "secret": true }, "mount": { "type": "string", "description": "Path of the AliCloud secrets engine mount. Must match the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"alicloud\"`. Use `vault_mount.alicloud.path` here. Cannot be changed after creation (forces replacement).\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "secretKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only AliCloud Secret Access Key. This value will never be read back from Vault.", "secret": true }, "secretKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field. Incrementing this value will trigger an update to the secret key in Vault. This is required to enable Terraform to detect changes to the write-only field.\n" } }, "requiredInputs": [ "accessKey", "mount", "secretKeyWo", "secretKeyWoVersion" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "accessKey": { "type": "string", "description": "The AliCloud Access Key ID with permissions to manage RAM users and policies.\nThis credential is used by Vault to create and manage dynamic AliCloud credentials.\n", "secret": true }, "mount": { "type": "string", "description": "Path of the AliCloud secrets engine mount. Must match the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"alicloud\"`. Use `vault_mount.alicloud.path` here. Cannot be changed after creation (forces replacement).\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "secretKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only AliCloud Secret Access Key. This value will never be read back from Vault.", "secret": true }, "secretKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field. Incrementing this value will trigger an update to the secret key in Vault. This is required to enable Terraform to detect changes to the write-only field.\n" } }, "type": "object" } }, "vault:alicloud/secretBackendRole:SecretBackendRole": { "description": "Creates a role on an AliCloud Secret Backend for Vault. Roles are used to map\ncredentials to the policies or RAM roles that define their permissions.\n\nThe AliCloud secrets engine dynamically generates AliCloud access credentials\nbased on RAM policies or by assuming RAM roles. This provides a secure way to\ngrant temporary, limited-privilege credentials to applications and services.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n### Role with RAM Role ARN (STS Assumed Role)\n\nUse an existing RAM role. Vault will generate temporary STS credentials by\nassuming this role.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst alicloud = new vault.Mount(\"alicloud\", {\n path: \"alicloud\",\n type: \"alicloud\",\n});\nconst alicloudSecretBackend = new vault.alicloud.SecretBackend(\"alicloud\", {\n mount: alicloud.path,\n accessKey: \"LTAI...\",\n secretKeyWo: \"your-secret-key\",\n});\nconst role = new vault.alicloud.SecretBackendRole(\"role\", {\n mount: alicloud.path,\n name: \"deploy-role\",\n roleArn: \"acs:ram::123456789012:role/MyApplicationRole\",\n ttl: 3600,\n maxTtl: 7200,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nalicloud = vault.Mount(\"alicloud\",\n path=\"alicloud\",\n type=\"alicloud\")\nalicloud_secret_backend = vault.alicloud.SecretBackend(\"alicloud\",\n mount=alicloud.path,\n access_key=\"LTAI...\",\n secret_key_wo=\"your-secret-key\")\nrole = vault.alicloud.SecretBackendRole(\"role\",\n mount=alicloud.path,\n name=\"deploy-role\",\n role_arn=\"acs:ram::123456789012:role/MyApplicationRole\",\n ttl=3600,\n max_ttl=7200)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var alicloud = new Vault.Mount(\"alicloud\", new()\n {\n Path = \"alicloud\",\n Type = \"alicloud\",\n });\n\n var alicloudSecretBackend = new Vault.AliCloud.SecretBackend(\"alicloud\", new()\n {\n Mount = alicloud.Path,\n AccessKey = \"LTAI...\",\n SecretKeyWo = \"your-secret-key\",\n });\n\n var role = new Vault.AliCloud.SecretBackendRole(\"role\", new()\n {\n Mount = alicloud.Path,\n Name = \"deploy-role\",\n RoleArn = \"acs:ram::123456789012:role/MyApplicationRole\",\n Ttl = 3600,\n MaxTtl = 7200,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/alicloud\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\talicloud2, err := vault.NewMount(ctx, \"alicloud\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"alicloud\"),\n\t\t\tType: pulumi.String(\"alicloud\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = alicloud.NewSecretBackend(ctx, \"alicloud\", \u0026alicloud.SecretBackendArgs{\n\t\t\tMount: alicloud2.Path,\n\t\t\tAccessKey: pulumi.String(\"LTAI...\"),\n\t\t\tSecretKeyWo: pulumi.String(\"your-secret-key\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = alicloud.NewSecretBackendRole(ctx, \"role\", \u0026alicloud.SecretBackendRoleArgs{\n\t\t\tMount: alicloud2.Path,\n\t\t\tName: pulumi.String(\"deploy-role\"),\n\t\t\tRoleArn: pulumi.String(\"acs:ram::123456789012:role/MyApplicationRole\"),\n\t\t\tTtl: pulumi.Int(3600),\n\t\t\tMaxTtl: pulumi.Int(7200),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"alicloud\" {\n path = \"alicloud\"\n type = \"alicloud\"\n}\nresource \"vault_alicloud_secretbackend\" \"alicloud\" {\n mount = vault_mount.alicloud.path\n access_key = \"LTAI...\"\n secret_key_wo = \"your-secret-key\"\n}\nresource \"vault_alicloud_secretbackendrole\" \"role\" {\n mount = vault_mount.alicloud.path\n name = \"deploy-role\"\n role_arn = \"acs:ram::123456789012:role/MyApplicationRole\"\n ttl = 3600\n max_ttl = 7200\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.alicloud.SecretBackend;\nimport com.pulumi.vault.alicloud.SecretBackendArgs;\nimport com.pulumi.vault.alicloud.SecretBackendRole;\nimport com.pulumi.vault.alicloud.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var alicloud = new Mount(\"alicloud\", MountArgs.builder()\n .path(\"alicloud\")\n .type(\"alicloud\")\n .build());\n\n var alicloudSecretBackend = new SecretBackend(\"alicloudSecretBackend\", SecretBackendArgs.builder()\n .mount(alicloud.path())\n .accessKey(\"LTAI...\")\n .secretKeyWo(\"your-secret-key\")\n .build());\n\n var role = new SecretBackendRole(\"role\", SecretBackendRoleArgs.builder()\n .mount(alicloud.path())\n .name(\"deploy-role\")\n .roleArn(\"acs:ram::123456789012:role/MyApplicationRole\")\n .ttl(3600)\n .maxTtl(7200)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n alicloud:\n type: vault:Mount\n properties:\n path: alicloud\n type: alicloud\n alicloudSecretBackend:\n type: vault:alicloud:SecretBackend\n name: alicloud\n properties:\n mount: ${alicloud.path}\n accessKey: LTAI...\n secretKeyWo: your-secret-key\n role:\n type: vault:alicloud:SecretBackendRole\n properties:\n mount: ${alicloud.path}\n name: deploy-role\n roleArn: acs:ram::123456789012:role/MyApplicationRole\n ttl: 3600\n maxTtl: 7200\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Role with Remote Policies\n\nUse remote policies to reference existing system or custom RAM policies.\nVault will create a temporary RAM user and attach these policies.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst role = new vault.alicloud.SecretBackendRole(\"role\", {\n mount: alicloud.path,\n name: \"oss-reader\",\n remotePolicies: [\n {\n name: \"AliyunOSSReadOnlyAccess\",\n type: \"System\",\n },\n {\n name: \"AliyunECSReadOnlyAccess\",\n type: \"System\",\n },\n ],\n ttl: 3600,\n maxTtl: 7200,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nrole = vault.alicloud.SecretBackendRole(\"role\",\n mount=alicloud[\"path\"],\n name=\"oss-reader\",\n remote_policies=[\n {\n \"name\": \"AliyunOSSReadOnlyAccess\",\n \"type\": \"System\",\n },\n {\n \"name\": \"AliyunECSReadOnlyAccess\",\n \"type\": \"System\",\n },\n ],\n ttl=3600,\n max_ttl=7200)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var role = new Vault.AliCloud.SecretBackendRole(\"role\", new()\n {\n Mount = alicloud.Path,\n Name = \"oss-reader\",\n RemotePolicies = new[]\n {\n new Vault.AliCloud.Inputs.SecretBackendRoleRemotePolicyArgs\n {\n Name = \"AliyunOSSReadOnlyAccess\",\n Type = \"System\",\n },\n new Vault.AliCloud.Inputs.SecretBackendRoleRemotePolicyArgs\n {\n Name = \"AliyunECSReadOnlyAccess\",\n Type = \"System\",\n },\n },\n Ttl = 3600,\n MaxTtl = 7200,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/alicloud\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := alicloud.NewSecretBackendRole(ctx, \"role\", \u0026alicloud.SecretBackendRoleArgs{\n\t\t\tMount: pulumi.Any(alicloud.Path),\n\t\t\tName: pulumi.String(\"oss-reader\"),\n\t\t\tRemotePolicies: alicloud.SecretBackendRoleRemotePolicyArray{\n\t\t\t\t\u0026alicloud.SecretBackendRoleRemotePolicyArgs{\n\t\t\t\t\tName: pulumi.String(\"AliyunOSSReadOnlyAccess\"),\n\t\t\t\t\tType: pulumi.String(\"System\"),\n\t\t\t\t},\n\t\t\t\t\u0026alicloud.SecretBackendRoleRemotePolicyArgs{\n\t\t\t\t\tName: pulumi.String(\"AliyunECSReadOnlyAccess\"),\n\t\t\t\t\tType: pulumi.String(\"System\"),\n\t\t\t\t},\n\t\t\t},\n\t\t\tTtl: pulumi.Int(3600),\n\t\t\tMaxTtl: pulumi.Int(7200),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_alicloud_secretbackendrole\" \"role\" {\n mount = alicloud.path\n name = \"oss-reader\"\n remote_policies {\n name = \"AliyunOSSReadOnlyAccess\"\n type = \"System\"\n }\n remote_policies {\n name = \"AliyunECSReadOnlyAccess\"\n type = \"System\"\n }\n ttl = 3600\n max_ttl = 7200\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.alicloud.SecretBackendRole;\nimport com.pulumi.vault.alicloud.SecretBackendRoleArgs;\nimport com.pulumi.vault.alicloud.inputs.SecretBackendRoleRemotePolicyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var role = new SecretBackendRole(\"role\", SecretBackendRoleArgs.builder()\n .mount(alicloud.path())\n .name(\"oss-reader\")\n .remotePolicies( \n SecretBackendRoleRemotePolicyArgs.builder()\n .name(\"AliyunOSSReadOnlyAccess\")\n .type(\"System\")\n .build(),\n SecretBackendRoleRemotePolicyArgs.builder()\n .name(\"AliyunECSReadOnlyAccess\")\n .type(\"System\")\n .build())\n .ttl(3600)\n .maxTtl(7200)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n role:\n type: vault:alicloud:SecretBackendRole\n properties:\n mount: ${alicloud.path}\n name: oss-reader\n remotePolicies:\n - name: AliyunOSSReadOnlyAccess\n type: System\n - name: AliyunECSReadOnlyAccess\n type: System\n ttl: 3600\n maxTtl: 7200\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Role with Inline Policies\n\nInline policies allow you to define custom permissions directly. Vault will\ncreate a temporary RAM user and attach the inline policy.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst role = new vault.alicloud.SecretBackendRole(\"role\", {\n mount: alicloud.path,\n name: \"custom-permissions\",\n inlinePolicies: [{\n policyDocument: JSON.stringify({\n Statement: [{\n Action: [\n \"oss:GetObject\",\n \"oss:PutObject\",\n ],\n Effect: \"Allow\",\n Resource: [\"acs:oss:*:*:my-bucket/*\"],\n }],\n Version: \"1\",\n }),\n }],\n ttl: 3600,\n maxTtl: 7200,\n});\n```\n```python\nimport pulumi\nimport json\nimport pulumi_vault as vault\n\nrole = vault.alicloud.SecretBackendRole(\"role\",\n mount=alicloud[\"path\"],\n name=\"custom-permissions\",\n inline_policies=[{\n \"policy_document\": json.dumps({\n \"Statement\": [{\n \"Action\": [\n \"oss:GetObject\",\n \"oss:PutObject\",\n ],\n \"Effect\": \"Allow\",\n \"Resource\": [\"acs:oss:*:*:my-bucket/*\"],\n }],\n \"Version\": \"1\",\n }),\n }],\n ttl=3600,\n max_ttl=7200)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text.Json;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var role = new Vault.AliCloud.SecretBackendRole(\"role\", new()\n {\n Mount = alicloud.Path,\n Name = \"custom-permissions\",\n InlinePolicies = new[]\n {\n new Vault.AliCloud.Inputs.SecretBackendRoleInlinePolicyArgs\n {\n PolicyDocument = JsonSerializer.Serialize(new Dictionary\u003cstring, object?\u003e\n {\n [\"Statement\"] = new[]\n {\n new Dictionary\u003cstring, object?\u003e\n {\n [\"Action\"] = new[]\n {\n \"oss:GetObject\",\n \"oss:PutObject\",\n },\n [\"Effect\"] = \"Allow\",\n [\"Resource\"] = new[]\n {\n \"acs:oss:*:*:my-bucket/*\",\n },\n },\n },\n [\"Version\"] = \"1\",\n }),\n },\n },\n Ttl = 3600,\n MaxTtl = 7200,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/alicloud\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttmpJSON0, err := json.Marshal(map[string]interface{}{\n\t\t\t\"Statement\": []map[string]interface{}{\n\t\t\t\tmap[string]interface{}{\n\t\t\t\t\t\"Action\": []string{\n\t\t\t\t\t\t\"oss:GetObject\",\n\t\t\t\t\t\t\"oss:PutObject\",\n\t\t\t\t\t},\n\t\t\t\t\t\"Effect\": \"Allow\",\n\t\t\t\t\t\"Resource\": []string{\n\t\t\t\t\t\t\"acs:oss:*:*:my-bucket/*\",\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\t\"Version\": \"1\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjson0 := string(tmpJSON0)\n\t\t_, err = alicloud.NewSecretBackendRole(ctx, \"role\", \u0026alicloud.SecretBackendRoleArgs{\n\t\t\tMount: pulumi.Any(alicloud.Path),\n\t\t\tName: pulumi.String(\"custom-permissions\"),\n\t\t\tInlinePolicies: alicloud.SecretBackendRoleInlinePolicyArray{\n\t\t\t\t\u0026alicloud.SecretBackendRoleInlinePolicyArgs{\n\t\t\t\t\tPolicyDocument: pulumi.String(json0),\n\t\t\t\t},\n\t\t\t},\n\t\t\tTtl: pulumi.Int(3600),\n\t\t\tMaxTtl: pulumi.Int(7200),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_alicloud_secretbackendrole\" \"role\" {\n mount = alicloud.path\n name = \"custom-permissions\"\n inline_policies {\n policy_document = jsonencode({\n \"Statement\" = [{\n \"Action\" = [\"oss:GetObject\", \"oss:PutObject\"]\n \"Effect\" = \"Allow\"\n \"Resource\" = [\"acs:oss:*:*:my-bucket/*\"]\n }]\n \"Version\" = \"1\"\n })\n }\n ttl = 3600\n max_ttl = 7200\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.alicloud.SecretBackendRole;\nimport com.pulumi.vault.alicloud.SecretBackendRoleArgs;\nimport com.pulumi.vault.alicloud.inputs.SecretBackendRoleInlinePolicyArgs;\nimport static com.pulumi.codegen.internal.Serialization.*;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var role = new SecretBackendRole(\"role\", SecretBackendRoleArgs.builder()\n .mount(alicloud.path())\n .name(\"custom-permissions\")\n .inlinePolicies(SecretBackendRoleInlinePolicyArgs.builder()\n .policyDocument(serializeJson(\n jsonObject(\n jsonProperty(\"Statement\", jsonArray(jsonObject(\n jsonProperty(\"Action\", jsonArray(\n \"oss:GetObject\", \n \"oss:PutObject\"\n )),\n jsonProperty(\"Effect\", \"Allow\"),\n jsonProperty(\"Resource\", jsonArray(\"acs:oss:*:*:my-bucket/*\"))\n ))),\n jsonProperty(\"Version\", \"1\")\n )))\n .build())\n .ttl(3600)\n .maxTtl(7200)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n role:\n type: vault:alicloud:SecretBackendRole\n properties:\n mount: ${alicloud.path}\n name: custom-permissions\n inlinePolicies:\n - policyDocument:\n fn::toJSON:\n Statement:\n - Action:\n - oss:GetObject\n - oss:PutObject\n Effect: Allow\n Resource:\n - acs:oss:*:*:my-bucket/*\n Version: '1'\n ttl: 3600\n maxTtl: 7200\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Role with Combined Inline and Remote Policies\n\nYou can combine inline and remote policies on the same role.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst role = new vault.alicloud.SecretBackendRole(\"role\", {\n mount: alicloud.path,\n name: \"combined\",\n remotePolicies: [{\n name: \"AliyunOSSReadOnlyAccess\",\n type: \"System\",\n }],\n inlinePolicies: [{\n policyDocument: JSON.stringify({\n Statement: [{\n Action: [\"ecs:DescribeInstances\"],\n Effect: \"Allow\",\n Resource: [\"*\"],\n }],\n Version: \"1\",\n }),\n }],\n ttl: 3600,\n maxTtl: 7200,\n});\n```\n```python\nimport pulumi\nimport json\nimport pulumi_vault as vault\n\nrole = vault.alicloud.SecretBackendRole(\"role\",\n mount=alicloud[\"path\"],\n name=\"combined\",\n remote_policies=[{\n \"name\": \"AliyunOSSReadOnlyAccess\",\n \"type\": \"System\",\n }],\n inline_policies=[{\n \"policy_document\": json.dumps({\n \"Statement\": [{\n \"Action\": [\"ecs:DescribeInstances\"],\n \"Effect\": \"Allow\",\n \"Resource\": [\"*\"],\n }],\n \"Version\": \"1\",\n }),\n }],\n ttl=3600,\n max_ttl=7200)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text.Json;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var role = new Vault.AliCloud.SecretBackendRole(\"role\", new()\n {\n Mount = alicloud.Path,\n Name = \"combined\",\n RemotePolicies = new[]\n {\n new Vault.AliCloud.Inputs.SecretBackendRoleRemotePolicyArgs\n {\n Name = \"AliyunOSSReadOnlyAccess\",\n Type = \"System\",\n },\n },\n InlinePolicies = new[]\n {\n new Vault.AliCloud.Inputs.SecretBackendRoleInlinePolicyArgs\n {\n PolicyDocument = JsonSerializer.Serialize(new Dictionary\u003cstring, object?\u003e\n {\n [\"Statement\"] = new[]\n {\n new Dictionary\u003cstring, object?\u003e\n {\n [\"Action\"] = new[]\n {\n \"ecs:DescribeInstances\",\n },\n [\"Effect\"] = \"Allow\",\n [\"Resource\"] = new[]\n {\n \"*\",\n },\n },\n },\n [\"Version\"] = \"1\",\n }),\n },\n },\n Ttl = 3600,\n MaxTtl = 7200,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/alicloud\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttmpJSON0, err := json.Marshal(map[string]interface{}{\n\t\t\t\"Statement\": []map[string]interface{}{\n\t\t\t\tmap[string]interface{}{\n\t\t\t\t\t\"Action\": []string{\n\t\t\t\t\t\t\"ecs:DescribeInstances\",\n\t\t\t\t\t},\n\t\t\t\t\t\"Effect\": \"Allow\",\n\t\t\t\t\t\"Resource\": []string{\n\t\t\t\t\t\t\"*\",\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\t\"Version\": \"1\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjson0 := string(tmpJSON0)\n\t\t_, err = alicloud.NewSecretBackendRole(ctx, \"role\", \u0026alicloud.SecretBackendRoleArgs{\n\t\t\tMount: pulumi.Any(alicloud.Path),\n\t\t\tName: pulumi.String(\"combined\"),\n\t\t\tRemotePolicies: alicloud.SecretBackendRoleRemotePolicyArray{\n\t\t\t\t\u0026alicloud.SecretBackendRoleRemotePolicyArgs{\n\t\t\t\t\tName: pulumi.String(\"AliyunOSSReadOnlyAccess\"),\n\t\t\t\t\tType: pulumi.String(\"System\"),\n\t\t\t\t},\n\t\t\t},\n\t\t\tInlinePolicies: alicloud.SecretBackendRoleInlinePolicyArray{\n\t\t\t\t\u0026alicloud.SecretBackendRoleInlinePolicyArgs{\n\t\t\t\t\tPolicyDocument: pulumi.String(json0),\n\t\t\t\t},\n\t\t\t},\n\t\t\tTtl: pulumi.Int(3600),\n\t\t\tMaxTtl: pulumi.Int(7200),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_alicloud_secretbackendrole\" \"role\" {\n mount = alicloud.path\n name = \"combined\"\n remote_policies {\n name = \"AliyunOSSReadOnlyAccess\"\n type = \"System\"\n }\n inline_policies {\n policy_document = jsonencode({\n \"Statement\" = [{\n \"Action\" = [\"ecs:DescribeInstances\"]\n \"Effect\" = \"Allow\"\n \"Resource\" = [\"*\"]\n }]\n \"Version\" = \"1\"\n })\n }\n ttl = 3600\n max_ttl = 7200\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.alicloud.SecretBackendRole;\nimport com.pulumi.vault.alicloud.SecretBackendRoleArgs;\nimport com.pulumi.vault.alicloud.inputs.SecretBackendRoleRemotePolicyArgs;\nimport com.pulumi.vault.alicloud.inputs.SecretBackendRoleInlinePolicyArgs;\nimport static com.pulumi.codegen.internal.Serialization.*;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var role = new SecretBackendRole(\"role\", SecretBackendRoleArgs.builder()\n .mount(alicloud.path())\n .name(\"combined\")\n .remotePolicies(SecretBackendRoleRemotePolicyArgs.builder()\n .name(\"AliyunOSSReadOnlyAccess\")\n .type(\"System\")\n .build())\n .inlinePolicies(SecretBackendRoleInlinePolicyArgs.builder()\n .policyDocument(serializeJson(\n jsonObject(\n jsonProperty(\"Statement\", jsonArray(jsonObject(\n jsonProperty(\"Action\", jsonArray(\"ecs:DescribeInstances\")),\n jsonProperty(\"Effect\", \"Allow\"),\n jsonProperty(\"Resource\", jsonArray(\"*\"))\n ))),\n jsonProperty(\"Version\", \"1\")\n )))\n .build())\n .ttl(3600)\n .maxTtl(7200)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n role:\n type: vault:alicloud:SecretBackendRole\n properties:\n mount: ${alicloud.path}\n name: combined\n remotePolicies:\n - name: AliyunOSSReadOnlyAccess\n type: System\n inlinePolicies:\n - policyDocument:\n fn::toJSON:\n Statement:\n - Action:\n - ecs:DescribeInstances\n Effect: Allow\n Resource:\n - '*'\n Version: '1'\n ttl: 3600\n maxTtl: 7200\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Credential Types Comparison\n\n| Method | Use Case | Credential Type | Pros | Cons |\n|--------|----------|-----------------|------|------|\n| \u003cspan pulumi-lang-nodejs=\"`roleArn`\" pulumi-lang-dotnet=\"`RoleArn`\" pulumi-lang-go=\"`roleArn`\" pulumi-lang-python=\"`role_arn`\" pulumi-lang-yaml=\"`roleArn`\" pulumi-lang-java=\"`roleArn`\" pulumi-lang-hcl=\"`role_arn`\"\u003e`roleArn`\u003c/span\u003e | Production deployments | STS assumed role | Most secure, leverages existing RAM roles | Requires pre-existing RAM role with trust policy |\n| \u003cspan pulumi-lang-nodejs=\"`remotePolicies`\" pulumi-lang-dotnet=\"`RemotePolicies`\" pulumi-lang-go=\"`remotePolicies`\" pulumi-lang-python=\"`remote_policies`\" pulumi-lang-yaml=\"`remotePolicies`\" pulumi-lang-java=\"`remotePolicies`\" pulumi-lang-hcl=\"`remote_policies`\"\u003e`remotePolicies`\u003c/span\u003e | Dynamic permissions with existing policies | RAM user | Reuses existing policies, easier to manage | Creates temporary RAM users |\n| \u003cspan pulumi-lang-nodejs=\"`inlinePolicies`\" pulumi-lang-dotnet=\"`InlinePolicies`\" pulumi-lang-go=\"`inlinePolicies`\" pulumi-lang-python=\"`inline_policies`\" pulumi-lang-yaml=\"`inlinePolicies`\" pulumi-lang-java=\"`inlinePolicies`\" pulumi-lang-hcl=\"`inline_policies`\"\u003e`inlinePolicies`\u003c/span\u003e | Custom permissions | RAM user | Flexible, no external dependencies | Creates temporary RAM users |\n\n## See Also\n\n* [AliCloud Secrets Engine API Documentation](https://developer.hashicorp.com/vault/api-docs/secret/alicloud)\n*\u003cspan pulumi-lang-nodejs=\" vault.alicloud.SecretBackend \" pulumi-lang-dotnet=\" vault.alicloud.SecretBackend \" pulumi-lang-go=\" alicloud.SecretBackend \" pulumi-lang-python=\" alicloud.SecretBackend \" pulumi-lang-yaml=\" vault.alicloud.SecretBackend \" pulumi-lang-java=\" vault.alicloud.SecretBackend \" pulumi-lang-hcl=\" vault_alicloud_secret_backend \"\u003e vault.alicloud.SecretBackend \u003c/span\u003e- Configure the AliCloud secrets engine backend\n\n## Import\n\nAliCloud secret backend roles can be imported using the full path to the role\nin the format `\u003cmount\u003e/role/\u003cname\u003e`, e.g.\n\n```sh\n$ pulumi import vault:alicloud/secretBackendRole:SecretBackendRole role alicloud/role/deploy-role\n```\n\n\u003e **Note:** When importing into a Vault namespace, set the\n`TERRAFORM_VAULT_NAMESPACE_IMPORT` environment variable to the target namespace\nbefore running the import command.\n\n", "properties": { "inlinePolicies": { "type": "array", "items": { "$ref": "#/types/vault:alicloud/SecretBackendRoleInlinePolicy:SecretBackendRoleInlinePolicy" }, "description": "Set of inline policy documents to be applied to the generated credentials. Each block represents one policy with a JSON-encoded\u003cspan pulumi-lang-nodejs=\" policyDocument \" pulumi-lang-dotnet=\" PolicyDocument \" pulumi-lang-go=\" policyDocument \" pulumi-lang-python=\" policy_document \" pulumi-lang-yaml=\" policyDocument \" pulumi-lang-java=\" policyDocument \" pulumi-lang-hcl=\" policy_document \"\u003e policyDocument \u003c/span\u003efield." }, "maxTtl": { "type": "integer", "description": "The maximum TTL for credentials issued by this role,\nin seconds. Defaults to 0, in which case the value will fall back to the\nsystem/mount defaults.\n" }, "mount": { "type": "string", "description": "The path where the AliCloud secret backend is mounted,\nwith no leading or trailing `/`s.\n" }, "name": { "type": "string", "description": "The name of the role. Must be unique within the backend.\nChanging this forces creation of a new resource.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "remotePolicies": { "type": "array", "items": { "$ref": "#/types/vault:alicloud/SecretBackendRoleRemotePolicy:SecretBackendRoleRemotePolicy" }, "description": "Set of remote policy specifications to attach to the generated credentials. Each block groups a policy name with its type (System or Custom)." }, "roleArn": { "type": "string", "description": "The ARN of the RAM role to assume. When specified,\nVault will generate temporary STS credentials by assuming this role. The\nrole's trust policy must allow the access key configured in the backend to\nassume it. Cannot be used with \u003cspan pulumi-lang-nodejs=\"`inlinePolicies`\" pulumi-lang-dotnet=\"`InlinePolicies`\" pulumi-lang-go=\"`inlinePolicies`\" pulumi-lang-python=\"`inline_policies`\" pulumi-lang-yaml=\"`inlinePolicies`\" pulumi-lang-java=\"`inlinePolicies`\" pulumi-lang-hcl=\"`inline_policies`\"\u003e`inlinePolicies`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`remotePolicies`\" pulumi-lang-dotnet=\"`RemotePolicies`\" pulumi-lang-go=\"`remotePolicies`\" pulumi-lang-python=\"`remote_policies`\" pulumi-lang-yaml=\"`remotePolicies`\" pulumi-lang-java=\"`remotePolicies`\" pulumi-lang-hcl=\"`remote_policies`\"\u003e`remotePolicies`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "The default TTL for credentials issued by this role, in\nseconds. Defaults to 0, in which case the value will fall back to the\nsystem/mount defaults.\n" } }, "required": [ "mount", "name" ], "inputProperties": { "inlinePolicies": { "type": "array", "items": { "$ref": "#/types/vault:alicloud/SecretBackendRoleInlinePolicy:SecretBackendRoleInlinePolicy" }, "description": "Set of inline policy documents to be applied to the generated credentials. Each block represents one policy with a JSON-encoded\u003cspan pulumi-lang-nodejs=\" policyDocument \" pulumi-lang-dotnet=\" PolicyDocument \" pulumi-lang-go=\" policyDocument \" pulumi-lang-python=\" policy_document \" pulumi-lang-yaml=\" policyDocument \" pulumi-lang-java=\" policyDocument \" pulumi-lang-hcl=\" policy_document \"\u003e policyDocument \u003c/span\u003efield." }, "maxTtl": { "type": "integer", "description": "The maximum TTL for credentials issued by this role,\nin seconds. Defaults to 0, in which case the value will fall back to the\nsystem/mount defaults.\n" }, "mount": { "type": "string", "description": "The path where the AliCloud secret backend is mounted,\nwith no leading or trailing `/`s.\n" }, "name": { "type": "string", "description": "The name of the role. Must be unique within the backend.\nChanging this forces creation of a new resource.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "remotePolicies": { "type": "array", "items": { "$ref": "#/types/vault:alicloud/SecretBackendRoleRemotePolicy:SecretBackendRoleRemotePolicy" }, "description": "Set of remote policy specifications to attach to the generated credentials. Each block groups a policy name with its type (System or Custom)." }, "roleArn": { "type": "string", "description": "The ARN of the RAM role to assume. When specified,\nVault will generate temporary STS credentials by assuming this role. The\nrole's trust policy must allow the access key configured in the backend to\nassume it. Cannot be used with \u003cspan pulumi-lang-nodejs=\"`inlinePolicies`\" pulumi-lang-dotnet=\"`InlinePolicies`\" pulumi-lang-go=\"`inlinePolicies`\" pulumi-lang-python=\"`inline_policies`\" pulumi-lang-yaml=\"`inlinePolicies`\" pulumi-lang-java=\"`inlinePolicies`\" pulumi-lang-hcl=\"`inline_policies`\"\u003e`inlinePolicies`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`remotePolicies`\" pulumi-lang-dotnet=\"`RemotePolicies`\" pulumi-lang-go=\"`remotePolicies`\" pulumi-lang-python=\"`remote_policies`\" pulumi-lang-yaml=\"`remotePolicies`\" pulumi-lang-java=\"`remotePolicies`\" pulumi-lang-hcl=\"`remote_policies`\"\u003e`remotePolicies`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "The default TTL for credentials issued by this role, in\nseconds. Defaults to 0, in which case the value will fall back to the\nsystem/mount defaults.\n" } }, "requiredInputs": [ "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRole resources.\n", "properties": { "inlinePolicies": { "type": "array", "items": { "$ref": "#/types/vault:alicloud/SecretBackendRoleInlinePolicy:SecretBackendRoleInlinePolicy" }, "description": "Set of inline policy documents to be applied to the generated credentials. Each block represents one policy with a JSON-encoded\u003cspan pulumi-lang-nodejs=\" policyDocument \" pulumi-lang-dotnet=\" PolicyDocument \" pulumi-lang-go=\" policyDocument \" pulumi-lang-python=\" policy_document \" pulumi-lang-yaml=\" policyDocument \" pulumi-lang-java=\" policyDocument \" pulumi-lang-hcl=\" policy_document \"\u003e policyDocument \u003c/span\u003efield." }, "maxTtl": { "type": "integer", "description": "The maximum TTL for credentials issued by this role,\nin seconds. Defaults to 0, in which case the value will fall back to the\nsystem/mount defaults.\n" }, "mount": { "type": "string", "description": "The path where the AliCloud secret backend is mounted,\nwith no leading or trailing `/`s.\n" }, "name": { "type": "string", "description": "The name of the role. Must be unique within the backend.\nChanging this forces creation of a new resource.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "remotePolicies": { "type": "array", "items": { "$ref": "#/types/vault:alicloud/SecretBackendRoleRemotePolicy:SecretBackendRoleRemotePolicy" }, "description": "Set of remote policy specifications to attach to the generated credentials. Each block groups a policy name with its type (System or Custom)." }, "roleArn": { "type": "string", "description": "The ARN of the RAM role to assume. When specified,\nVault will generate temporary STS credentials by assuming this role. The\nrole's trust policy must allow the access key configured in the backend to\nassume it. Cannot be used with \u003cspan pulumi-lang-nodejs=\"`inlinePolicies`\" pulumi-lang-dotnet=\"`InlinePolicies`\" pulumi-lang-go=\"`inlinePolicies`\" pulumi-lang-python=\"`inline_policies`\" pulumi-lang-yaml=\"`inlinePolicies`\" pulumi-lang-java=\"`inlinePolicies`\" pulumi-lang-hcl=\"`inline_policies`\"\u003e`inlinePolicies`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`remotePolicies`\" pulumi-lang-dotnet=\"`RemotePolicies`\" pulumi-lang-go=\"`remotePolicies`\" pulumi-lang-python=\"`remote_policies`\" pulumi-lang-yaml=\"`remotePolicies`\" pulumi-lang-java=\"`remotePolicies`\" pulumi-lang-hcl=\"`remote_policies`\"\u003e`remotePolicies`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "The default TTL for credentials issued by this role, in\nseconds. Defaults to 0, in which case the value will fall back to the\nsystem/mount defaults.\n" } }, "type": "object" } }, "vault:appRole/authBackendLogin:AuthBackendLogin": { "description": "Logs into Vault using the AppRole auth backend. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/approle) for more\ninformation.\n\n## Example Usage\n\n### Standard Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst approle = new vault.AuthBackend(\"approle\", {type: \"approle\"});\nconst example = new vault.approle.AuthBackendRole(\"example\", {\n backend: approle.path,\n roleName: \"test-role\",\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n});\nconst id = new vault.approle.AuthBackendRoleSecretId(\"id\", {\n backend: approle.path,\n roleName: example.roleName,\n});\nconst login = new vault.approle.AuthBackendLogin(\"login\", {\n backend: approle.path,\n roleId: example.roleId,\n secretId: id.secretId,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\napprole = vault.AuthBackend(\"approle\", type=\"approle\")\nexample = vault.approle.AuthBackendRole(\"example\",\n backend=approle.path,\n role_name=\"test-role\",\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ])\nid = vault.approle.AuthBackendRoleSecretId(\"id\",\n backend=approle.path,\n role_name=example.role_name)\nlogin = vault.approle.AuthBackendLogin(\"login\",\n backend=approle.path,\n role_id=example.role_id,\n secret_id=id.secret_id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var approle = new Vault.AuthBackend(\"approle\", new()\n {\n Type = \"approle\",\n });\n\n var example = new Vault.AppRole.AuthBackendRole(\"example\", new()\n {\n Backend = approle.Path,\n RoleName = \"test-role\",\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n });\n\n var id = new Vault.AppRole.AuthBackendRoleSecretId(\"id\", new()\n {\n Backend = approle.Path,\n RoleName = example.RoleName,\n });\n\n var login = new Vault.AppRole.AuthBackendLogin(\"login\", new()\n {\n Backend = approle.Path,\n RoleId = example.RoleId,\n SecretId = id.SecretId,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/approle\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tapprole2, err := vault.NewAuthBackend(ctx, \"approle\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"approle\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texample, err := approle.NewAuthBackendRole(ctx, \"example\", \u0026approle.AuthBackendRoleArgs{\n\t\t\tBackend: approle2.Path,\n\t\t\tRoleName: pulumi.String(\"test-role\"),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tid, err := approle.NewAuthBackendRoleSecretId(ctx, \"id\", \u0026approle.AuthBackendRoleSecretIdArgs{\n\t\t\tBackend: approle2.Path,\n\t\t\tRoleName: example.RoleName,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = approle.NewAuthBackendLogin(ctx, \"login\", \u0026approle.AuthBackendLoginArgs{\n\t\t\tBackend: approle2.Path,\n\t\t\tRoleId: example.RoleId,\n\t\t\tSecretId: id.SecretId,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"approle\" {\n type = \"approle\"\n}\nresource \"vault_approle_authbackendrole\" \"example\" {\n backend = vault_authbackend.approle.path\n role_name = \"test-role\"\n token_policies = [\"default\", \"dev\", \"prod\"]\n}\nresource \"vault_approle_authbackendrolesecretid\" \"id\" {\n backend = vault_authbackend.approle.path\n role_name = vault_approle_authbackendrole.example.role_name\n}\nresource \"vault_approle_authbackendlogin\" \"login\" {\n backend = vault_authbackend.approle.path\n role_id = vault_approle_authbackendrole.example.role_id\n secret_id = vault_approle_authbackendrolesecretid.id.secret_id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.appRole.AuthBackendRole;\nimport com.pulumi.vault.appRole.AuthBackendRoleArgs;\nimport com.pulumi.vault.appRole.AuthBackendRoleSecretId;\nimport com.pulumi.vault.appRole.AuthBackendRoleSecretIdArgs;\nimport com.pulumi.vault.appRole.AuthBackendLogin;\nimport com.pulumi.vault.appRole.AuthBackendLoginArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var approle = new AuthBackend(\"approle\", AuthBackendArgs.builder()\n .type(\"approle\")\n .build());\n\n var example = new AuthBackendRole(\"example\", AuthBackendRoleArgs.builder()\n .backend(approle.path())\n .roleName(\"test-role\")\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .build());\n\n var id = new AuthBackendRoleSecretId(\"id\", AuthBackendRoleSecretIdArgs.builder()\n .backend(approle.path())\n .roleName(example.roleName())\n .build());\n\n var login = new AuthBackendLogin(\"login\", AuthBackendLoginArgs.builder()\n .backend(approle.path())\n .roleId(example.roleId())\n .secretId(id.secretId())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n approle:\n type: vault:AuthBackend\n properties:\n type: approle\n example:\n type: vault:appRole:AuthBackendRole\n properties:\n backend: ${approle.path}\n roleName: test-role\n tokenPolicies:\n - default\n - dev\n - prod\n id:\n type: vault:appRole:AuthBackendRoleSecretId\n properties:\n backend: ${approle.path}\n roleName: ${example.roleName}\n login:\n type: vault:appRole:AuthBackendLogin\n properties:\n backend: ${approle.path}\n roleId: ${example.roleId}\n secretId: ${id.secretId}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Write-Only Field\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst approle = new vault.AuthBackend(\"approle\", {type: \"approle\"});\nconst example = new vault.approle.AuthBackendRole(\"example\", {\n backend: approle.path,\n roleName: \"test-role\",\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n});\nconst id = new vault.approle.AuthBackendRoleSecretId(\"id\", {\n backend: approle.path,\n roleName: example.roleName,\n});\nconst login = new vault.approle.AuthBackendLogin(\"login\", {\n backend: approle.path,\n roleId: example.roleId,\n secretIdWo: id.secretId,\n secretIdWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\napprole = vault.AuthBackend(\"approle\", type=\"approle\")\nexample = vault.approle.AuthBackendRole(\"example\",\n backend=approle.path,\n role_name=\"test-role\",\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ])\nid = vault.approle.AuthBackendRoleSecretId(\"id\",\n backend=approle.path,\n role_name=example.role_name)\nlogin = vault.approle.AuthBackendLogin(\"login\",\n backend=approle.path,\n role_id=example.role_id,\n secret_id_wo=id.secret_id,\n secret_id_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var approle = new Vault.AuthBackend(\"approle\", new()\n {\n Type = \"approle\",\n });\n\n var example = new Vault.AppRole.AuthBackendRole(\"example\", new()\n {\n Backend = approle.Path,\n RoleName = \"test-role\",\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n });\n\n var id = new Vault.AppRole.AuthBackendRoleSecretId(\"id\", new()\n {\n Backend = approle.Path,\n RoleName = example.RoleName,\n });\n\n var login = new Vault.AppRole.AuthBackendLogin(\"login\", new()\n {\n Backend = approle.Path,\n RoleId = example.RoleId,\n SecretIdWo = id.SecretId,\n SecretIdWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/approle\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tapprole2, err := vault.NewAuthBackend(ctx, \"approle\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"approle\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texample, err := approle.NewAuthBackendRole(ctx, \"example\", \u0026approle.AuthBackendRoleArgs{\n\t\t\tBackend: approle2.Path,\n\t\t\tRoleName: pulumi.String(\"test-role\"),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tid, err := approle.NewAuthBackendRoleSecretId(ctx, \"id\", \u0026approle.AuthBackendRoleSecretIdArgs{\n\t\t\tBackend: approle2.Path,\n\t\t\tRoleName: example.RoleName,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = approle.NewAuthBackendLogin(ctx, \"login\", \u0026approle.AuthBackendLoginArgs{\n\t\t\tBackend: approle2.Path,\n\t\t\tRoleId: example.RoleId,\n\t\t\tSecretIdWo: id.SecretId,\n\t\t\tSecretIdWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"approle\" {\n type = \"approle\"\n}\nresource \"vault_approle_authbackendrole\" \"example\" {\n backend = vault_authbackend.approle.path\n role_name = \"test-role\"\n token_policies = [\"default\", \"dev\", \"prod\"]\n}\nresource \"vault_approle_authbackendrolesecretid\" \"id\" {\n backend = vault_authbackend.approle.path\n role_name = vault_approle_authbackendrole.example.role_name\n}\nresource \"vault_approle_authbackendlogin\" \"login\" {\n backend = vault_authbackend.approle.path\n role_id = vault_approle_authbackendrole.example.role_id\n secret_id_wo = vault_approle_authbackendrolesecretid.id.secret_id\n secret_id_wo_version = 1\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.appRole.AuthBackendRole;\nimport com.pulumi.vault.appRole.AuthBackendRoleArgs;\nimport com.pulumi.vault.appRole.AuthBackendRoleSecretId;\nimport com.pulumi.vault.appRole.AuthBackendRoleSecretIdArgs;\nimport com.pulumi.vault.appRole.AuthBackendLogin;\nimport com.pulumi.vault.appRole.AuthBackendLoginArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var approle = new AuthBackend(\"approle\", AuthBackendArgs.builder()\n .type(\"approle\")\n .build());\n\n var example = new AuthBackendRole(\"example\", AuthBackendRoleArgs.builder()\n .backend(approle.path())\n .roleName(\"test-role\")\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .build());\n\n var id = new AuthBackendRoleSecretId(\"id\", AuthBackendRoleSecretIdArgs.builder()\n .backend(approle.path())\n .roleName(example.roleName())\n .build());\n\n var login = new AuthBackendLogin(\"login\", AuthBackendLoginArgs.builder()\n .backend(approle.path())\n .roleId(example.roleId())\n .secretIdWo(id.secretId())\n .secretIdWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n approle:\n type: vault:AuthBackend\n properties:\n type: approle\n example:\n type: vault:appRole:AuthBackendRole\n properties:\n backend: ${approle.path}\n roleName: test-role\n tokenPolicies:\n - default\n - dev\n - prod\n id:\n type: vault:appRole:AuthBackendRoleSecretId\n properties:\n backend: ${approle.path}\n roleName: ${example.roleName}\n login:\n type: vault:appRole:AuthBackendLogin\n properties:\n backend: ${approle.path}\n roleId: ${example.roleId}\n secretIdWo: ${id.secretId}\n secretIdWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n", "properties": { "accessor": { "type": "string", "description": "The accessor for the token.\n" }, "backend": { "type": "string", "description": "The unique path of the Vault backend to log in with.\n" }, "clientToken": { "type": "string", "description": "The Vault token created.\n", "secret": true }, "leaseDuration": { "type": "integer", "description": "How long the token is valid for, in seconds.\n" }, "leaseStarted": { "type": "string", "description": "The date and time the lease started, in RFC 3339 format.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata associated with the token.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A list of policies applied to the token.\n" }, "renewable": { "type": "boolean", "description": "Whether the token is renewable or not.\n" }, "roleId": { "type": "string", "description": "The ID of the role to log in with.\n" }, "secretId": { "type": "string", "description": "The secret ID of the role to log in with. Required\nunless \u003cspan pulumi-lang-nodejs=\"`bindSecretId`\" pulumi-lang-dotnet=\"`BindSecretId`\" pulumi-lang-go=\"`bindSecretId`\" pulumi-lang-python=\"`bind_secret_id`\" pulumi-lang-yaml=\"`bindSecretId`\" pulumi-lang-java=\"`bindSecretId`\" pulumi-lang-hcl=\"`bind_secret_id`\"\u003e`bindSecretId`\u003c/span\u003e is set to false on the role.\n", "secret": true }, "secretIdWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe SecretID to log in with. Write-only attribute that can accept ephemeral values. Required unless \u003cspan pulumi-lang-nodejs=\"`bindSecretId`\" pulumi-lang-dotnet=\"`BindSecretId`\" pulumi-lang-go=\"`bindSecretId`\" pulumi-lang-python=\"`bind_secret_id`\" pulumi-lang-yaml=\"`bindSecretId`\" pulumi-lang-java=\"`bindSecretId`\" pulumi-lang-hcl=\"`bind_secret_id`\"\u003e`bindSecretId`\u003c/span\u003e is set to false on the role.", "secret": true }, "secretIdWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`secretIdWo`\" pulumi-lang-dotnet=\"`SecretIdWo`\" pulumi-lang-go=\"`secretIdWo`\" pulumi-lang-python=\"`secret_id_wo`\" pulumi-lang-yaml=\"`secretIdWo`\" pulumi-lang-java=\"`secretIdWo`\" pulumi-lang-hcl=\"`secret_id_wo`\"\u003e`secretIdWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" } }, "required": [ "accessor", "clientToken", "leaseDuration", "leaseStarted", "metadata", "policies", "renewable", "roleId" ], "inputProperties": { "backend": { "type": "string", "description": "The unique path of the Vault backend to log in with.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "roleId": { "type": "string", "description": "The ID of the role to log in with.\n", "willReplaceOnChanges": true }, "secretId": { "type": "string", "description": "The secret ID of the role to log in with. Required\nunless \u003cspan pulumi-lang-nodejs=\"`bindSecretId`\" pulumi-lang-dotnet=\"`BindSecretId`\" pulumi-lang-go=\"`bindSecretId`\" pulumi-lang-python=\"`bind_secret_id`\" pulumi-lang-yaml=\"`bindSecretId`\" pulumi-lang-java=\"`bindSecretId`\" pulumi-lang-hcl=\"`bind_secret_id`\"\u003e`bindSecretId`\u003c/span\u003e is set to false on the role.\n", "secret": true, "willReplaceOnChanges": true }, "secretIdWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe SecretID to log in with. Write-only attribute that can accept ephemeral values. Required unless \u003cspan pulumi-lang-nodejs=\"`bindSecretId`\" pulumi-lang-dotnet=\"`BindSecretId`\" pulumi-lang-go=\"`bindSecretId`\" pulumi-lang-python=\"`bind_secret_id`\" pulumi-lang-yaml=\"`bindSecretId`\" pulumi-lang-java=\"`bindSecretId`\" pulumi-lang-hcl=\"`bind_secret_id`\"\u003e`bindSecretId`\u003c/span\u003e is set to false on the role.", "secret": true }, "secretIdWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`secretIdWo`\" pulumi-lang-dotnet=\"`SecretIdWo`\" pulumi-lang-go=\"`secretIdWo`\" pulumi-lang-python=\"`secret_id_wo`\" pulumi-lang-yaml=\"`secretIdWo`\" pulumi-lang-java=\"`secretIdWo`\" pulumi-lang-hcl=\"`secret_id_wo`\"\u003e`secretIdWo`\u003c/span\u003e. For more info see updating write-only attributes.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "roleId" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendLogin resources.\n", "properties": { "accessor": { "type": "string", "description": "The accessor for the token.\n" }, "backend": { "type": "string", "description": "The unique path of the Vault backend to log in with.\n", "willReplaceOnChanges": true }, "clientToken": { "type": "string", "description": "The Vault token created.\n", "secret": true }, "leaseDuration": { "type": "integer", "description": "How long the token is valid for, in seconds.\n" }, "leaseStarted": { "type": "string", "description": "The date and time the lease started, in RFC 3339 format.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata associated with the token.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A list of policies applied to the token.\n" }, "renewable": { "type": "boolean", "description": "Whether the token is renewable or not.\n" }, "roleId": { "type": "string", "description": "The ID of the role to log in with.\n", "willReplaceOnChanges": true }, "secretId": { "type": "string", "description": "The secret ID of the role to log in with. Required\nunless \u003cspan pulumi-lang-nodejs=\"`bindSecretId`\" pulumi-lang-dotnet=\"`BindSecretId`\" pulumi-lang-go=\"`bindSecretId`\" pulumi-lang-python=\"`bind_secret_id`\" pulumi-lang-yaml=\"`bindSecretId`\" pulumi-lang-java=\"`bindSecretId`\" pulumi-lang-hcl=\"`bind_secret_id`\"\u003e`bindSecretId`\u003c/span\u003e is set to false on the role.\n", "secret": true, "willReplaceOnChanges": true }, "secretIdWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe SecretID to log in with. Write-only attribute that can accept ephemeral values. Required unless \u003cspan pulumi-lang-nodejs=\"`bindSecretId`\" pulumi-lang-dotnet=\"`BindSecretId`\" pulumi-lang-go=\"`bindSecretId`\" pulumi-lang-python=\"`bind_secret_id`\" pulumi-lang-yaml=\"`bindSecretId`\" pulumi-lang-java=\"`bindSecretId`\" pulumi-lang-hcl=\"`bind_secret_id`\"\u003e`bindSecretId`\u003c/span\u003e is set to false on the role.", "secret": true }, "secretIdWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`secretIdWo`\" pulumi-lang-dotnet=\"`SecretIdWo`\" pulumi-lang-go=\"`secretIdWo`\" pulumi-lang-python=\"`secret_id_wo`\" pulumi-lang-yaml=\"`secretIdWo`\" pulumi-lang-java=\"`secretIdWo`\" pulumi-lang-hcl=\"`secret_id_wo`\"\u003e`secretIdWo`\u003c/span\u003e. For more info see updating write-only attributes.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:appRole/authBackendRole:AuthBackendRole": { "description": "Manages an AppRole auth backend role in a Vault server. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/approle) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst approle = new vault.AuthBackend(\"approle\", {type: \"approle\"});\nconst example = new vault.approle.AuthBackendRole(\"example\", {\n backend: approle.path,\n roleName: \"test-role\",\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\napprole = vault.AuthBackend(\"approle\", type=\"approle\")\nexample = vault.approle.AuthBackendRole(\"example\",\n backend=approle.path,\n role_name=\"test-role\",\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var approle = new Vault.AuthBackend(\"approle\", new()\n {\n Type = \"approle\",\n });\n\n var example = new Vault.AppRole.AuthBackendRole(\"example\", new()\n {\n Backend = approle.Path,\n RoleName = \"test-role\",\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/approle\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tapprole2, err := vault.NewAuthBackend(ctx, \"approle\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"approle\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = approle.NewAuthBackendRole(ctx, \"example\", \u0026approle.AuthBackendRoleArgs{\n\t\t\tBackend: approle2.Path,\n\t\t\tRoleName: pulumi.String(\"test-role\"),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"approle\" {\n type = \"approle\"\n}\nresource \"vault_approle_authbackendrole\" \"example\" {\n backend = vault_authbackend.approle.path\n role_name = \"test-role\"\n token_policies = [\"default\", \"dev\", \"prod\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.appRole.AuthBackendRole;\nimport com.pulumi.vault.appRole.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var approle = new AuthBackend(\"approle\", AuthBackendArgs.builder()\n .type(\"approle\")\n .build());\n\n var example = new AuthBackendRole(\"example\", AuthBackendRoleArgs.builder()\n .backend(approle.path())\n .roleName(\"test-role\")\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n approle:\n type: vault:AuthBackend\n properties:\n type: approle\n example:\n type: vault:appRole:AuthBackendRole\n properties:\n backend: ${approle.path}\n roleName: test-role\n tokenPolicies:\n - default\n - dev\n - prod\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAppRole authentication backend roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:appRole/authBackendRole:AuthBackendRole example auth/approle/role/test-role\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "backend": { "type": "string", "description": "The unique name of the auth backend to configure.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`approle`\" pulumi-lang-dotnet=\"`Approle`\" pulumi-lang-go=\"`approle`\" pulumi-lang-python=\"`approle`\" pulumi-lang-yaml=\"`approle`\" pulumi-lang-java=\"`approle`\" pulumi-lang-hcl=\"`approle`\"\u003e`approle`\u003c/span\u003e.\n" }, "bindSecretId": { "type": "boolean", "description": "Whether or not to require \u003cspan pulumi-lang-nodejs=\"`secretId`\" pulumi-lang-dotnet=\"`SecretId`\" pulumi-lang-go=\"`secretId`\" pulumi-lang-python=\"`secret_id`\" pulumi-lang-yaml=\"`secretId`\" pulumi-lang-java=\"`secretId`\" pulumi-lang-hcl=\"`secret_id`\"\u003e`secretId`\u003c/span\u003e to be\npresented when logging in using this AppRole. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "localSecretIds": { "type": "boolean", "description": "If true, SecretIDs generated against this role will be 'local' to the node they were generated on. This means that they will only be valid when used against the same node that they were generated on." }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "roleId": { "type": "string", "description": "The RoleID of this role. If not specified, one will be\nauto-generated.\n" }, "roleName": { "type": "string", "description": "The name of the role.\n" }, "secretIdBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "If set,\nspecifies blocks of IP addresses which can perform the login operation.\n" }, "secretIdNumUses": { "type": "integer", "description": "The number of times any particular SecretID\ncan be used to fetch a token from this AppRole, after which the SecretID will\nexpire. A value of zero will allow unlimited uses.\n" }, "secretIdTtl": { "type": "integer", "description": "The number of seconds after which any SecretID\nexpires.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "roleId", "roleName" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "backend": { "type": "string", "description": "The unique name of the auth backend to configure.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`approle`\" pulumi-lang-dotnet=\"`Approle`\" pulumi-lang-go=\"`approle`\" pulumi-lang-python=\"`approle`\" pulumi-lang-yaml=\"`approle`\" pulumi-lang-java=\"`approle`\" pulumi-lang-hcl=\"`approle`\"\u003e`approle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "bindSecretId": { "type": "boolean", "description": "Whether or not to require \u003cspan pulumi-lang-nodejs=\"`secretId`\" pulumi-lang-dotnet=\"`SecretId`\" pulumi-lang-go=\"`secretId`\" pulumi-lang-python=\"`secret_id`\" pulumi-lang-yaml=\"`secretId`\" pulumi-lang-java=\"`secretId`\" pulumi-lang-hcl=\"`secret_id`\"\u003e`secretId`\u003c/span\u003e to be\npresented when logging in using this AppRole. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "localSecretIds": { "type": "boolean", "description": "If true, SecretIDs generated against this role will be 'local' to the node they were generated on. This means that they will only be valid when used against the same node that they were generated on." }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "roleId": { "type": "string", "description": "The RoleID of this role. If not specified, one will be\nauto-generated.\n" }, "roleName": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "secretIdBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "If set,\nspecifies blocks of IP addresses which can perform the login operation.\n" }, "secretIdNumUses": { "type": "integer", "description": "The number of times any particular SecretID\ncan be used to fetch a token from this AppRole, after which the SecretID will\nexpire. A value of zero will allow unlimited uses.\n" }, "secretIdTtl": { "type": "integer", "description": "The number of seconds after which any SecretID\nexpires.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "requiredInputs": [ "roleName" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "backend": { "type": "string", "description": "The unique name of the auth backend to configure.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`approle`\" pulumi-lang-dotnet=\"`Approle`\" pulumi-lang-go=\"`approle`\" pulumi-lang-python=\"`approle`\" pulumi-lang-yaml=\"`approle`\" pulumi-lang-java=\"`approle`\" pulumi-lang-hcl=\"`approle`\"\u003e`approle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "bindSecretId": { "type": "boolean", "description": "Whether or not to require \u003cspan pulumi-lang-nodejs=\"`secretId`\" pulumi-lang-dotnet=\"`SecretId`\" pulumi-lang-go=\"`secretId`\" pulumi-lang-python=\"`secret_id`\" pulumi-lang-yaml=\"`secretId`\" pulumi-lang-java=\"`secretId`\" pulumi-lang-hcl=\"`secret_id`\"\u003e`secretId`\u003c/span\u003e to be\npresented when logging in using this AppRole. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "localSecretIds": { "type": "boolean", "description": "If true, SecretIDs generated against this role will be 'local' to the node they were generated on. This means that they will only be valid when used against the same node that they were generated on." }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "roleId": { "type": "string", "description": "The RoleID of this role. If not specified, one will be\nauto-generated.\n" }, "roleName": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "secretIdBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "If set,\nspecifies blocks of IP addresses which can perform the login operation.\n" }, "secretIdNumUses": { "type": "integer", "description": "The number of times any particular SecretID\ncan be used to fetch a token from this AppRole, after which the SecretID will\nexpire. A value of zero will allow unlimited uses.\n" }, "secretIdTtl": { "type": "integer", "description": "The number of seconds after which any SecretID\nexpires.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:appRole/authBackendRoleSecretId:AuthBackendRoleSecretId": { "description": "Manages an AppRole auth backend SecretID in a Vault server. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/approle) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst approle = new vault.AuthBackend(\"approle\", {type: \"approle\"});\nconst example = new vault.approle.AuthBackendRole(\"example\", {\n backend: approle.path,\n roleName: \"test-role\",\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n});\nconst id = new vault.approle.AuthBackendRoleSecretId(\"id\", {\n backend: approle.path,\n roleName: example.roleName,\n metadata: JSON.stringify({\n hello: \"world\",\n }),\n});\n```\n```python\nimport pulumi\nimport json\nimport pulumi_vault as vault\n\napprole = vault.AuthBackend(\"approle\", type=\"approle\")\nexample = vault.approle.AuthBackendRole(\"example\",\n backend=approle.path,\n role_name=\"test-role\",\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ])\nid = vault.approle.AuthBackendRoleSecretId(\"id\",\n backend=approle.path,\n role_name=example.role_name,\n metadata=json.dumps({\n \"hello\": \"world\",\n }))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text.Json;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var approle = new Vault.AuthBackend(\"approle\", new()\n {\n Type = \"approle\",\n });\n\n var example = new Vault.AppRole.AuthBackendRole(\"example\", new()\n {\n Backend = approle.Path,\n RoleName = \"test-role\",\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n });\n\n var id = new Vault.AppRole.AuthBackendRoleSecretId(\"id\", new()\n {\n Backend = approle.Path,\n RoleName = example.RoleName,\n Metadata = JsonSerializer.Serialize(new Dictionary\u003cstring, object?\u003e\n {\n [\"hello\"] = \"world\",\n }),\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/approle\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tapprole2, err := vault.NewAuthBackend(ctx, \"approle\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"approle\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texample, err := approle.NewAuthBackendRole(ctx, \"example\", \u0026approle.AuthBackendRoleArgs{\n\t\t\tBackend: approle2.Path,\n\t\t\tRoleName: pulumi.String(\"test-role\"),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttmpJSON0, err := json.Marshal(map[string]string{\n\t\t\t\"hello\": \"world\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjson0 := string(tmpJSON0)\n\t\t_, err = approle.NewAuthBackendRoleSecretId(ctx, \"id\", \u0026approle.AuthBackendRoleSecretIdArgs{\n\t\t\tBackend: approle2.Path,\n\t\t\tRoleName: example.RoleName,\n\t\t\tMetadata: pulumi.String(json0),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"approle\" {\n type = \"approle\"\n}\nresource \"vault_approle_authbackendrole\" \"example\" {\n backend = vault_authbackend.approle.path\n role_name = \"test-role\"\n token_policies = [\"default\", \"dev\", \"prod\"]\n}\nresource \"vault_approle_authbackendrolesecretid\" \"id\" {\n backend = vault_authbackend.approle.path\n role_name = vault_approle_authbackendrole.example.role_name\n metadata = jsonencode({\n \"hello\" = \"world\"\n })\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.appRole.AuthBackendRole;\nimport com.pulumi.vault.appRole.AuthBackendRoleArgs;\nimport com.pulumi.vault.appRole.AuthBackendRoleSecretId;\nimport com.pulumi.vault.appRole.AuthBackendRoleSecretIdArgs;\nimport static com.pulumi.codegen.internal.Serialization.*;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var approle = new AuthBackend(\"approle\", AuthBackendArgs.builder()\n .type(\"approle\")\n .build());\n\n var example = new AuthBackendRole(\"example\", AuthBackendRoleArgs.builder()\n .backend(approle.path())\n .roleName(\"test-role\")\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .build());\n\n var id = new AuthBackendRoleSecretId(\"id\", AuthBackendRoleSecretIdArgs.builder()\n .backend(approle.path())\n .roleName(example.roleName())\n .metadata(serializeJson(\n jsonObject(\n jsonProperty(\"hello\", \"world\")\n )))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n approle:\n type: vault:AuthBackend\n properties:\n type: approle\n example:\n type: vault:appRole:AuthBackendRole\n properties:\n backend: ${approle.path}\n roleName: test-role\n tokenPolicies:\n - default\n - dev\n - prod\n id:\n type: vault:appRole:AuthBackendRoleSecretId\n properties:\n backend: ${approle.path}\n roleName: ${example.roleName}\n metadata:\n fn::toJSON:\n hello: world\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "accessor": { "type": "string", "description": "The unique ID for this SecretID that can be safely logged.\n" }, "backend": { "type": "string", "description": "Unique name of the auth backend to configure." }, "cidrLists": { "type": "array", "items": { "type": "string" }, "description": "If set, specifies blocks of IP addresses which can\nperform the login operation using this SecretID.\n" }, "metadata": { "type": "string", "description": "A JSON-encoded string containing metadata in\nkey-value pairs to be set on tokens issued with this SecretID.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "numUses": { "type": "integer", "description": "The number of uses for the secret-id." }, "roleName": { "type": "string", "description": "The name of the role to create the SecretID for.\n" }, "secretId": { "type": "string", "description": "The SecretID to be created. If set, uses \"Push\"\nmode. Defaults to Vault auto-generating SecretIDs.\n", "secret": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "If set, specifies blocks of IP addresses which\ncan use the auth tokens generated by this SecretID. Overrides any role-set\nvalue but must be a subset.\n" }, "ttl": { "type": "integer", "description": "The TTL duration of the SecretID." }, "withWrappedAccessor": { "type": "boolean", "description": "Set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e to use the wrapped secret-id accessor as the resource ID.\nIf \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e (default value), a fresh secret ID will be regenerated whenever the wrapping token is expired or\ninvalidated through unwrapping.\n" }, "wrappingAccessor": { "type": "string", "description": "The unique ID for the response-wrapped SecretID that can\nbe safely logged.\n" }, "wrappingToken": { "type": "string", "description": "The token used to retrieve a response-wrapped SecretID.\n", "secret": true }, "wrappingTtl": { "type": "string", "description": "If set, the SecretID response will be\n[response-wrapped](https://www.vaultproject.io/docs/concepts/response-wrapping)\nand available for the duration specified. Only a single unwrapping of the\ntoken is allowed.\n" } }, "required": [ "accessor", "roleName", "secretId", "wrappingAccessor", "wrappingToken" ], "inputProperties": { "backend": { "type": "string", "description": "Unique name of the auth backend to configure.", "willReplaceOnChanges": true }, "cidrLists": { "type": "array", "items": { "type": "string" }, "description": "If set, specifies blocks of IP addresses which can\nperform the login operation using this SecretID.\n", "willReplaceOnChanges": true }, "metadata": { "type": "string", "description": "A JSON-encoded string containing metadata in\nkey-value pairs to be set on tokens issued with this SecretID.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "numUses": { "type": "integer", "description": "The number of uses for the secret-id.", "willReplaceOnChanges": true }, "roleName": { "type": "string", "description": "The name of the role to create the SecretID for.\n", "willReplaceOnChanges": true }, "secretId": { "type": "string", "description": "The SecretID to be created. If set, uses \"Push\"\nmode. Defaults to Vault auto-generating SecretIDs.\n", "secret": true, "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "If set, specifies blocks of IP addresses which\ncan use the auth tokens generated by this SecretID. Overrides any role-set\nvalue but must be a subset.\n", "willReplaceOnChanges": true }, "ttl": { "type": "integer", "description": "The TTL duration of the SecretID.", "willReplaceOnChanges": true }, "withWrappedAccessor": { "type": "boolean", "description": "Set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e to use the wrapped secret-id accessor as the resource ID.\nIf \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e (default value), a fresh secret ID will be regenerated whenever the wrapping token is expired or\ninvalidated through unwrapping.\n", "willReplaceOnChanges": true }, "wrappingTtl": { "type": "string", "description": "If set, the SecretID response will be\n[response-wrapped](https://www.vaultproject.io/docs/concepts/response-wrapping)\nand available for the duration specified. Only a single unwrapping of the\ntoken is allowed.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "roleName" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRoleSecretId resources.\n", "properties": { "accessor": { "type": "string", "description": "The unique ID for this SecretID that can be safely logged.\n" }, "backend": { "type": "string", "description": "Unique name of the auth backend to configure.", "willReplaceOnChanges": true }, "cidrLists": { "type": "array", "items": { "type": "string" }, "description": "If set, specifies blocks of IP addresses which can\nperform the login operation using this SecretID.\n", "willReplaceOnChanges": true }, "metadata": { "type": "string", "description": "A JSON-encoded string containing metadata in\nkey-value pairs to be set on tokens issued with this SecretID.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "numUses": { "type": "integer", "description": "The number of uses for the secret-id.", "willReplaceOnChanges": true }, "roleName": { "type": "string", "description": "The name of the role to create the SecretID for.\n", "willReplaceOnChanges": true }, "secretId": { "type": "string", "description": "The SecretID to be created. If set, uses \"Push\"\nmode. Defaults to Vault auto-generating SecretIDs.\n", "secret": true, "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "If set, specifies blocks of IP addresses which\ncan use the auth tokens generated by this SecretID. Overrides any role-set\nvalue but must be a subset.\n", "willReplaceOnChanges": true }, "ttl": { "type": "integer", "description": "The TTL duration of the SecretID.", "willReplaceOnChanges": true }, "withWrappedAccessor": { "type": "boolean", "description": "Set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e to use the wrapped secret-id accessor as the resource ID.\nIf \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e (default value), a fresh secret ID will be regenerated whenever the wrapping token is expired or\ninvalidated through unwrapping.\n", "willReplaceOnChanges": true }, "wrappingAccessor": { "type": "string", "description": "The unique ID for the response-wrapped SecretID that can\nbe safely logged.\n" }, "wrappingToken": { "type": "string", "description": "The token used to retrieve a response-wrapped SecretID.\n", "secret": true }, "wrappingTtl": { "type": "string", "description": "If set, the SecretID response will be\n[response-wrapped](https://www.vaultproject.io/docs/concepts/response-wrapping)\nand available for the duration specified. Only a single unwrapping of the\ntoken is allowed.\n", "willReplaceOnChanges": true } }, "type": "object" }, "aliases": [ { "type": "vault:appRole/authBackendRoleSecretID:AuthBackendRoleSecretID" } ] }, "vault:aws/authBackendCert:AuthBackendCert": { "description": "Manages a certificate to be used with an AWS Auth Backend in Vault.\n\nThis resource sets the AWS public key and the type of document that can be\nverified against the key that Vault can then use to verify the instance\nidentity documents making auth requests.\n\nFor more information, see the [Vault\ndocs](https://www.vaultproject.io/api-docs/auth/aws#configure-client).\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and will\nappear in the console output when Terraform runs. Protect these artifacts\naccordingly. See the main provider documentation for more\ndetails.\n\n## Import\n\nAWS auth backend certificates can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e path, `/config/certificate/`, and the \u003cspan pulumi-lang-nodejs=\"`certName`\" pulumi-lang-dotnet=\"`CertName`\" pulumi-lang-go=\"`certName`\" pulumi-lang-python=\"`cert_name`\" pulumi-lang-yaml=\"`certName`\" pulumi-lang-java=\"`certName`\" pulumi-lang-hcl=\"`cert_name`\"\u003e`certName`\u003c/span\u003e e.g.\n\n```sh\n$ pulumi import vault:aws/authBackendCert:AuthBackendCert example auth/aws/config/certificate/my-cert\n```\n\n", "properties": { "awsPublicCert": { "type": "string", "description": "The Base64 encoded AWS Public key required to\nverify PKCS7 signature of the EC2 instance metadata. You can find this key in\nthe [AWS\ndocumentation](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html).\n" }, "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n" }, "certName": { "type": "string", "description": "The name of the certificate.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "type": { "type": "string", "description": "Either \"pkcs7\" or \"identity\", indicating the type of\ndocument which can be verified using the given certificate. Defaults to\n\"pkcs7\".\n" } }, "required": [ "awsPublicCert", "certName" ], "inputProperties": { "awsPublicCert": { "type": "string", "description": "The Base64 encoded AWS Public key required to\nverify PKCS7 signature of the EC2 instance metadata. You can find this key in\nthe [AWS\ndocumentation](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html).\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "certName": { "type": "string", "description": "The name of the certificate.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Either \"pkcs7\" or \"identity\", indicating the type of\ndocument which can be verified using the given certificate. Defaults to\n\"pkcs7\".\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "awsPublicCert", "certName" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendCert resources.\n", "properties": { "awsPublicCert": { "type": "string", "description": "The Base64 encoded AWS Public key required to\nverify PKCS7 signature of the EC2 instance metadata. You can find this key in\nthe [AWS\ndocumentation](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html).\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "certName": { "type": "string", "description": "The name of the certificate.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Either \"pkcs7\" or \"identity\", indicating the type of\ndocument which can be verified using the given certificate. Defaults to\n\"pkcs7\".\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:aws/authBackendClient:AuthBackendClient": { "description": "Configures the client used by an AWS Auth Backend in Vault.\n\nThis resource sets the access key and secret key that Vault will use\nwhen making API requests on behalf of an AWS Auth Backend. It can also\nbe used to override the URLs Vault uses when making those API requests.\n\nFor more information, see the\n[Vault docs](https://www.vaultproject.io/api-docs/auth/aws#configure-client).\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n### Using Write-Only Secret Key (Recommended)\n\nFor enhanced security, use the write-only \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field which is never stored in Terraform state:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.AuthBackend(\"example\", {type: \"aws\"});\nconst exampleAuthBackendClient = new vault.aws.AuthBackendClient(\"example\", {\n backend: example.path,\n accessKey: \"INSERT_AWS_ACCESS_KEY\",\n secretKeyWo: awsSecretKey,\n secretKeyWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.AuthBackend(\"example\", type=\"aws\")\nexample_auth_backend_client = vault.aws.AuthBackendClient(\"example\",\n backend=example.path,\n access_key=\"INSERT_AWS_ACCESS_KEY\",\n secret_key_wo=aws_secret_key,\n secret_key_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.AuthBackend(\"example\", new()\n {\n Type = \"aws\",\n });\n\n var exampleAuthBackendClient = new Vault.Aws.AuthBackendClient(\"example\", new()\n {\n Backend = example.Path,\n AccessKey = \"INSERT_AWS_ACCESS_KEY\",\n SecretKeyWo = awsSecretKey,\n SecretKeyWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewAuthBackend(ctx, \"example\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendClient(ctx, \"example\", \u0026aws.AuthBackendClientArgs{\n\t\t\tBackend: example.Path,\n\t\t\tAccessKey: pulumi.String(\"INSERT_AWS_ACCESS_KEY\"),\n\t\t\tSecretKeyWo: pulumi.Any(awsSecretKey),\n\t\t\tSecretKeyWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"example\" {\n type = \"aws\"\n}\nresource \"vault_aws_authbackendclient\" \"example\" {\n backend = vault_authbackend.example.path\n access_key = \"INSERT_AWS_ACCESS_KEY\"\n secret_key_wo = awsSecretKey\n secret_key_wo_version = 1 # Increment to rotate\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendClient;\nimport com.pulumi.vault.aws.AuthBackendClientArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .type(\"aws\")\n .build());\n\n var exampleAuthBackendClient = new AuthBackendClient(\"exampleAuthBackendClient\", AuthBackendClientArgs.builder()\n .backend(example.path())\n .accessKey(\"INSERT_AWS_ACCESS_KEY\")\n .secretKeyWo(awsSecretKey)\n .secretKeyWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:AuthBackend\n properties:\n type: aws\n exampleAuthBackendClient:\n type: vault:aws:AuthBackendClient\n name: example\n properties:\n backend: ${example.path}\n accessKey: INSERT_AWS_ACCESS_KEY\n secretKeyWo: ${awsSecretKey}\n secretKeyWoVersion: 1 # Increment to rotate\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Workload Identity Federation (Secret-less)\n\nYou can setup the AWS auth engine with Workload Identity Federation (WIF) for a secret-less configuration:\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.AuthBackend(\"example\", {type: \"aws\"});\nconst exampleAuthBackendClient = new vault.aws.AuthBackendClient(\"example\", {\n identityTokenAudience: \"\u003cTOKEN_AUDIENCE\u003e\",\n identityTokenTtl: Number(\"\u003cTOKEN_TTL\u003e\"),\n roleArn: \"\u003cAWS_ROLE_ARN\u003e\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.AuthBackend(\"example\", type=\"aws\")\nexample_auth_backend_client = vault.aws.AuthBackendClient(\"example\",\n identity_token_audience=\"\u003cTOKEN_AUDIENCE\u003e\",\n identity_token_ttl=int(\"\u003cTOKEN_TTL\u003e\"),\n role_arn=\"\u003cAWS_ROLE_ARN\u003e\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.AuthBackend(\"example\", new()\n {\n Type = \"aws\",\n });\n\n var exampleAuthBackendClient = new Vault.Aws.AuthBackendClient(\"example\", new()\n {\n IdentityTokenAudience = \"\u003cTOKEN_AUDIENCE\u003e\",\n IdentityTokenTtl = \"\u003cTOKEN_TTL\u003e\",\n RoleArn = \"\u003cAWS_ROLE_ARN\u003e\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewAuthBackend(ctx, \"example\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendClient(ctx, \"example\", \u0026aws.AuthBackendClientArgs{\n\t\t\tIdentityTokenAudience: pulumi.String(\"\u003cTOKEN_AUDIENCE\u003e\"),\n\t\t\tIdentityTokenTtl: pulumi.Int(\"\u003cTOKEN_TTL\u003e\"),\n\t\t\tRoleArn: pulumi.String(\"\u003cAWS_ROLE_ARN\u003e\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"example\" {\n type = \"aws\"\n}\nresource \"vault_aws_authbackendclient\" \"example\" {\n identity_token_audience = \"\u003cTOKEN_AUDIENCE\u003e\"\n identity_token_ttl = \"\u003cTOKEN_TTL\u003e\"\n role_arn = \"\u003cAWS_ROLE_ARN\u003e\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendClient;\nimport com.pulumi.vault.aws.AuthBackendClientArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .type(\"aws\")\n .build());\n\n var exampleAuthBackendClient = new AuthBackendClient(\"exampleAuthBackendClient\", AuthBackendClientArgs.builder()\n .identityTokenAudience(\"\u003cTOKEN_AUDIENCE\u003e\")\n .identityTokenTtl(\"\u003cTOKEN_TTL\u003e\")\n .roleArn(\"\u003cAWS_ROLE_ARN\u003e\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:AuthBackend\n properties:\n type: aws\n exampleAuthBackendClient:\n type: vault:aws:AuthBackendClient\n name: example\n properties:\n identityTokenAudience: \u003cTOKEN_AUDIENCE\u003e\n identityTokenTtl: \u003cTOKEN_TTL\u003e\n roleArn: \u003cAWS_ROLE_ARN\u003e\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Legacy Secret Key Field\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.AuthBackend(\"example\", {type: \"aws\"});\nconst exampleAuthBackendClient = new vault.aws.AuthBackendClient(\"example\", {\n backend: example.path,\n accessKey: \"INSERT_AWS_ACCESS_KEY\",\n secretKey: \"INSERT_AWS_SECRET_KEY\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n allowedStsHeaderValues: [\n \"X-Custom-Header\",\n \"X-Another-Header\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.AuthBackend(\"example\", type=\"aws\")\nexample_auth_backend_client = vault.aws.AuthBackendClient(\"example\",\n backend=example.path,\n access_key=\"INSERT_AWS_ACCESS_KEY\",\n secret_key=\"INSERT_AWS_SECRET_KEY\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600,\n allowed_sts_header_values=[\n \"X-Custom-Header\",\n \"X-Another-Header\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.AuthBackend(\"example\", new()\n {\n Type = \"aws\",\n });\n\n var exampleAuthBackendClient = new Vault.Aws.AuthBackendClient(\"example\", new()\n {\n Backend = example.Path,\n AccessKey = \"INSERT_AWS_ACCESS_KEY\",\n SecretKey = \"INSERT_AWS_SECRET_KEY\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n AllowedStsHeaderValues = new[]\n {\n \"X-Custom-Header\",\n \"X-Another-Header\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewAuthBackend(ctx, \"example\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendClient(ctx, \"example\", \u0026aws.AuthBackendClientArgs{\n\t\t\tBackend: example.Path,\n\t\t\tAccessKey: pulumi.String(\"INSERT_AWS_ACCESS_KEY\"),\n\t\t\tSecretKey: pulumi.String(\"INSERT_AWS_SECRET_KEY\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t\tAllowedStsHeaderValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"X-Custom-Header\"),\n\t\t\t\tpulumi.String(\"X-Another-Header\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"example\" {\n type = \"aws\"\n}\nresource \"vault_aws_authbackendclient\" \"example\" {\n backend = vault_authbackend.example.path\n access_key = \"INSERT_AWS_ACCESS_KEY\"\n secret_key = \"INSERT_AWS_SECRET_KEY\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n allowed_sts_header_values = [\"X-Custom-Header\", \"X-Another-Header\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendClient;\nimport com.pulumi.vault.aws.AuthBackendClientArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .type(\"aws\")\n .build());\n\n var exampleAuthBackendClient = new AuthBackendClient(\"exampleAuthBackendClient\", AuthBackendClientArgs.builder()\n .backend(example.path())\n .accessKey(\"INSERT_AWS_ACCESS_KEY\")\n .secretKey(\"INSERT_AWS_SECRET_KEY\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .allowedStsHeaderValues( \n \"X-Custom-Header\",\n \"X-Another-Header\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:AuthBackend\n properties:\n type: aws\n exampleAuthBackendClient:\n type: vault:aws:AuthBackendClient\n name: example\n properties:\n backend: ${example.path}\n accessKey: INSERT_AWS_ACCESS_KEY\n secretKey: INSERT_AWS_SECRET_KEY\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n allowedStsHeaderValues:\n - X-Custom-Header\n - X-Another-Header\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e - (Optional) Write-only AWS secret key that Vault should use for the\n auth backend. This field is recommended over \u003cspan pulumi-lang-nodejs=\"`secretKey`\" pulumi-lang-dotnet=\"`SecretKey`\" pulumi-lang-go=\"`secretKey`\" pulumi-lang-python=\"`secret_key`\" pulumi-lang-yaml=\"`secretKey`\" pulumi-lang-java=\"`secretKey`\" pulumi-lang-hcl=\"`secret_key`\"\u003e`secretKey`\u003c/span\u003e for enhanced security as it\n is never stored in Terraform state. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`secretKey`\" pulumi-lang-dotnet=\"`SecretKey`\" pulumi-lang-go=\"`secretKey`\" pulumi-lang-python=\"`secret_key`\" pulumi-lang-yaml=\"`secretKey`\" pulumi-lang-java=\"`secretKey`\" pulumi-lang-hcl=\"`secret_key`\"\u003e`secretKey`\u003c/span\u003e.\n Must be used together with \u003cspan pulumi-lang-nodejs=\"`secretKeyWoVersion`\" pulumi-lang-dotnet=\"`SecretKeyWoVersion`\" pulumi-lang-go=\"`secretKeyWoVersion`\" pulumi-lang-python=\"`secret_key_wo_version`\" pulumi-lang-yaml=\"`secretKeyWoVersion`\" pulumi-lang-java=\"`secretKeyWoVersion`\" pulumi-lang-hcl=\"`secret_key_wo_version`\"\u003e`secretKeyWoVersion`\u003c/span\u003e.\n **Note**: This property is write-only and will not be read from the API.\n\n## Import\n\nAWS auth backend clients can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e path, and `/config/client` e.g.\n\n```sh\n$ pulumi import vault:aws/authBackendClient:AuthBackendClient example auth/aws/config/client\n```\n\n", "properties": { "accessKey": { "type": "string", "description": "The AWS access key that Vault should use for the\nauth backend. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`identityTokenAudience`\" pulumi-lang-dotnet=\"`IdentityTokenAudience`\" pulumi-lang-go=\"`identityTokenAudience`\" pulumi-lang-python=\"`identity_token_audience`\" pulumi-lang-yaml=\"`identityTokenAudience`\" pulumi-lang-java=\"`identityTokenAudience`\" pulumi-lang-hcl=\"`identity_token_audience`\"\u003e`identityTokenAudience`\u003c/span\u003e.\n", "secret": true }, "allowedStsHeaderValues": { "type": "array", "items": { "type": "string" }, "description": "List of additional headers that are allowed to be in STS request headers.\nThe headers are automatically canonicalized (e.g., `content-type` becomes `Content-Type`). Duplicate values are automatically\nremoved. This can be useful when you need to allow specific headers in STS requests for IAM-based authentication.\n" }, "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "ec2Endpoint": { "type": "string", "description": "Override the URL Vault uses when making EC2 API\ncalls.\n" }, "iamEndpoint": { "type": "string", "description": "Override the URL Vault uses when making IAM API\ncalls.\n" }, "iamServerIdHeaderValue": { "type": "string", "description": "The value to require in the\n`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests\nthat are used in the IAM auth method.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e. \nRequires Vault 1.17+. *Available only for Vault Enterprise*\n" }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "maxRetries": { "type": "integer", "description": "Number of max retries the client should use for recoverable errors. \nThe default `-1` falls back to the AWS SDK's default behavior.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "roleArn": { "type": "string", "description": "Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "secretKey": { "type": "string", "description": "The AWS secret key that Vault should use for the\nauth backend. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e.\n**Note:** This field stores the secret in Terraform state in plain text.\nConsider using \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "secretKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only AWS Secret key with permissions to query AWS APIs. This field is recommended over\u003cspan pulumi-lang-nodejs=\" secretKey \" pulumi-lang-dotnet=\" SecretKey \" pulumi-lang-go=\" secretKey \" pulumi-lang-python=\" secret_key \" pulumi-lang-yaml=\" secretKey \" pulumi-lang-java=\" secretKey \" pulumi-lang-hcl=\" secret_key \"\u003e secretKey \u003c/span\u003efor enhanced security.", "secret": true }, "secretKeyWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field.\nIncrement this value to rotate the secret key. Required when \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e is set.\n" }, "stsEndpoint": { "type": "string", "description": "Override the URL Vault uses when making STS API\ncalls.\n" }, "stsRegion": { "type": "string", "description": "Override the default region when making STS API \ncalls. The \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003e argument must be set when using \u003cspan pulumi-lang-nodejs=\"`stsRegion`\" pulumi-lang-dotnet=\"`StsRegion`\" pulumi-lang-go=\"`stsRegion`\" pulumi-lang-python=\"`sts_region`\" pulumi-lang-yaml=\"`stsRegion`\" pulumi-lang-java=\"`stsRegion`\" pulumi-lang-hcl=\"`sts_region`\"\u003e`stsRegion`\u003c/span\u003e.\n" }, "useStsRegionFromClient": { "type": "boolean", "description": "Available in Vault v1.15+. If set, \noverrides both \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`stsRegion`\" pulumi-lang-dotnet=\"`StsRegion`\" pulumi-lang-go=\"`stsRegion`\" pulumi-lang-python=\"`sts_region`\" pulumi-lang-yaml=\"`stsRegion`\" pulumi-lang-java=\"`stsRegion`\" pulumi-lang-hcl=\"`sts_region`\"\u003e`stsRegion`\u003c/span\u003e to instead use the region\nspecified in the client request headers for IAM-based authentication.\nThis can be useful when you have client requests coming from different\nregions and want flexibility in which regional STS API is used.\n" } }, "required": [ "identityTokenTtl", "useStsRegionFromClient" ], "inputProperties": { "accessKey": { "type": "string", "description": "The AWS access key that Vault should use for the\nauth backend. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`identityTokenAudience`\" pulumi-lang-dotnet=\"`IdentityTokenAudience`\" pulumi-lang-go=\"`identityTokenAudience`\" pulumi-lang-python=\"`identity_token_audience`\" pulumi-lang-yaml=\"`identityTokenAudience`\" pulumi-lang-java=\"`identityTokenAudience`\" pulumi-lang-hcl=\"`identity_token_audience`\"\u003e`identityTokenAudience`\u003c/span\u003e.\n", "secret": true }, "allowedStsHeaderValues": { "type": "array", "items": { "type": "string" }, "description": "List of additional headers that are allowed to be in STS request headers.\nThe headers are automatically canonicalized (e.g., `content-type` becomes `Content-Type`). Duplicate values are automatically\nremoved. This can be useful when you need to allow specific headers in STS requests for IAM-based authentication.\n" }, "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "ec2Endpoint": { "type": "string", "description": "Override the URL Vault uses when making EC2 API\ncalls.\n" }, "iamEndpoint": { "type": "string", "description": "Override the URL Vault uses when making IAM API\ncalls.\n" }, "iamServerIdHeaderValue": { "type": "string", "description": "The value to require in the\n`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests\nthat are used in the IAM auth method.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e. \nRequires Vault 1.17+. *Available only for Vault Enterprise*\n" }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "maxRetries": { "type": "integer", "description": "Number of max retries the client should use for recoverable errors. \nThe default `-1` falls back to the AWS SDK's default behavior.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "roleArn": { "type": "string", "description": "Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "secretKey": { "type": "string", "description": "The AWS secret key that Vault should use for the\nauth backend. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e.\n**Note:** This field stores the secret in Terraform state in plain text.\nConsider using \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "secretKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only AWS Secret key with permissions to query AWS APIs. This field is recommended over\u003cspan pulumi-lang-nodejs=\" secretKey \" pulumi-lang-dotnet=\" SecretKey \" pulumi-lang-go=\" secretKey \" pulumi-lang-python=\" secret_key \" pulumi-lang-yaml=\" secretKey \" pulumi-lang-java=\" secretKey \" pulumi-lang-hcl=\" secret_key \"\u003e secretKey \u003c/span\u003efor enhanced security.", "secret": true }, "secretKeyWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field.\nIncrement this value to rotate the secret key. Required when \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e is set.\n" }, "stsEndpoint": { "type": "string", "description": "Override the URL Vault uses when making STS API\ncalls.\n" }, "stsRegion": { "type": "string", "description": "Override the default region when making STS API \ncalls. The \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003e argument must be set when using \u003cspan pulumi-lang-nodejs=\"`stsRegion`\" pulumi-lang-dotnet=\"`StsRegion`\" pulumi-lang-go=\"`stsRegion`\" pulumi-lang-python=\"`sts_region`\" pulumi-lang-yaml=\"`stsRegion`\" pulumi-lang-java=\"`stsRegion`\" pulumi-lang-hcl=\"`sts_region`\"\u003e`stsRegion`\u003c/span\u003e.\n" }, "useStsRegionFromClient": { "type": "boolean", "description": "Available in Vault v1.15+. If set, \noverrides both \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`stsRegion`\" pulumi-lang-dotnet=\"`StsRegion`\" pulumi-lang-go=\"`stsRegion`\" pulumi-lang-python=\"`sts_region`\" pulumi-lang-yaml=\"`stsRegion`\" pulumi-lang-java=\"`stsRegion`\" pulumi-lang-hcl=\"`sts_region`\"\u003e`stsRegion`\u003c/span\u003e to instead use the region\nspecified in the client request headers for IAM-based authentication.\nThis can be useful when you have client requests coming from different\nregions and want flexibility in which regional STS API is used.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendClient resources.\n", "properties": { "accessKey": { "type": "string", "description": "The AWS access key that Vault should use for the\nauth backend. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`identityTokenAudience`\" pulumi-lang-dotnet=\"`IdentityTokenAudience`\" pulumi-lang-go=\"`identityTokenAudience`\" pulumi-lang-python=\"`identity_token_audience`\" pulumi-lang-yaml=\"`identityTokenAudience`\" pulumi-lang-java=\"`identityTokenAudience`\" pulumi-lang-hcl=\"`identity_token_audience`\"\u003e`identityTokenAudience`\u003c/span\u003e.\n", "secret": true }, "allowedStsHeaderValues": { "type": "array", "items": { "type": "string" }, "description": "List of additional headers that are allowed to be in STS request headers.\nThe headers are automatically canonicalized (e.g., `content-type` becomes `Content-Type`). Duplicate values are automatically\nremoved. This can be useful when you need to allow specific headers in STS requests for IAM-based authentication.\n" }, "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "ec2Endpoint": { "type": "string", "description": "Override the URL Vault uses when making EC2 API\ncalls.\n" }, "iamEndpoint": { "type": "string", "description": "Override the URL Vault uses when making IAM API\ncalls.\n" }, "iamServerIdHeaderValue": { "type": "string", "description": "The value to require in the\n`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests\nthat are used in the IAM auth method.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e. \nRequires Vault 1.17+. *Available only for Vault Enterprise*\n" }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "maxRetries": { "type": "integer", "description": "Number of max retries the client should use for recoverable errors. \nThe default `-1` falls back to the AWS SDK's default behavior.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "roleArn": { "type": "string", "description": "Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "secretKey": { "type": "string", "description": "The AWS secret key that Vault should use for the\nauth backend. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e.\n**Note:** This field stores the secret in Terraform state in plain text.\nConsider using \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "secretKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only AWS Secret key with permissions to query AWS APIs. This field is recommended over\u003cspan pulumi-lang-nodejs=\" secretKey \" pulumi-lang-dotnet=\" SecretKey \" pulumi-lang-go=\" secretKey \" pulumi-lang-python=\" secret_key \" pulumi-lang-yaml=\" secretKey \" pulumi-lang-java=\" secretKey \" pulumi-lang-hcl=\" secret_key \"\u003e secretKey \u003c/span\u003efor enhanced security.", "secret": true }, "secretKeyWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field.\nIncrement this value to rotate the secret key. Required when \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e is set.\n" }, "stsEndpoint": { "type": "string", "description": "Override the URL Vault uses when making STS API\ncalls.\n" }, "stsRegion": { "type": "string", "description": "Override the default region when making STS API \ncalls. The \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003e argument must be set when using \u003cspan pulumi-lang-nodejs=\"`stsRegion`\" pulumi-lang-dotnet=\"`StsRegion`\" pulumi-lang-go=\"`stsRegion`\" pulumi-lang-python=\"`sts_region`\" pulumi-lang-yaml=\"`stsRegion`\" pulumi-lang-java=\"`stsRegion`\" pulumi-lang-hcl=\"`sts_region`\"\u003e`stsRegion`\u003c/span\u003e.\n" }, "useStsRegionFromClient": { "type": "boolean", "description": "Available in Vault v1.15+. If set, \noverrides both \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`stsRegion`\" pulumi-lang-dotnet=\"`StsRegion`\" pulumi-lang-go=\"`stsRegion`\" pulumi-lang-python=\"`sts_region`\" pulumi-lang-yaml=\"`stsRegion`\" pulumi-lang-java=\"`stsRegion`\" pulumi-lang-hcl=\"`sts_region`\"\u003e`stsRegion`\u003c/span\u003e to instead use the region\nspecified in the client request headers for IAM-based authentication.\nThis can be useful when you have client requests coming from different\nregions and want flexibility in which regional STS API is used.\n" } }, "type": "object" } }, "vault:aws/authBackendConfigIdentity:AuthBackendConfigIdentity": { "description": "Manages an AWS auth backend identity configuration in a Vault server. This configuration defines how Vault interacts\nwith the identity store. See the [Vault documentation](https://www.vaultproject.io/docs/auth/aws.html) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.AuthBackend(\"aws\", {type: \"aws\"});\nconst example = new vault.aws.AuthBackendConfigIdentity(\"example\", {\n backend: aws.path,\n iamAlias: \"full_arn\",\n iamMetadatas: [\n \"canonical_arn\",\n \"account_id\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.AuthBackend(\"aws\", type=\"aws\")\nexample = vault.aws.AuthBackendConfigIdentity(\"example\",\n backend=aws.path,\n iam_alias=\"full_arn\",\n iam_metadatas=[\n \"canonical_arn\",\n \"account_id\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.AuthBackend(\"aws\", new()\n {\n Type = \"aws\",\n });\n\n var example = new Vault.Aws.AuthBackendConfigIdentity(\"example\", new()\n {\n Backend = aws.Path,\n IamAlias = \"full_arn\",\n IamMetadatas = new[]\n {\n \"canonical_arn\",\n \"account_id\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\taws2, err := vault.NewAuthBackend(ctx, \"aws\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendConfigIdentity(ctx, \"example\", \u0026aws.AuthBackendConfigIdentityArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tIamAlias: pulumi.String(\"full_arn\"),\n\t\t\tIamMetadatas: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"canonical_arn\"),\n\t\t\t\tpulumi.String(\"account_id\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"aws\" {\n type = \"aws\"\n}\nresource \"vault_aws_authbackendconfigidentity\" \"example\" {\n backend = vault_authbackend.aws.path\n iam_alias = \"full_arn\"\n iam_metadatas = [\"canonical_arn\", \"account_id\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendConfigIdentity;\nimport com.pulumi.vault.aws.AuthBackendConfigIdentityArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new AuthBackend(\"aws\", AuthBackendArgs.builder()\n .type(\"aws\")\n .build());\n\n var example = new AuthBackendConfigIdentity(\"example\", AuthBackendConfigIdentityArgs.builder()\n .backend(aws.path())\n .iamAlias(\"full_arn\")\n .iamMetadatas( \n \"canonical_arn\",\n \"account_id\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:AuthBackend\n properties:\n type: aws\n example:\n type: vault:aws:AuthBackendConfigIdentity\n properties:\n backend: ${aws.path}\n iamAlias: full_arn\n iamMetadatas:\n - canonical_arn\n - account_id\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAWS auth backend identity config can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e path, and `/config/identity` e.g.\n\n```sh\n$ pulumi import vault:aws/authBackendConfigIdentity:AuthBackendConfigIdentity example auth/aws/config/identity\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n" }, "ec2Alias": { "type": "string", "description": "How to generate the identity alias when using the ec2 auth method. Valid choices are\n\u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`instanceId`\" pulumi-lang-dotnet=\"`InstanceId`\" pulumi-lang-go=\"`instanceId`\" pulumi-lang-python=\"`instance_id`\" pulumi-lang-yaml=\"`instanceId`\" pulumi-lang-java=\"`instanceId`\" pulumi-lang-hcl=\"`instance_id`\"\u003e`instanceId`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`imageId`\" pulumi-lang-dotnet=\"`ImageId`\" pulumi-lang-go=\"`imageId`\" pulumi-lang-python=\"`image_id`\" pulumi-lang-yaml=\"`imageId`\" pulumi-lang-java=\"`imageId`\" pulumi-lang-hcl=\"`image_id`\"\u003e`imageId`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e\n" }, "ec2Metadatas": { "type": "array", "items": { "type": "string" }, "description": "The metadata to include on the token returned by the \u003cspan pulumi-lang-nodejs=\"`login`\" pulumi-lang-dotnet=\"`Login`\" pulumi-lang-go=\"`login`\" pulumi-lang-python=\"`login`\" pulumi-lang-yaml=\"`login`\" pulumi-lang-java=\"`login`\" pulumi-lang-hcl=\"`login`\"\u003e`login`\u003c/span\u003e endpoint. This metadata will be\nadded to both audit logs, and on the \u003cspan pulumi-lang-nodejs=\"`ec2Alias`\" pulumi-lang-dotnet=\"`Ec2Alias`\" pulumi-lang-go=\"`ec2Alias`\" pulumi-lang-python=\"`ec2_alias`\" pulumi-lang-yaml=\"`ec2Alias`\" pulumi-lang-java=\"`ec2Alias`\" pulumi-lang-hcl=\"`ec2_alias`\"\u003e`ec2Alias`\u003c/span\u003e\n" }, "iamAlias": { "type": "string", "description": "How to generate the identity alias when using the iam auth method. Valid choices are\n\u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`uniqueId`\" pulumi-lang-dotnet=\"`UniqueId`\" pulumi-lang-go=\"`uniqueId`\" pulumi-lang-python=\"`unique_id`\" pulumi-lang-yaml=\"`uniqueId`\" pulumi-lang-java=\"`uniqueId`\" pulumi-lang-hcl=\"`unique_id`\"\u003e`uniqueId`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`fullArn`\" pulumi-lang-dotnet=\"`FullArn`\" pulumi-lang-go=\"`fullArn`\" pulumi-lang-python=\"`full_arn`\" pulumi-lang-yaml=\"`fullArn`\" pulumi-lang-java=\"`fullArn`\" pulumi-lang-hcl=\"`full_arn`\"\u003e`fullArn`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`canonicalArn`\" pulumi-lang-dotnet=\"`CanonicalArn`\" pulumi-lang-go=\"`canonicalArn`\" pulumi-lang-python=\"`canonical_arn`\" pulumi-lang-yaml=\"`canonicalArn`\" pulumi-lang-java=\"`canonicalArn`\" pulumi-lang-hcl=\"`canonical_arn`\"\u003e`canonicalArn`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e. \u003cspan pulumi-lang-nodejs=\"`canonicalArn`\" pulumi-lang-dotnet=\"`CanonicalArn`\" pulumi-lang-go=\"`canonicalArn`\" pulumi-lang-python=\"`canonical_arn`\" pulumi-lang-yaml=\"`canonicalArn`\" pulumi-lang-java=\"`canonicalArn`\" pulumi-lang-hcl=\"`canonical_arn`\"\u003e`canonicalArn`\u003c/span\u003e requires Vault 1.16+.\n" }, "iamMetadatas": { "type": "array", "items": { "type": "string" }, "description": "The metadata to include on the token returned by the \u003cspan pulumi-lang-nodejs=\"`login`\" pulumi-lang-dotnet=\"`Login`\" pulumi-lang-go=\"`login`\" pulumi-lang-python=\"`login`\" pulumi-lang-yaml=\"`login`\" pulumi-lang-java=\"`login`\" pulumi-lang-hcl=\"`login`\"\u003e`login`\u003c/span\u003e endpoint. This metadata will be\nadded to both audit logs, and on the \u003cspan pulumi-lang-nodejs=\"`iamAlias`\" pulumi-lang-dotnet=\"`IamAlias`\" pulumi-lang-go=\"`iamAlias`\" pulumi-lang-python=\"`iam_alias`\" pulumi-lang-yaml=\"`iamAlias`\" pulumi-lang-java=\"`iamAlias`\" pulumi-lang-hcl=\"`iam_alias`\"\u003e`iamAlias`\u003c/span\u003e\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "inputProperties": { "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "ec2Alias": { "type": "string", "description": "How to generate the identity alias when using the ec2 auth method. Valid choices are\n\u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`instanceId`\" pulumi-lang-dotnet=\"`InstanceId`\" pulumi-lang-go=\"`instanceId`\" pulumi-lang-python=\"`instance_id`\" pulumi-lang-yaml=\"`instanceId`\" pulumi-lang-java=\"`instanceId`\" pulumi-lang-hcl=\"`instance_id`\"\u003e`instanceId`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`imageId`\" pulumi-lang-dotnet=\"`ImageId`\" pulumi-lang-go=\"`imageId`\" pulumi-lang-python=\"`image_id`\" pulumi-lang-yaml=\"`imageId`\" pulumi-lang-java=\"`imageId`\" pulumi-lang-hcl=\"`image_id`\"\u003e`imageId`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e\n" }, "ec2Metadatas": { "type": "array", "items": { "type": "string" }, "description": "The metadata to include on the token returned by the \u003cspan pulumi-lang-nodejs=\"`login`\" pulumi-lang-dotnet=\"`Login`\" pulumi-lang-go=\"`login`\" pulumi-lang-python=\"`login`\" pulumi-lang-yaml=\"`login`\" pulumi-lang-java=\"`login`\" pulumi-lang-hcl=\"`login`\"\u003e`login`\u003c/span\u003e endpoint. This metadata will be\nadded to both audit logs, and on the \u003cspan pulumi-lang-nodejs=\"`ec2Alias`\" pulumi-lang-dotnet=\"`Ec2Alias`\" pulumi-lang-go=\"`ec2Alias`\" pulumi-lang-python=\"`ec2_alias`\" pulumi-lang-yaml=\"`ec2Alias`\" pulumi-lang-java=\"`ec2Alias`\" pulumi-lang-hcl=\"`ec2_alias`\"\u003e`ec2Alias`\u003c/span\u003e\n" }, "iamAlias": { "type": "string", "description": "How to generate the identity alias when using the iam auth method. Valid choices are\n\u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`uniqueId`\" pulumi-lang-dotnet=\"`UniqueId`\" pulumi-lang-go=\"`uniqueId`\" pulumi-lang-python=\"`unique_id`\" pulumi-lang-yaml=\"`uniqueId`\" pulumi-lang-java=\"`uniqueId`\" pulumi-lang-hcl=\"`unique_id`\"\u003e`uniqueId`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`fullArn`\" pulumi-lang-dotnet=\"`FullArn`\" pulumi-lang-go=\"`fullArn`\" pulumi-lang-python=\"`full_arn`\" pulumi-lang-yaml=\"`fullArn`\" pulumi-lang-java=\"`fullArn`\" pulumi-lang-hcl=\"`full_arn`\"\u003e`fullArn`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`canonicalArn`\" pulumi-lang-dotnet=\"`CanonicalArn`\" pulumi-lang-go=\"`canonicalArn`\" pulumi-lang-python=\"`canonical_arn`\" pulumi-lang-yaml=\"`canonicalArn`\" pulumi-lang-java=\"`canonicalArn`\" pulumi-lang-hcl=\"`canonical_arn`\"\u003e`canonicalArn`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e. \u003cspan pulumi-lang-nodejs=\"`canonicalArn`\" pulumi-lang-dotnet=\"`CanonicalArn`\" pulumi-lang-go=\"`canonicalArn`\" pulumi-lang-python=\"`canonical_arn`\" pulumi-lang-yaml=\"`canonicalArn`\" pulumi-lang-java=\"`canonicalArn`\" pulumi-lang-hcl=\"`canonical_arn`\"\u003e`canonicalArn`\u003c/span\u003e requires Vault 1.16+.\n" }, "iamMetadatas": { "type": "array", "items": { "type": "string" }, "description": "The metadata to include on the token returned by the \u003cspan pulumi-lang-nodejs=\"`login`\" pulumi-lang-dotnet=\"`Login`\" pulumi-lang-go=\"`login`\" pulumi-lang-python=\"`login`\" pulumi-lang-yaml=\"`login`\" pulumi-lang-java=\"`login`\" pulumi-lang-hcl=\"`login`\"\u003e`login`\u003c/span\u003e endpoint. This metadata will be\nadded to both audit logs, and on the \u003cspan pulumi-lang-nodejs=\"`iamAlias`\" pulumi-lang-dotnet=\"`IamAlias`\" pulumi-lang-go=\"`iamAlias`\" pulumi-lang-python=\"`iam_alias`\" pulumi-lang-yaml=\"`iamAlias`\" pulumi-lang-java=\"`iamAlias`\" pulumi-lang-hcl=\"`iam_alias`\"\u003e`iamAlias`\u003c/span\u003e\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendConfigIdentity resources.\n", "properties": { "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "ec2Alias": { "type": "string", "description": "How to generate the identity alias when using the ec2 auth method. Valid choices are\n\u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`instanceId`\" pulumi-lang-dotnet=\"`InstanceId`\" pulumi-lang-go=\"`instanceId`\" pulumi-lang-python=\"`instance_id`\" pulumi-lang-yaml=\"`instanceId`\" pulumi-lang-java=\"`instanceId`\" pulumi-lang-hcl=\"`instance_id`\"\u003e`instanceId`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`imageId`\" pulumi-lang-dotnet=\"`ImageId`\" pulumi-lang-go=\"`imageId`\" pulumi-lang-python=\"`image_id`\" pulumi-lang-yaml=\"`imageId`\" pulumi-lang-java=\"`imageId`\" pulumi-lang-hcl=\"`image_id`\"\u003e`imageId`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e\n" }, "ec2Metadatas": { "type": "array", "items": { "type": "string" }, "description": "The metadata to include on the token returned by the \u003cspan pulumi-lang-nodejs=\"`login`\" pulumi-lang-dotnet=\"`Login`\" pulumi-lang-go=\"`login`\" pulumi-lang-python=\"`login`\" pulumi-lang-yaml=\"`login`\" pulumi-lang-java=\"`login`\" pulumi-lang-hcl=\"`login`\"\u003e`login`\u003c/span\u003e endpoint. This metadata will be\nadded to both audit logs, and on the \u003cspan pulumi-lang-nodejs=\"`ec2Alias`\" pulumi-lang-dotnet=\"`Ec2Alias`\" pulumi-lang-go=\"`ec2Alias`\" pulumi-lang-python=\"`ec2_alias`\" pulumi-lang-yaml=\"`ec2Alias`\" pulumi-lang-java=\"`ec2Alias`\" pulumi-lang-hcl=\"`ec2_alias`\"\u003e`ec2Alias`\u003c/span\u003e\n" }, "iamAlias": { "type": "string", "description": "How to generate the identity alias when using the iam auth method. Valid choices are\n\u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`uniqueId`\" pulumi-lang-dotnet=\"`UniqueId`\" pulumi-lang-go=\"`uniqueId`\" pulumi-lang-python=\"`unique_id`\" pulumi-lang-yaml=\"`uniqueId`\" pulumi-lang-java=\"`uniqueId`\" pulumi-lang-hcl=\"`unique_id`\"\u003e`uniqueId`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`fullArn`\" pulumi-lang-dotnet=\"`FullArn`\" pulumi-lang-go=\"`fullArn`\" pulumi-lang-python=\"`full_arn`\" pulumi-lang-yaml=\"`fullArn`\" pulumi-lang-java=\"`fullArn`\" pulumi-lang-hcl=\"`full_arn`\"\u003e`fullArn`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`canonicalArn`\" pulumi-lang-dotnet=\"`CanonicalArn`\" pulumi-lang-go=\"`canonicalArn`\" pulumi-lang-python=\"`canonical_arn`\" pulumi-lang-yaml=\"`canonicalArn`\" pulumi-lang-java=\"`canonicalArn`\" pulumi-lang-hcl=\"`canonical_arn`\"\u003e`canonicalArn`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`roleId`\" pulumi-lang-dotnet=\"`RoleId`\" pulumi-lang-go=\"`roleId`\" pulumi-lang-python=\"`role_id`\" pulumi-lang-yaml=\"`roleId`\" pulumi-lang-java=\"`roleId`\" pulumi-lang-hcl=\"`role_id`\"\u003e`roleId`\u003c/span\u003e. \u003cspan pulumi-lang-nodejs=\"`canonicalArn`\" pulumi-lang-dotnet=\"`CanonicalArn`\" pulumi-lang-go=\"`canonicalArn`\" pulumi-lang-python=\"`canonical_arn`\" pulumi-lang-yaml=\"`canonicalArn`\" pulumi-lang-java=\"`canonicalArn`\" pulumi-lang-hcl=\"`canonical_arn`\"\u003e`canonicalArn`\u003c/span\u003e requires Vault 1.16+.\n" }, "iamMetadatas": { "type": "array", "items": { "type": "string" }, "description": "The metadata to include on the token returned by the \u003cspan pulumi-lang-nodejs=\"`login`\" pulumi-lang-dotnet=\"`Login`\" pulumi-lang-go=\"`login`\" pulumi-lang-python=\"`login`\" pulumi-lang-yaml=\"`login`\" pulumi-lang-java=\"`login`\" pulumi-lang-hcl=\"`login`\"\u003e`login`\u003c/span\u003e endpoint. This metadata will be\nadded to both audit logs, and on the \u003cspan pulumi-lang-nodejs=\"`iamAlias`\" pulumi-lang-dotnet=\"`IamAlias`\" pulumi-lang-go=\"`iamAlias`\" pulumi-lang-python=\"`iam_alias`\" pulumi-lang-yaml=\"`iamAlias`\" pulumi-lang-java=\"`iamAlias`\" pulumi-lang-hcl=\"`iam_alias`\"\u003e`iamAlias`\u003c/span\u003e\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:aws/authBackendIdentityWhitelist:AuthBackendIdentityWhitelist": { "description": "Configures the periodic tidying operation of the whitelisted identity entries.\n\nFor more information, see the\n[Vault docs](https://www.vaultproject.io/api-docs/auth/aws#configure-identity-whitelist-tidy-operation).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.AuthBackend(\"example\", {type: \"aws\"});\nconst exampleAuthBackendIdentityWhitelist = new vault.aws.AuthBackendIdentityWhitelist(\"example\", {\n backend: example.path,\n safetyBuffer: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.AuthBackend(\"example\", type=\"aws\")\nexample_auth_backend_identity_whitelist = vault.aws.AuthBackendIdentityWhitelist(\"example\",\n backend=example.path,\n safety_buffer=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.AuthBackend(\"example\", new()\n {\n Type = \"aws\",\n });\n\n var exampleAuthBackendIdentityWhitelist = new Vault.Aws.AuthBackendIdentityWhitelist(\"example\", new()\n {\n Backend = example.Path,\n SafetyBuffer = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewAuthBackend(ctx, \"example\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendIdentityWhitelist(ctx, \"example\", \u0026aws.AuthBackendIdentityWhitelistArgs{\n\t\t\tBackend: example.Path,\n\t\t\tSafetyBuffer: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"example\" {\n type = \"aws\"\n}\nresource \"vault_aws_authbackendidentitywhitelist\" \"example\" {\n backend = vault_authbackend.example.path\n safety_buffer = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendIdentityWhitelist;\nimport com.pulumi.vault.aws.AuthBackendIdentityWhitelistArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .type(\"aws\")\n .build());\n\n var exampleAuthBackendIdentityWhitelist = new AuthBackendIdentityWhitelist(\"exampleAuthBackendIdentityWhitelist\", AuthBackendIdentityWhitelistArgs.builder()\n .backend(example.path())\n .safetyBuffer(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:AuthBackend\n properties:\n type: aws\n exampleAuthBackendIdentityWhitelist:\n type: vault:aws:AuthBackendIdentityWhitelist\n name: example\n properties:\n backend: ${example.path}\n safetyBuffer: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAWS auth backend identity whitelists can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e path, and `/config/tidy/identity-whitelist` e.g.\n\n```sh\n$ pulumi import vault:aws/authBackendIdentityWhitelist:AuthBackendIdentityWhitelist example auth/aws/config/tidy/identity-whitelist\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path of the AWS backend being configured.\n" }, "disablePeriodicTidy": { "type": "boolean", "description": "If set to true, disables the periodic\ntidying of the identity-whitelist entries.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "safetyBuffer": { "type": "integer", "description": "The amount of extra time, in minutes, that must\nhave passed beyond the roletag expiration, before it is removed from the\nbackend storage.\n" } }, "inputProperties": { "backend": { "type": "string", "description": "The path of the AWS backend being configured.\n", "willReplaceOnChanges": true }, "disablePeriodicTidy": { "type": "boolean", "description": "If set to true, disables the periodic\ntidying of the identity-whitelist entries.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "safetyBuffer": { "type": "integer", "description": "The amount of extra time, in minutes, that must\nhave passed beyond the roletag expiration, before it is removed from the\nbackend storage.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendIdentityWhitelist resources.\n", "properties": { "backend": { "type": "string", "description": "The path of the AWS backend being configured.\n", "willReplaceOnChanges": true }, "disablePeriodicTidy": { "type": "boolean", "description": "If set to true, disables the periodic\ntidying of the identity-whitelist entries.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "safetyBuffer": { "type": "integer", "description": "The amount of extra time, in minutes, that must\nhave passed beyond the roletag expiration, before it is removed from the\nbackend storage.\n" } }, "type": "object" } }, "vault:aws/authBackendLogin:AuthBackendLogin": { "description": "Logs into a Vault server using an AWS auth backend. Login can be\naccomplished using a signed identity request from IAM or using ec2\ninstance metadata. For more information, see the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/aws.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.AuthBackend(\"aws\", {\n type: \"aws\",\n path: \"aws\",\n});\nconst example = new vault.aws.AuthBackendClient(\"example\", {\n backend: aws.path,\n accessKey: \"123456789012\",\n secretKey: \"AWSSECRETKEYGOESHERE\",\n});\nconst exampleAuthBackendRole = new vault.aws.AuthBackendRole(\"example\", {\n backend: aws.path,\n role: \"test-role\",\n authType: \"ec2\",\n boundAmiId: \"ami-8c1be5f6\",\n boundAccountId: \"123456789012\",\n boundVpcId: \"vpc-b61106d4\",\n boundSubnetId: \"vpc-133128f1\",\n boundIamInstanceProfileArns: [\"arn:aws:iam::123456789012:instance-profile/MyProfile\"],\n ttl: 60,\n maxTtl: 120,\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n}, {\n dependsOn: [example],\n});\nconst exampleAuthBackendLogin = new vault.aws.AuthBackendLogin(\"example\", {\n backend: exampleVaultAuthBackend.path,\n role: exampleAuthBackendRole.role,\n identity: \"BASE64ENCODEDIDENTITYDOCUMENT\",\n signature: \"BASE64ENCODEDSHA256IDENTITYDOCUMENTSIGNATURE\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.AuthBackend(\"aws\",\n type=\"aws\",\n path=\"aws\")\nexample = vault.aws.AuthBackendClient(\"example\",\n backend=aws.path,\n access_key=\"123456789012\",\n secret_key=\"AWSSECRETKEYGOESHERE\")\nexample_auth_backend_role = vault.aws.AuthBackendRole(\"example\",\n backend=aws.path,\n role=\"test-role\",\n auth_type=\"ec2\",\n bound_ami_id=\"ami-8c1be5f6\",\n bound_account_id=\"123456789012\",\n bound_vpc_id=\"vpc-b61106d4\",\n bound_subnet_id=\"vpc-133128f1\",\n bound_iam_instance_profile_arns=[\"arn:aws:iam::123456789012:instance-profile/MyProfile\"],\n ttl=60,\n max_ttl=120,\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ],\n opts = pulumi.ResourceOptions(depends_on=[example]))\nexample_auth_backend_login = vault.aws.AuthBackendLogin(\"example\",\n backend=example_vault_auth_backend[\"path\"],\n role=example_auth_backend_role.role,\n identity=\"BASE64ENCODEDIDENTITYDOCUMENT\",\n signature=\"BASE64ENCODEDSHA256IDENTITYDOCUMENTSIGNATURE\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.AuthBackend(\"aws\", new()\n {\n Type = \"aws\",\n Path = \"aws\",\n });\n\n var example = new Vault.Aws.AuthBackendClient(\"example\", new()\n {\n Backend = aws.Path,\n AccessKey = \"123456789012\",\n SecretKey = \"AWSSECRETKEYGOESHERE\",\n });\n\n var exampleAuthBackendRole = new Vault.Aws.AuthBackendRole(\"example\", new()\n {\n Backend = aws.Path,\n Role = \"test-role\",\n AuthType = \"ec2\",\n BoundAmiId = \"ami-8c1be5f6\",\n BoundAccountId = \"123456789012\",\n BoundVpcId = \"vpc-b61106d4\",\n BoundSubnetId = \"vpc-133128f1\",\n BoundIamInstanceProfileArns = new[]\n {\n \"arn:aws:iam::123456789012:instance-profile/MyProfile\",\n },\n Ttl = 60,\n MaxTtl = 120,\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n example,\n },\n });\n\n var exampleAuthBackendLogin = new Vault.Aws.AuthBackendLogin(\"example\", new()\n {\n Backend = exampleVaultAuthBackend.Path,\n Role = exampleAuthBackendRole.Role,\n Identity = \"BASE64ENCODEDIDENTITYDOCUMENT\",\n Signature = \"BASE64ENCODEDSHA256IDENTITYDOCUMENTSIGNATURE\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\taws2, err := vault.NewAuthBackend(ctx, \"aws\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t\tPath: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texample, err := aws.NewAuthBackendClient(ctx, \"example\", \u0026aws.AuthBackendClientArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tAccessKey: pulumi.String(\"123456789012\"),\n\t\t\tSecretKey: pulumi.String(\"AWSSECRETKEYGOESHERE\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleAuthBackendRole, err := aws.NewAuthBackendRole(ctx, \"example\", \u0026aws.AuthBackendRoleArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tRole: pulumi.String(\"test-role\"),\n\t\t\tAuthType: pulumi.String(\"ec2\"),\n\t\t\tBoundAmiId: \"ami-8c1be5f6\",\n\t\t\tBoundAccountId: \"123456789012\",\n\t\t\tBoundVpcId: \"vpc-b61106d4\",\n\t\t\tBoundSubnetId: \"vpc-133128f1\",\n\t\t\tBoundIamInstanceProfileArns: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"arn:aws:iam::123456789012:instance-profile/MyProfile\"),\n\t\t\t},\n\t\t\tTtl: 60,\n\t\t\tMaxTtl: 120,\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\texample,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendLogin(ctx, \"example\", \u0026aws.AuthBackendLoginArgs{\n\t\t\tBackend: pulumi.Any(exampleVaultAuthBackend.Path),\n\t\t\tRole: exampleAuthBackendRole.Role,\n\t\t\tIdentity: pulumi.String(\"BASE64ENCODEDIDENTITYDOCUMENT\"),\n\t\t\tSignature: pulumi.String(\"BASE64ENCODEDSHA256IDENTITYDOCUMENTSIGNATURE\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"aws\" {\n type = \"aws\"\n path = \"aws\"\n}\nresource \"vault_aws_authbackendclient\" \"example\" {\n backend = vault_authbackend.aws.path\n access_key = \"123456789012\"\n secret_key = \"AWSSECRETKEYGOESHERE\"\n}\nresource \"vault_aws_authbackendrole\" \"example\" {\n depends_on = [vault_aws_authbackendclient.example]\n backend = vault_authbackend.aws.path\n role = \"test-role\"\n auth_type = \"ec2\"\n bound_ami_id = \"ami-8c1be5f6\"\n bound_account_id = \"123456789012\"\n bound_vpc_id = \"vpc-b61106d4\"\n bound_subnet_id = \"vpc-133128f1\"\n bound_iam_instance_profile_arns = [\"arn:aws:iam::123456789012:instance-profile/MyProfile\"]\n ttl = 60\n max_ttl = 120\n token_policies = [\"default\", \"dev\", \"prod\"]\n}\nresource \"vault_aws_authbackendlogin\" \"example\" {\n backend = exampleVaultAuthBackend.path\n role = vault_aws_authbackendrole.example.role\n identity = \"BASE64ENCODEDIDENTITYDOCUMENT\"\n signature = \"BASE64ENCODEDSHA256IDENTITYDOCUMENTSIGNATURE\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendClient;\nimport com.pulumi.vault.aws.AuthBackendClientArgs;\nimport com.pulumi.vault.aws.AuthBackendRole;\nimport com.pulumi.vault.aws.AuthBackendRoleArgs;\nimport com.pulumi.vault.aws.AuthBackendLogin;\nimport com.pulumi.vault.aws.AuthBackendLoginArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new AuthBackend(\"aws\", AuthBackendArgs.builder()\n .type(\"aws\")\n .path(\"aws\")\n .build());\n\n var example = new AuthBackendClient(\"example\", AuthBackendClientArgs.builder()\n .backend(aws.path())\n .accessKey(\"123456789012\")\n .secretKey(\"AWSSECRETKEYGOESHERE\")\n .build());\n\n var exampleAuthBackendRole = new AuthBackendRole(\"exampleAuthBackendRole\", AuthBackendRoleArgs.builder()\n .backend(aws.path())\n .role(\"test-role\")\n .authType(\"ec2\")\n .boundAmiId(\"ami-8c1be5f6\")\n .boundAccountId(\"123456789012\")\n .boundVpcId(\"vpc-b61106d4\")\n .boundSubnetId(\"vpc-133128f1\")\n .boundIamInstanceProfileArns(\"arn:aws:iam::123456789012:instance-profile/MyProfile\")\n .ttl(60)\n .maxTtl(120)\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(example)\n .build());\n\n var exampleAuthBackendLogin = new AuthBackendLogin(\"exampleAuthBackendLogin\", AuthBackendLoginArgs.builder()\n .backend(exampleVaultAuthBackend.path())\n .role(exampleAuthBackendRole.role())\n .identity(\"BASE64ENCODEDIDENTITYDOCUMENT\")\n .signature(\"BASE64ENCODEDSHA256IDENTITYDOCUMENTSIGNATURE\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:AuthBackend\n properties:\n type: aws\n path: aws\n example:\n type: vault:aws:AuthBackendClient\n properties:\n backend: ${aws.path}\n accessKey: '123456789012'\n secretKey: AWSSECRETKEYGOESHERE\n exampleAuthBackendRole:\n type: vault:aws:AuthBackendRole\n name: example\n properties:\n backend: ${aws.path}\n role: test-role\n authType: ec2\n boundAmiId: ami-8c1be5f6\n boundAccountId: '123456789012'\n boundVpcId: vpc-b61106d4\n boundSubnetId: vpc-133128f1\n boundIamInstanceProfileArns:\n - arn:aws:iam::123456789012:instance-profile/MyProfile\n ttl: 60\n maxTtl: 120\n tokenPolicies:\n - default\n - dev\n - prod\n options:\n dependsOn:\n - ${example}\n exampleAuthBackendLogin:\n type: vault:aws:AuthBackendLogin\n name: example\n properties:\n backend: ${exampleVaultAuthBackend.path}\n role: ${exampleAuthBackendRole.role}\n identity: BASE64ENCODEDIDENTITYDOCUMENT\n signature: BASE64ENCODEDSHA256IDENTITYDOCUMENTSIGNATURE\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "accessor": { "type": "string", "description": "The token's accessor.\n" }, "authType": { "type": "string", "description": "The authentication type used to generate this token.\n" }, "backend": { "type": "string", "description": "The unique name of the AWS auth backend. Defaults to\n'aws'.\n" }, "clientToken": { "type": "string", "description": "The token returned by Vault.\n", "secret": true }, "iamHttpRequestMethod": { "type": "string", "description": "The HTTP method used in the signed IAM\nrequest.\n" }, "iamRequestBody": { "type": "string", "description": "The base64-encoded body of the signed\nrequest.\n" }, "iamRequestHeaders": { "type": "string", "description": "The base64-encoded, JSON serialized\nrepresentation of the GetCallerIdentity HTTP request headers.\n" }, "iamRequestUrl": { "type": "string", "description": "The base64-encoded HTTP URL used in the signed\nrequest.\n" }, "identity": { "type": "string", "description": "The base64-encoded EC2 instance identity document to\nauthenticate with. Can be retrieved from the EC2 metadata server.\n" }, "leaseDuration": { "type": "integer", "description": "The duration in seconds the token will be valid, relative\nto the time in \u003cspan pulumi-lang-nodejs=\"`leaseStartTime`\" pulumi-lang-dotnet=\"`LeaseStartTime`\" pulumi-lang-go=\"`leaseStartTime`\" pulumi-lang-python=\"`lease_start_time`\" pulumi-lang-yaml=\"`leaseStartTime`\" pulumi-lang-java=\"`leaseStartTime`\" pulumi-lang-hcl=\"`lease_start_time`\"\u003e`leaseStartTime`\u003c/span\u003e.\n" }, "leaseStartTime": { "type": "string", "description": "The approximate time at which the token was created,\nusing the clock of the system where Terraform was running.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of information returned by the Vault server about the\nauthentication used to generate this token.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "nonce": { "type": "string", "description": "The unique nonce to be used for login requests. Can be\nset to a user-specified value, or will contain the server-generated value\nonce a token is issued. EC2 instances can only acquire a single token until\nthe whitelist is tidied again unless they keep track of this nonce.\n" }, "pkcs7": { "type": "string", "description": "The PKCS#7 signature of the identity document to\nauthenticate with, with all newline characters removed. Can be retrieved from\nthe EC2 metadata server.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "The Vault policies assigned to this token.\n" }, "renewable": { "type": "boolean", "description": "Set to true if the token can be extended through renewal.\n" }, "role": { "type": "string", "description": "The name of the AWS auth backend role to create tokens\nagainst.\n" }, "signature": { "type": "string", "description": "The base64-encoded SHA256 RSA signature of the\ninstance identity document to authenticate with, with all newline characters\nremoved. Can be retrieved from the EC2 metadata server.\n" } }, "required": [ "accessor", "authType", "clientToken", "leaseDuration", "leaseStartTime", "metadata", "nonce", "policies", "renewable", "role" ], "inputProperties": { "backend": { "type": "string", "description": "The unique name of the AWS auth backend. Defaults to\n'aws'.\n", "willReplaceOnChanges": true }, "iamHttpRequestMethod": { "type": "string", "description": "The HTTP method used in the signed IAM\nrequest.\n", "willReplaceOnChanges": true }, "iamRequestBody": { "type": "string", "description": "The base64-encoded body of the signed\nrequest.\n", "willReplaceOnChanges": true }, "iamRequestHeaders": { "type": "string", "description": "The base64-encoded, JSON serialized\nrepresentation of the GetCallerIdentity HTTP request headers.\n", "willReplaceOnChanges": true }, "iamRequestUrl": { "type": "string", "description": "The base64-encoded HTTP URL used in the signed\nrequest.\n", "willReplaceOnChanges": true }, "identity": { "type": "string", "description": "The base64-encoded EC2 instance identity document to\nauthenticate with. Can be retrieved from the EC2 metadata server.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "nonce": { "type": "string", "description": "The unique nonce to be used for login requests. Can be\nset to a user-specified value, or will contain the server-generated value\nonce a token is issued. EC2 instances can only acquire a single token until\nthe whitelist is tidied again unless they keep track of this nonce.\n", "willReplaceOnChanges": true }, "pkcs7": { "type": "string", "description": "The PKCS#7 signature of the identity document to\nauthenticate with, with all newline characters removed. Can be retrieved from\nthe EC2 metadata server.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "The name of the AWS auth backend role to create tokens\nagainst.\n", "willReplaceOnChanges": true }, "signature": { "type": "string", "description": "The base64-encoded SHA256 RSA signature of the\ninstance identity document to authenticate with, with all newline characters\nremoved. Can be retrieved from the EC2 metadata server.\n", "willReplaceOnChanges": true } }, "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendLogin resources.\n", "properties": { "accessor": { "type": "string", "description": "The token's accessor.\n" }, "authType": { "type": "string", "description": "The authentication type used to generate this token.\n" }, "backend": { "type": "string", "description": "The unique name of the AWS auth backend. Defaults to\n'aws'.\n", "willReplaceOnChanges": true }, "clientToken": { "type": "string", "description": "The token returned by Vault.\n", "secret": true }, "iamHttpRequestMethod": { "type": "string", "description": "The HTTP method used in the signed IAM\nrequest.\n", "willReplaceOnChanges": true }, "iamRequestBody": { "type": "string", "description": "The base64-encoded body of the signed\nrequest.\n", "willReplaceOnChanges": true }, "iamRequestHeaders": { "type": "string", "description": "The base64-encoded, JSON serialized\nrepresentation of the GetCallerIdentity HTTP request headers.\n", "willReplaceOnChanges": true }, "iamRequestUrl": { "type": "string", "description": "The base64-encoded HTTP URL used in the signed\nrequest.\n", "willReplaceOnChanges": true }, "identity": { "type": "string", "description": "The base64-encoded EC2 instance identity document to\nauthenticate with. Can be retrieved from the EC2 metadata server.\n", "willReplaceOnChanges": true }, "leaseDuration": { "type": "integer", "description": "The duration in seconds the token will be valid, relative\nto the time in \u003cspan pulumi-lang-nodejs=\"`leaseStartTime`\" pulumi-lang-dotnet=\"`LeaseStartTime`\" pulumi-lang-go=\"`leaseStartTime`\" pulumi-lang-python=\"`lease_start_time`\" pulumi-lang-yaml=\"`leaseStartTime`\" pulumi-lang-java=\"`leaseStartTime`\" pulumi-lang-hcl=\"`lease_start_time`\"\u003e`leaseStartTime`\u003c/span\u003e.\n" }, "leaseStartTime": { "type": "string", "description": "The approximate time at which the token was created,\nusing the clock of the system where Terraform was running.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of information returned by the Vault server about the\nauthentication used to generate this token.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "nonce": { "type": "string", "description": "The unique nonce to be used for login requests. Can be\nset to a user-specified value, or will contain the server-generated value\nonce a token is issued. EC2 instances can only acquire a single token until\nthe whitelist is tidied again unless they keep track of this nonce.\n", "willReplaceOnChanges": true }, "pkcs7": { "type": "string", "description": "The PKCS#7 signature of the identity document to\nauthenticate with, with all newline characters removed. Can be retrieved from\nthe EC2 metadata server.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "The Vault policies assigned to this token.\n" }, "renewable": { "type": "boolean", "description": "Set to true if the token can be extended through renewal.\n" }, "role": { "type": "string", "description": "The name of the AWS auth backend role to create tokens\nagainst.\n", "willReplaceOnChanges": true }, "signature": { "type": "string", "description": "The base64-encoded SHA256 RSA signature of the\ninstance identity document to authenticate with, with all newline characters\nremoved. Can be retrieved from the EC2 metadata server.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:aws/authBackendRole:AuthBackendRole": { "description": "Manages an AWS auth backend role in a Vault server. Roles constrain the\ninstances or principals that can perform the login operation against the\nbackend. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/aws.html) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.AuthBackend(\"aws\", {type: \"aws\"});\nconst example = new vault.aws.AuthBackendRole(\"example\", {\n backend: aws.path,\n role: \"test-role\",\n authType: \"iam\",\n boundAmiIds: [\"ami-8c1be5f6\"],\n boundAccountIds: [\"123456789012\"],\n boundVpcIds: [\"vpc-b61106d4\"],\n boundSubnetIds: [\"vpc-133128f1\"],\n boundIamRoleArns: [\"arn:aws:iam::123456789012:role/MyRole\"],\n boundIamInstanceProfileArns: [\"arn:aws:iam::123456789012:instance-profile/MyProfile\"],\n inferredEntityType: \"ec2_instance\",\n inferredAwsRegion: \"us-east-1\",\n tokenTtl: 60,\n tokenMaxTtl: 120,\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.AuthBackend(\"aws\", type=\"aws\")\nexample = vault.aws.AuthBackendRole(\"example\",\n backend=aws.path,\n role=\"test-role\",\n auth_type=\"iam\",\n bound_ami_ids=[\"ami-8c1be5f6\"],\n bound_account_ids=[\"123456789012\"],\n bound_vpc_ids=[\"vpc-b61106d4\"],\n bound_subnet_ids=[\"vpc-133128f1\"],\n bound_iam_role_arns=[\"arn:aws:iam::123456789012:role/MyRole\"],\n bound_iam_instance_profile_arns=[\"arn:aws:iam::123456789012:instance-profile/MyProfile\"],\n inferred_entity_type=\"ec2_instance\",\n inferred_aws_region=\"us-east-1\",\n token_ttl=60,\n token_max_ttl=120,\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.AuthBackend(\"aws\", new()\n {\n Type = \"aws\",\n });\n\n var example = new Vault.Aws.AuthBackendRole(\"example\", new()\n {\n Backend = aws.Path,\n Role = \"test-role\",\n AuthType = \"iam\",\n BoundAmiIds = new[]\n {\n \"ami-8c1be5f6\",\n },\n BoundAccountIds = new[]\n {\n \"123456789012\",\n },\n BoundVpcIds = new[]\n {\n \"vpc-b61106d4\",\n },\n BoundSubnetIds = new[]\n {\n \"vpc-133128f1\",\n },\n BoundIamRoleArns = new[]\n {\n \"arn:aws:iam::123456789012:role/MyRole\",\n },\n BoundIamInstanceProfileArns = new[]\n {\n \"arn:aws:iam::123456789012:instance-profile/MyProfile\",\n },\n InferredEntityType = \"ec2_instance\",\n InferredAwsRegion = \"us-east-1\",\n TokenTtl = 60,\n TokenMaxTtl = 120,\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\taws2, err := vault.NewAuthBackend(ctx, \"aws\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendRole(ctx, \"example\", \u0026aws.AuthBackendRoleArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tRole: pulumi.String(\"test-role\"),\n\t\t\tAuthType: pulumi.String(\"iam\"),\n\t\t\tBoundAmiIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"ami-8c1be5f6\"),\n\t\t\t},\n\t\t\tBoundAccountIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"123456789012\"),\n\t\t\t},\n\t\t\tBoundVpcIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"vpc-b61106d4\"),\n\t\t\t},\n\t\t\tBoundSubnetIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"vpc-133128f1\"),\n\t\t\t},\n\t\t\tBoundIamRoleArns: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"arn:aws:iam::123456789012:role/MyRole\"),\n\t\t\t},\n\t\t\tBoundIamInstanceProfileArns: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"arn:aws:iam::123456789012:instance-profile/MyProfile\"),\n\t\t\t},\n\t\t\tInferredEntityType: pulumi.String(\"ec2_instance\"),\n\t\t\tInferredAwsRegion: pulumi.String(\"us-east-1\"),\n\t\t\tTokenTtl: pulumi.Int(60),\n\t\t\tTokenMaxTtl: pulumi.Int(120),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"aws\" {\n type = \"aws\"\n}\nresource \"vault_aws_authbackendrole\" \"example\" {\n backend = vault_authbackend.aws.path\n role = \"test-role\"\n auth_type = \"iam\"\n bound_ami_ids = [\"ami-8c1be5f6\"]\n bound_account_ids = [\"123456789012\"]\n bound_vpc_ids = [\"vpc-b61106d4\"]\n bound_subnet_ids = [\"vpc-133128f1\"]\n bound_iam_role_arns = [\"arn:aws:iam::123456789012:role/MyRole\"]\n bound_iam_instance_profile_arns = [\"arn:aws:iam::123456789012:instance-profile/MyProfile\"]\n inferred_entity_type = \"ec2_instance\"\n inferred_aws_region = \"us-east-1\"\n token_ttl = 60\n token_max_ttl = 120\n token_policies = [\"default\", \"dev\", \"prod\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendRole;\nimport com.pulumi.vault.aws.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new AuthBackend(\"aws\", AuthBackendArgs.builder()\n .type(\"aws\")\n .build());\n\n var example = new AuthBackendRole(\"example\", AuthBackendRoleArgs.builder()\n .backend(aws.path())\n .role(\"test-role\")\n .authType(\"iam\")\n .boundAmiIds(\"ami-8c1be5f6\")\n .boundAccountIds(\"123456789012\")\n .boundVpcIds(\"vpc-b61106d4\")\n .boundSubnetIds(\"vpc-133128f1\")\n .boundIamRoleArns(\"arn:aws:iam::123456789012:role/MyRole\")\n .boundIamInstanceProfileArns(\"arn:aws:iam::123456789012:instance-profile/MyProfile\")\n .inferredEntityType(\"ec2_instance\")\n .inferredAwsRegion(\"us-east-1\")\n .tokenTtl(60)\n .tokenMaxTtl(120)\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:AuthBackend\n properties:\n type: aws\n example:\n type: vault:aws:AuthBackendRole\n properties:\n backend: ${aws.path}\n role: test-role\n authType: iam\n boundAmiIds:\n - ami-8c1be5f6\n boundAccountIds:\n - '123456789012'\n boundVpcIds:\n - vpc-b61106d4\n boundSubnetIds:\n - vpc-133128f1\n boundIamRoleArns:\n - arn:aws:iam::123456789012:role/MyRole\n boundIamInstanceProfileArns:\n - arn:aws:iam::123456789012:instance-profile/MyProfile\n inferredEntityType: ec2_instance\n inferredAwsRegion: us-east-1\n tokenTtl: 60\n tokenMaxTtl: 120\n tokenPolicies:\n - default\n - dev\n - prod\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAWS auth backend roles can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e path, `/role/`, and the \u003cspan pulumi-lang-nodejs=\"`role`\" pulumi-lang-dotnet=\"`Role`\" pulumi-lang-go=\"`role`\" pulumi-lang-python=\"`role`\" pulumi-lang-yaml=\"`role`\" pulumi-lang-java=\"`role`\" pulumi-lang-hcl=\"`role`\"\u003e`role`\u003c/span\u003e name e.g.\n\n```sh\n$ pulumi import vault:aws/authBackendRole:AuthBackendRole example auth/aws/role/test-role\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowInstanceMigration": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, allows migration of\nthe underlying instance where the client resides.\n" }, "authType": { "type": "string", "description": "The auth type permitted for this role. Valid choices\nare \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e.\n" }, "backend": { "type": "string", "description": "Path to the mounted aws auth backend.\n" }, "boundAccountIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2\ninstances that can perform the login operation that they should be using the\naccount ID specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundAmiIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2 instances\nthat can perform the login operation that they should be using the AMI ID\nspecified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundEc2InstanceIds": { "type": "array", "items": { "type": "string" }, "description": "Only EC2 instances that match this instance ID will be permitted to log in." }, "boundIamInstanceProfileArns": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on\nthe EC2 instances that can perform the login operation that they must be\nassociated with an IAM instance profile ARN which has a prefix that matches\nthe value specified by this field. The value is prefix-matched as though it\nwere a glob ending in `*`. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundIamPrincipalArns": { "type": "array", "items": { "type": "string" }, "description": "If set, defines the IAM principal that\nmust be authenticated when \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e. Wildcards are\nsupported at the end of the ARN.\n" }, "boundIamRoleArns": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2\ninstances that can perform the login operation that they must match the IAM\nrole ARN specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundRegions": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2 instances\nthat can perform the login operation that the region in their identity\ndocument must match the one specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set\nto \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this\nconstraint.\n" }, "boundSubnetIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2\ninstances that can perform the login operation that they be associated with\nthe subnet ID that matches the value specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e\nmust be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e\nto use this constraint.\n" }, "boundVpcIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2 instances\nthat can perform the login operation that they be associated with the VPC ID\nthat matches the value specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to\n\u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this\nconstraint.\n" }, "disallowReauthentication": { "type": "boolean", "description": "IF set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, only allows a\nsingle token to be granted per instance ID. This can only be set when\n\u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e.\n" }, "inferredAwsRegion": { "type": "string", "description": "When \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e is set, this\nis the region to search for the inferred entities. Required if\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e is set. This only applies when \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to\n\u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e.\n" }, "inferredEntityType": { "type": "string", "description": "If set, instructs Vault to turn on\ninferencing. The only valid value is \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e, which instructs Vault to\ninfer that the role comes from an EC2 instance in an IAM instance profile.\nThis only applies when \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "resolveAwsUniqueIds": { "type": "boolean", "description": "Only valid when\n\u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the \u003cspan pulumi-lang-nodejs=\"`boundIamPrincipalArns`\" pulumi-lang-dotnet=\"`BoundIamPrincipalArns`\" pulumi-lang-go=\"`boundIamPrincipalArns`\" pulumi-lang-python=\"`bound_iam_principal_arns`\" pulumi-lang-yaml=\"`boundIamPrincipalArns`\" pulumi-lang-java=\"`boundIamPrincipalArns`\" pulumi-lang-hcl=\"`bound_iam_principal_arns`\"\u003e`boundIamPrincipalArns`\u003c/span\u003e are\nresolved to [AWS Unique\nIDs](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids)\nfor the bound principal ARN. This field is ignored when a\n\u003cspan pulumi-lang-nodejs=\"`boundIamPrincipalArn`\" pulumi-lang-dotnet=\"`BoundIamPrincipalArn`\" pulumi-lang-go=\"`boundIamPrincipalArn`\" pulumi-lang-python=\"`bound_iam_principal_arn`\" pulumi-lang-yaml=\"`boundIamPrincipalArn`\" pulumi-lang-java=\"`boundIamPrincipalArn`\" pulumi-lang-hcl=\"`bound_iam_principal_arn`\"\u003e`boundIamPrincipalArn`\u003c/span\u003e ends in a wildcard. Resolving to unique IDs more\nclosely mimics the behavior of AWS services in that if an IAM user or role is\ndeleted and a new one is recreated with the same name, those new users or\nroles won't get access to roles in Vault that were permissioned to the prior\nprincipals of the same name. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\nOnce set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this cannot be changed to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e without recreating the role.\n" }, "role": { "type": "string", "description": "The name of the role.\n" }, "roleId": { "type": "string", "description": "The Vault generated role ID.\n" }, "roleTag": { "type": "string", "description": "If set, enable role tags for this role. The value set\nfor this field should be the key of the tag on the EC2 instance. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e\nmust be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e\nto use this constraint.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "role", "roleId" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowInstanceMigration": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, allows migration of\nthe underlying instance where the client resides.\n" }, "authType": { "type": "string", "description": "The auth type permitted for this role. Valid choices\nare \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "Path to the mounted aws auth backend.\n", "willReplaceOnChanges": true }, "boundAccountIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2\ninstances that can perform the login operation that they should be using the\naccount ID specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundAmiIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2 instances\nthat can perform the login operation that they should be using the AMI ID\nspecified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundEc2InstanceIds": { "type": "array", "items": { "type": "string" }, "description": "Only EC2 instances that match this instance ID will be permitted to log in." }, "boundIamInstanceProfileArns": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on\nthe EC2 instances that can perform the login operation that they must be\nassociated with an IAM instance profile ARN which has a prefix that matches\nthe value specified by this field. The value is prefix-matched as though it\nwere a glob ending in `*`. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundIamPrincipalArns": { "type": "array", "items": { "type": "string" }, "description": "If set, defines the IAM principal that\nmust be authenticated when \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e. Wildcards are\nsupported at the end of the ARN.\n" }, "boundIamRoleArns": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2\ninstances that can perform the login operation that they must match the IAM\nrole ARN specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundRegions": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2 instances\nthat can perform the login operation that the region in their identity\ndocument must match the one specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set\nto \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this\nconstraint.\n" }, "boundSubnetIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2\ninstances that can perform the login operation that they be associated with\nthe subnet ID that matches the value specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e\nmust be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e\nto use this constraint.\n" }, "boundVpcIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2 instances\nthat can perform the login operation that they be associated with the VPC ID\nthat matches the value specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to\n\u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this\nconstraint.\n" }, "disallowReauthentication": { "type": "boolean", "description": "IF set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, only allows a\nsingle token to be granted per instance ID. This can only be set when\n\u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e.\n" }, "inferredAwsRegion": { "type": "string", "description": "When \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e is set, this\nis the region to search for the inferred entities. Required if\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e is set. This only applies when \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to\n\u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e.\n" }, "inferredEntityType": { "type": "string", "description": "If set, instructs Vault to turn on\ninferencing. The only valid value is \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e, which instructs Vault to\ninfer that the role comes from an EC2 instance in an IAM instance profile.\nThis only applies when \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "resolveAwsUniqueIds": { "type": "boolean", "description": "Only valid when\n\u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the \u003cspan pulumi-lang-nodejs=\"`boundIamPrincipalArns`\" pulumi-lang-dotnet=\"`BoundIamPrincipalArns`\" pulumi-lang-go=\"`boundIamPrincipalArns`\" pulumi-lang-python=\"`bound_iam_principal_arns`\" pulumi-lang-yaml=\"`boundIamPrincipalArns`\" pulumi-lang-java=\"`boundIamPrincipalArns`\" pulumi-lang-hcl=\"`bound_iam_principal_arns`\"\u003e`boundIamPrincipalArns`\u003c/span\u003e are\nresolved to [AWS Unique\nIDs](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids)\nfor the bound principal ARN. This field is ignored when a\n\u003cspan pulumi-lang-nodejs=\"`boundIamPrincipalArn`\" pulumi-lang-dotnet=\"`BoundIamPrincipalArn`\" pulumi-lang-go=\"`boundIamPrincipalArn`\" pulumi-lang-python=\"`bound_iam_principal_arn`\" pulumi-lang-yaml=\"`boundIamPrincipalArn`\" pulumi-lang-java=\"`boundIamPrincipalArn`\" pulumi-lang-hcl=\"`bound_iam_principal_arn`\"\u003e`boundIamPrincipalArn`\u003c/span\u003e ends in a wildcard. Resolving to unique IDs more\nclosely mimics the behavior of AWS services in that if an IAM user or role is\ndeleted and a new one is recreated with the same name, those new users or\nroles won't get access to roles in Vault that were permissioned to the prior\nprincipals of the same name. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\nOnce set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this cannot be changed to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e without recreating the role.\n" }, "role": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "roleTag": { "type": "string", "description": "If set, enable role tags for this role. The value set\nfor this field should be the key of the tag on the EC2 instance. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e\nmust be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e\nto use this constraint.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "requiredInputs": [ "role" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowInstanceMigration": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, allows migration of\nthe underlying instance where the client resides.\n" }, "authType": { "type": "string", "description": "The auth type permitted for this role. Valid choices\nare \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "Path to the mounted aws auth backend.\n", "willReplaceOnChanges": true }, "boundAccountIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2\ninstances that can perform the login operation that they should be using the\naccount ID specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundAmiIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2 instances\nthat can perform the login operation that they should be using the AMI ID\nspecified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundEc2InstanceIds": { "type": "array", "items": { "type": "string" }, "description": "Only EC2 instances that match this instance ID will be permitted to log in." }, "boundIamInstanceProfileArns": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on\nthe EC2 instances that can perform the login operation that they must be\nassociated with an IAM instance profile ARN which has a prefix that matches\nthe value specified by this field. The value is prefix-matched as though it\nwere a glob ending in `*`. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundIamPrincipalArns": { "type": "array", "items": { "type": "string" }, "description": "If set, defines the IAM principal that\nmust be authenticated when \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e. Wildcards are\nsupported at the end of the ARN.\n" }, "boundIamRoleArns": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2\ninstances that can perform the login operation that they must match the IAM\nrole ARN specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this constraint.\n" }, "boundRegions": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2 instances\nthat can perform the login operation that the region in their identity\ndocument must match the one specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set\nto \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this\nconstraint.\n" }, "boundSubnetIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2\ninstances that can perform the login operation that they be associated with\nthe subnet ID that matches the value specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e\nmust be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e\nto use this constraint.\n" }, "boundVpcIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the EC2 instances\nthat can perform the login operation that they be associated with the VPC ID\nthat matches the value specified by this field. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e must be set to\n\u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e to use this\nconstraint.\n" }, "disallowReauthentication": { "type": "boolean", "description": "IF set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, only allows a\nsingle token to be granted per instance ID. This can only be set when\n\u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e.\n" }, "inferredAwsRegion": { "type": "string", "description": "When \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e is set, this\nis the region to search for the inferred entities. Required if\n\u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e is set. This only applies when \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to\n\u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e.\n" }, "inferredEntityType": { "type": "string", "description": "If set, instructs Vault to turn on\ninferencing. The only valid value is \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e, which instructs Vault to\ninfer that the role comes from an EC2 instance in an IAM instance profile.\nThis only applies when \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "resolveAwsUniqueIds": { "type": "boolean", "description": "Only valid when\n\u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the \u003cspan pulumi-lang-nodejs=\"`boundIamPrincipalArns`\" pulumi-lang-dotnet=\"`BoundIamPrincipalArns`\" pulumi-lang-go=\"`boundIamPrincipalArns`\" pulumi-lang-python=\"`bound_iam_principal_arns`\" pulumi-lang-yaml=\"`boundIamPrincipalArns`\" pulumi-lang-java=\"`boundIamPrincipalArns`\" pulumi-lang-hcl=\"`bound_iam_principal_arns`\"\u003e`boundIamPrincipalArns`\u003c/span\u003e are\nresolved to [AWS Unique\nIDs](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids)\nfor the bound principal ARN. This field is ignored when a\n\u003cspan pulumi-lang-nodejs=\"`boundIamPrincipalArn`\" pulumi-lang-dotnet=\"`BoundIamPrincipalArn`\" pulumi-lang-go=\"`boundIamPrincipalArn`\" pulumi-lang-python=\"`bound_iam_principal_arn`\" pulumi-lang-yaml=\"`boundIamPrincipalArn`\" pulumi-lang-java=\"`boundIamPrincipalArn`\" pulumi-lang-hcl=\"`bound_iam_principal_arn`\"\u003e`boundIamPrincipalArn`\u003c/span\u003e ends in a wildcard. Resolving to unique IDs more\nclosely mimics the behavior of AWS services in that if an IAM user or role is\ndeleted and a new one is recreated with the same name, those new users or\nroles won't get access to roles in Vault that were permissioned to the prior\nprincipals of the same name. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\nOnce set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this cannot be changed to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e without recreating the role.\n" }, "role": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "roleId": { "type": "string", "description": "The Vault generated role ID.\n" }, "roleTag": { "type": "string", "description": "If set, enable role tags for this role. The value set\nfor this field should be the key of the tag on the EC2 instance. \u003cspan pulumi-lang-nodejs=\"`authType`\" pulumi-lang-dotnet=\"`AuthType`\" pulumi-lang-go=\"`authType`\" pulumi-lang-python=\"`auth_type`\" pulumi-lang-yaml=\"`authType`\" pulumi-lang-java=\"`authType`\" pulumi-lang-hcl=\"`auth_type`\"\u003e`authType`\u003c/span\u003e\nmust be set to \u003cspan pulumi-lang-nodejs=\"`ec2`\" pulumi-lang-dotnet=\"`Ec2`\" pulumi-lang-go=\"`ec2`\" pulumi-lang-python=\"`ec2`\" pulumi-lang-yaml=\"`ec2`\" pulumi-lang-java=\"`ec2`\" pulumi-lang-hcl=\"`ec2`\"\u003e`ec2`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`inferredEntityType`\" pulumi-lang-dotnet=\"`InferredEntityType`\" pulumi-lang-go=\"`inferredEntityType`\" pulumi-lang-python=\"`inferred_entity_type`\" pulumi-lang-yaml=\"`inferredEntityType`\" pulumi-lang-java=\"`inferredEntityType`\" pulumi-lang-hcl=\"`inferred_entity_type`\"\u003e`inferredEntityType`\u003c/span\u003e must be set to \u003cspan pulumi-lang-nodejs=\"`ec2Instance`\" pulumi-lang-dotnet=\"`Ec2Instance`\" pulumi-lang-go=\"`ec2Instance`\" pulumi-lang-python=\"`ec2_instance`\" pulumi-lang-yaml=\"`ec2Instance`\" pulumi-lang-java=\"`ec2Instance`\" pulumi-lang-hcl=\"`ec2_instance`\"\u003e`ec2Instance`\u003c/span\u003e\nto use this constraint.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:aws/authBackendRoleTag:AuthBackendRoleTag": { "description": "Reads role tag information from an AWS auth backend in Vault. \n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.AuthBackend(\"aws\", {\n path: \"%s\",\n type: \"aws\",\n});\nconst role = new vault.aws.AuthBackendRole(\"role\", {\n backend: aws.path,\n role: \"%s\",\n authType: \"ec2\",\n boundAccountId: \"123456789012\",\n policies: [\n \"dev\",\n \"prod\",\n \"qa\",\n \"test\",\n ],\n roleTag: \"VaultRoleTag\",\n});\nconst test = new vault.aws.AuthBackendRoleTag(\"test\", {\n backend: aws.path,\n role: role.role,\n policies: [\n \"prod\",\n \"dev\",\n \"test\",\n ],\n maxTtl: \"1h\",\n instanceId: \"i-1234567\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.AuthBackend(\"aws\",\n path=\"%s\",\n type=\"aws\")\nrole = vault.aws.AuthBackendRole(\"role\",\n backend=aws.path,\n role=\"%s\",\n auth_type=\"ec2\",\n bound_account_id=\"123456789012\",\n policies=[\n \"dev\",\n \"prod\",\n \"qa\",\n \"test\",\n ],\n role_tag=\"VaultRoleTag\")\ntest = vault.aws.AuthBackendRoleTag(\"test\",\n backend=aws.path,\n role=role.role,\n policies=[\n \"prod\",\n \"dev\",\n \"test\",\n ],\n max_ttl=\"1h\",\n instance_id=\"i-1234567\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.AuthBackend(\"aws\", new()\n {\n Path = \"%s\",\n Type = \"aws\",\n });\n\n var role = new Vault.Aws.AuthBackendRole(\"role\", new()\n {\n Backend = aws.Path,\n Role = \"%s\",\n AuthType = \"ec2\",\n BoundAccountId = \"123456789012\",\n Policies = new[]\n {\n \"dev\",\n \"prod\",\n \"qa\",\n \"test\",\n },\n RoleTag = \"VaultRoleTag\",\n });\n\n var test = new Vault.Aws.AuthBackendRoleTag(\"test\", new()\n {\n Backend = aws.Path,\n Role = role.Role,\n Policies = new[]\n {\n \"prod\",\n \"dev\",\n \"test\",\n },\n MaxTtl = \"1h\",\n InstanceId = \"i-1234567\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\taws2, err := vault.NewAuthBackend(ctx, \"aws\", \u0026vault.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"%s\"),\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\trole, err := aws.NewAuthBackendRole(ctx, \"role\", \u0026aws.AuthBackendRoleArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tRole: pulumi.String(\"%s\"),\n\t\t\tAuthType: pulumi.String(\"ec2\"),\n\t\t\tBoundAccountId: \"123456789012\",\n\t\t\tPolicies: []string{\n\t\t\t\t\"dev\",\n\t\t\t\t\"prod\",\n\t\t\t\t\"qa\",\n\t\t\t\t\"test\",\n\t\t\t},\n\t\t\tRoleTag: pulumi.String(\"VaultRoleTag\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendRoleTag(ctx, \"test\", \u0026aws.AuthBackendRoleTagArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tRole: role.Role,\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tMaxTtl: pulumi.String(\"1h\"),\n\t\t\tInstanceId: pulumi.String(\"i-1234567\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"aws\" {\n path = \"%s\"\n type = \"aws\"\n}\nresource \"vault_aws_authbackendrole\" \"role\" {\n backend = vault_authbackend.aws.path\n role = \"%s\"\n auth_type = \"ec2\"\n bound_account_id = \"123456789012\"\n policies = [\"dev\", \"prod\", \"qa\", \"test\"]\n role_tag = \"VaultRoleTag\"\n}\nresource \"vault_aws_authbackendroletag\" \"test\" {\n backend = vault_authbackend.aws.path\n role = vault_aws_authbackendrole.role.role\n policies = [\"prod\", \"dev\", \"test\"]\n max_ttl = \"1h\"\n instance_id = \"i-1234567\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendRole;\nimport com.pulumi.vault.aws.AuthBackendRoleArgs;\nimport com.pulumi.vault.aws.AuthBackendRoleTag;\nimport com.pulumi.vault.aws.AuthBackendRoleTagArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new AuthBackend(\"aws\", AuthBackendArgs.builder()\n .path(\"%s\")\n .type(\"aws\")\n .build());\n\n var role = new AuthBackendRole(\"role\", AuthBackendRoleArgs.builder()\n .backend(aws.path())\n .role(\"%s\")\n .authType(\"ec2\")\n .boundAccountId(\"123456789012\")\n .policies(Arrays.asList( \n \"dev\",\n \"prod\",\n \"qa\",\n \"test\"))\n .roleTag(\"VaultRoleTag\")\n .build());\n\n var test = new AuthBackendRoleTag(\"test\", AuthBackendRoleTagArgs.builder()\n .backend(aws.path())\n .role(role.role())\n .policies( \n \"prod\",\n \"dev\",\n \"test\")\n .maxTtl(\"1h\")\n .instanceId(\"i-1234567\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:AuthBackend\n properties:\n path: '%s'\n type: aws\n role:\n type: vault:aws:AuthBackendRole\n properties:\n backend: ${aws.path}\n role: '%s'\n authType: ec2\n boundAccountId: '123456789012'\n policies:\n - dev\n - prod\n - qa\n - test\n roleTag: VaultRoleTag\n test:\n type: vault:aws:AuthBackendRoleTag\n properties:\n backend: ${aws.path}\n role: ${role.role}\n policies:\n - prod\n - dev\n - test\n maxTtl: 1h\n instanceId: i-1234567\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "allowInstanceMigration": { "type": "boolean", "description": "If set, allows migration of the underlying instances where the client resides. Use with caution.\n" }, "backend": { "type": "string", "description": "The path to the AWS auth backend to\nread role tags from, with no leading or trailing `/`s. Defaults to \"aws\".\n" }, "disallowReauthentication": { "type": "boolean", "description": "If set, only allows a single token to be granted per instance ID.\n" }, "instanceId": { "type": "string", "description": "Instance ID for which this tag is intended for. If set, the created tag can only be used by the instance with the given ID.\n" }, "maxTtl": { "type": "string", "description": "The maximum TTL of the tokens issued using this role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "The policies to be associated with the tag. Must be a subset of the policies associated with the role.\n" }, "role": { "type": "string", "description": "The name of the AWS auth backend role to read\nrole tags from, with no leading or trailing `/`s.\n" }, "tagKey": { "type": "string", "description": "The key of the role tag.\n" }, "tagValue": { "type": "string", "description": "The value to set the role key.\n" } }, "required": [ "role", "tagKey", "tagValue" ], "inputProperties": { "allowInstanceMigration": { "type": "boolean", "description": "If set, allows migration of the underlying instances where the client resides. Use with caution.\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The path to the AWS auth backend to\nread role tags from, with no leading or trailing `/`s. Defaults to \"aws\".\n", "willReplaceOnChanges": true }, "disallowReauthentication": { "type": "boolean", "description": "If set, only allows a single token to be granted per instance ID.\n", "willReplaceOnChanges": true }, "instanceId": { "type": "string", "description": "Instance ID for which this tag is intended for. If set, the created tag can only be used by the instance with the given ID.\n", "willReplaceOnChanges": true }, "maxTtl": { "type": "string", "description": "The maximum TTL of the tokens issued using this role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "The policies to be associated with the tag. Must be a subset of the policies associated with the role.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "The name of the AWS auth backend role to read\nrole tags from, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "role" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRoleTag resources.\n", "properties": { "allowInstanceMigration": { "type": "boolean", "description": "If set, allows migration of the underlying instances where the client resides. Use with caution.\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The path to the AWS auth backend to\nread role tags from, with no leading or trailing `/`s. Defaults to \"aws\".\n", "willReplaceOnChanges": true }, "disallowReauthentication": { "type": "boolean", "description": "If set, only allows a single token to be granted per instance ID.\n", "willReplaceOnChanges": true }, "instanceId": { "type": "string", "description": "Instance ID for which this tag is intended for. If set, the created tag can only be used by the instance with the given ID.\n", "willReplaceOnChanges": true }, "maxTtl": { "type": "string", "description": "The maximum TTL of the tokens issued using this role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "The policies to be associated with the tag. Must be a subset of the policies associated with the role.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "The name of the AWS auth backend role to read\nrole tags from, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "tagKey": { "type": "string", "description": "The key of the role tag.\n" }, "tagValue": { "type": "string", "description": "The value to set the role key.\n" } }, "type": "object" } }, "vault:aws/authBackendRoletagBlacklist:AuthBackendRoletagBlacklist": { "description": "Configures the periodic tidying operation of the blacklisted role tag entries.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.AuthBackend(\"example\", {type: \"aws\"});\nconst exampleAuthBackendRoletagBlacklist = new vault.aws.AuthBackendRoletagBlacklist(\"example\", {\n backend: example.path,\n safetyBuffer: 360,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.AuthBackend(\"example\", type=\"aws\")\nexample_auth_backend_roletag_blacklist = vault.aws.AuthBackendRoletagBlacklist(\"example\",\n backend=example.path,\n safety_buffer=360)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.AuthBackend(\"example\", new()\n {\n Type = \"aws\",\n });\n\n var exampleAuthBackendRoletagBlacklist = new Vault.Aws.AuthBackendRoletagBlacklist(\"example\", new()\n {\n Backend = example.Path,\n SafetyBuffer = 360,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewAuthBackend(ctx, \"example\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendRoletagBlacklist(ctx, \"example\", \u0026aws.AuthBackendRoletagBlacklistArgs{\n\t\t\tBackend: example.Path,\n\t\t\tSafetyBuffer: pulumi.Int(360),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"example\" {\n type = \"aws\"\n}\nresource \"vault_aws_authbackendroletagblacklist\" \"example\" {\n backend = vault_authbackend.example.path\n safety_buffer = 360\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendRoletagBlacklist;\nimport com.pulumi.vault.aws.AuthBackendRoletagBlacklistArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .type(\"aws\")\n .build());\n\n var exampleAuthBackendRoletagBlacklist = new AuthBackendRoletagBlacklist(\"exampleAuthBackendRoletagBlacklist\", AuthBackendRoletagBlacklistArgs.builder()\n .backend(example.path())\n .safetyBuffer(360)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:AuthBackend\n properties:\n type: aws\n exampleAuthBackendRoletagBlacklist:\n type: vault:aws:AuthBackendRoletagBlacklist\n name: example\n properties:\n backend: ${example.path}\n safetyBuffer: 360\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at.\n" }, "disablePeriodicTidy": { "type": "boolean", "description": "If set to true, disables the periodic\ntidying of the roletag blacklist entries. Defaults to false.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "safetyBuffer": { "type": "integer", "description": "The amount of extra time that must have passed\nbeyond the roletag expiration, before it is removed from the backend storage.\nDefaults to 259,200 seconds, or 72 hours.\n" } }, "required": [ "backend" ], "inputProperties": { "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at.\n", "willReplaceOnChanges": true }, "disablePeriodicTidy": { "type": "boolean", "description": "If set to true, disables the periodic\ntidying of the roletag blacklist entries. Defaults to false.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "safetyBuffer": { "type": "integer", "description": "The amount of extra time that must have passed\nbeyond the roletag expiration, before it is removed from the backend storage.\nDefaults to 259,200 seconds, or 72 hours.\n" } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRoletagBlacklist resources.\n", "properties": { "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at.\n", "willReplaceOnChanges": true }, "disablePeriodicTidy": { "type": "boolean", "description": "If set to true, disables the periodic\ntidying of the roletag blacklist entries. Defaults to false.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "safetyBuffer": { "type": "integer", "description": "The amount of extra time that must have passed\nbeyond the roletag expiration, before it is removed from the backend storage.\nDefaults to 259,200 seconds, or 72 hours.\n" } }, "type": "object" } }, "vault:aws/authBackendStsRole:AuthBackendStsRole": { "description": "Manages an STS role in a Vault server. STS roles are mappings\nbetween account IDs and STS ARNs. When a login attempt is made\nfrom an EC2 instance in the account ID specified, the associated\nSTS role will be used to verify the request. For more information,\nsee the [Vault documentation](https://www.vaultproject.io/docs/auth/aws.html#cross-account-access).\n\n\u003e **Important** All data provided in the resource configuration will be\n written in cleartext to state and plan files generated by Terraform, and will\n appear in the console output when Terraform runs. Protect these artifacts\n accordingly. See the main provider documentation for more\n details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.AuthBackend(\"aws\", {type: \"aws\"});\nconst role = new vault.aws.AuthBackendStsRole(\"role\", {\n backend: aws.path,\n accountId: \"1234567890\",\n stsRole: \"arn:aws:iam::1234567890:role/my-role\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.AuthBackend(\"aws\", type=\"aws\")\nrole = vault.aws.AuthBackendStsRole(\"role\",\n backend=aws.path,\n account_id=\"1234567890\",\n sts_role=\"arn:aws:iam::1234567890:role/my-role\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.AuthBackend(\"aws\", new()\n {\n Type = \"aws\",\n });\n\n var role = new Vault.Aws.AuthBackendStsRole(\"role\", new()\n {\n Backend = aws.Path,\n AccountId = \"1234567890\",\n StsRole = \"arn:aws:iam::1234567890:role/my-role\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\taws2, err := vault.NewAuthBackend(ctx, \"aws\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"aws\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewAuthBackendStsRole(ctx, \"role\", \u0026aws.AuthBackendStsRoleArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tAccountId: pulumi.String(\"1234567890\"),\n\t\t\tStsRole: pulumi.String(\"arn:aws:iam::1234567890:role/my-role\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"aws\" {\n type = \"aws\"\n}\nresource \"vault_aws_authbackendstsrole\" \"role\" {\n backend = vault_authbackend.aws.path\n account_id = \"1234567890\"\n sts_role = \"arn:aws:iam::1234567890:role/my-role\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.aws.AuthBackendStsRole;\nimport com.pulumi.vault.aws.AuthBackendStsRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new AuthBackend(\"aws\", AuthBackendArgs.builder()\n .type(\"aws\")\n .build());\n\n var role = new AuthBackendStsRole(\"role\", AuthBackendStsRoleArgs.builder()\n .backend(aws.path())\n .accountId(\"1234567890\")\n .stsRole(\"arn:aws:iam::1234567890:role/my-role\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:AuthBackend\n properties:\n type: aws\n role:\n type: vault:aws:AuthBackendStsRole\n properties:\n backend: ${aws.path}\n accountId: '1234567890'\n stsRole: arn:aws:iam::1234567890:role/my-role\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAWS auth backend STS roles can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e path, `/config/sts/`, and the \u003cspan pulumi-lang-nodejs=\"`accountId`\" pulumi-lang-dotnet=\"`AccountId`\" pulumi-lang-go=\"`accountId`\" pulumi-lang-python=\"`account_id`\" pulumi-lang-yaml=\"`accountId`\" pulumi-lang-java=\"`accountId`\" pulumi-lang-hcl=\"`account_id`\"\u003e`accountId`\u003c/span\u003e e.g.\n\n```sh\n$ pulumi import vault:aws/authBackendStsRole:AuthBackendStsRole example auth/aws/config/sts/1234567890\n```\n\n", "properties": { "accountId": { "type": "string", "description": "The AWS account ID to configure the STS role for.\n" }, "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n" }, "externalId": { "type": "string", "description": "External ID expected by the STS role. The associated STS role must be configured to require the external ID. Requires Vault 1.17+.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "stsRole": { "type": "string", "description": "The STS role to assume when verifying requests made\nby EC2 instances in the account specified by \u003cspan pulumi-lang-nodejs=\"`accountId`\" pulumi-lang-dotnet=\"`AccountId`\" pulumi-lang-go=\"`accountId`\" pulumi-lang-python=\"`account_id`\" pulumi-lang-yaml=\"`accountId`\" pulumi-lang-java=\"`accountId`\" pulumi-lang-hcl=\"`account_id`\"\u003e`accountId`\u003c/span\u003e.\n" } }, "required": [ "accountId", "stsRole" ], "inputProperties": { "accountId": { "type": "string", "description": "The AWS account ID to configure the STS role for.\n" }, "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "externalId": { "type": "string", "description": "External ID expected by the STS role. The associated STS role must be configured to require the external ID. Requires Vault 1.17+.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "stsRole": { "type": "string", "description": "The STS role to assume when verifying requests made\nby EC2 instances in the account specified by \u003cspan pulumi-lang-nodejs=\"`accountId`\" pulumi-lang-dotnet=\"`AccountId`\" pulumi-lang-go=\"`accountId`\" pulumi-lang-python=\"`account_id`\" pulumi-lang-yaml=\"`accountId`\" pulumi-lang-java=\"`accountId`\" pulumi-lang-hcl=\"`account_id`\"\u003e`accountId`\u003c/span\u003e.\n" } }, "requiredInputs": [ "accountId", "stsRole" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendStsRole resources.\n", "properties": { "accountId": { "type": "string", "description": "The AWS account ID to configure the STS role for.\n" }, "backend": { "type": "string", "description": "The path the AWS auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "externalId": { "type": "string", "description": "External ID expected by the STS role. The associated STS role must be configured to require the external ID. Requires Vault 1.17+.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "stsRole": { "type": "string", "description": "The STS role to assume when verifying requests made\nby EC2 instances in the account specified by \u003cspan pulumi-lang-nodejs=\"`accountId`\" pulumi-lang-dotnet=\"`AccountId`\" pulumi-lang-go=\"`accountId`\" pulumi-lang-python=\"`account_id`\" pulumi-lang-yaml=\"`accountId`\" pulumi-lang-java=\"`accountId`\" pulumi-lang-hcl=\"`account_id`\"\u003e`accountId`\u003c/span\u003e.\n" } }, "type": "object" } }, "vault:aws/secretBackend:SecretBackend": { "description": "Creates an AWS Secret Backend for Vault. AWS secret backends can then issue AWS\naccess keys and secret keys, once a role has been added to the backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.aws.SecretBackend(\"aws\", {\n accessKey: \"AKIA.....\",\n secretKey: \"AWS secret key\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.aws.SecretBackend(\"aws\",\n access_key=\"AKIA.....\",\n secret_key=\"AWS secret key\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.Aws.SecretBackend(\"aws\", new()\n {\n AccessKey = \"AKIA.....\",\n SecretKey = \"AWS secret key\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := aws.NewSecretBackend(ctx, \"aws\", \u0026aws.SecretBackendArgs{\n\t\t\tAccessKey: pulumi.String(\"AKIA.....\"),\n\t\t\tSecretKey: pulumi.String(\"AWS secret key\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_aws_secretbackend\" \"aws\" {\n access_key = \"AKIA.....\"\n secret_key = \"AWS secret key\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.aws.SecretBackend;\nimport com.pulumi.vault.aws.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new SecretBackend(\"aws\", SecretBackendArgs.builder()\n .accessKey(\"AKIA.....\")\n .secretKey(\"AWS secret key\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:aws:SecretBackend\n properties:\n accessKey: AKIA.....\n secretKey: AWS secret key\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Write-Only Secret Key\n\nThe \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field allows you to configure the AWS secret key without \nstoring it in Terraform state. This is recommended for enhanced security.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.aws.SecretBackend(\"aws\", {\n accessKey: \"AKIA.....\",\n secretKeyWo: awsSecretKey,\n secretKeyWoVersion: 1,\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.aws.SecretBackend(\"aws\",\n access_key=\"AKIA.....\",\n secret_key_wo=aws_secret_key,\n secret_key_wo_version=1,\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.Aws.SecretBackend(\"aws\", new()\n {\n AccessKey = \"AKIA.....\",\n SecretKeyWo = awsSecretKey,\n SecretKeyWoVersion = 1,\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := aws.NewSecretBackend(ctx, \"aws\", \u0026aws.SecretBackendArgs{\n\t\t\tAccessKey: pulumi.String(\"AKIA.....\"),\n\t\t\tSecretKeyWo: pulumi.Any(awsSecretKey),\n\t\t\tSecretKeyWoVersion: pulumi.Int(1),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_aws_secretbackend\" \"aws\" {\n access_key = \"AKIA.....\"\n secret_key_wo = awsSecretKey\n secret_key_wo_version = 1\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.aws.SecretBackend;\nimport com.pulumi.vault.aws.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new SecretBackend(\"aws\", SecretBackendArgs.builder()\n .accessKey(\"AKIA.....\")\n .secretKeyWo(awsSecretKey)\n .secretKeyWoVersion(1)\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:aws:SecretBackend\n properties:\n accessKey: AKIA.....\n secretKeyWo: ${awsSecretKey}\n secretKeyWoVersion: 1\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nTo update the \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e value, increment the \u003cspan pulumi-lang-nodejs=\"`secretKeyWoVersion`\" pulumi-lang-dotnet=\"`SecretKeyWoVersion`\" pulumi-lang-go=\"`secretKeyWoVersion`\" pulumi-lang-python=\"`secret_key_wo_version`\" pulumi-lang-yaml=\"`secretKeyWoVersion`\" pulumi-lang-java=\"`secretKeyWoVersion`\" pulumi-lang-hcl=\"`secret_key_wo_version`\"\u003e`secretKeyWoVersion`\u003c/span\u003e:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.aws.SecretBackend(\"aws\", {\n accessKey: \"AKIA.....\",\n secretKeyWo: awsSecretKey,\n secretKeyWoVersion: 2,\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.aws.SecretBackend(\"aws\",\n access_key=\"AKIA.....\",\n secret_key_wo=aws_secret_key,\n secret_key_wo_version=2,\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.Aws.SecretBackend(\"aws\", new()\n {\n AccessKey = \"AKIA.....\",\n SecretKeyWo = awsSecretKey,\n SecretKeyWoVersion = 2,\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := aws.NewSecretBackend(ctx, \"aws\", \u0026aws.SecretBackendArgs{\n\t\t\tAccessKey: pulumi.String(\"AKIA.....\"),\n\t\t\tSecretKeyWo: pulumi.Any(awsSecretKey),\n\t\t\tSecretKeyWoVersion: pulumi.Int(2),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_aws_secretbackend\" \"aws\" {\n access_key = \"AKIA.....\"\n secret_key_wo = awsSecretKey\n secret_key_wo_version = 2 # Increment to trigger update\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.aws.SecretBackend;\nimport com.pulumi.vault.aws.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new SecretBackend(\"aws\", SecretBackendArgs.builder()\n .accessKey(\"AKIA.....\")\n .secretKeyWo(awsSecretKey)\n .secretKeyWoVersion(2)\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:aws:SecretBackend\n properties:\n accessKey: AKIA.....\n secretKeyWo: ${awsSecretKey}\n secretKeyWoVersion: 2 # Increment to trigger update\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Workload Identity Federation\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.aws.SecretBackend(\"aws\", {\n identityTokenAudience: \"\u003cTOKEN_AUDIENCE\u003e\",\n identityTokenTtl: Number(\"\u003cTOKEN_TTL\u003e\"),\n roleArn: \"\u003cAWS_ROLE_ARN\u003e\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.aws.SecretBackend(\"aws\",\n identity_token_audience=\"\u003cTOKEN_AUDIENCE\u003e\",\n identity_token_ttl=int(\"\u003cTOKEN_TTL\u003e\"),\n role_arn=\"\u003cAWS_ROLE_ARN\u003e\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.Aws.SecretBackend(\"aws\", new()\n {\n IdentityTokenAudience = \"\u003cTOKEN_AUDIENCE\u003e\",\n IdentityTokenTtl = \"\u003cTOKEN_TTL\u003e\",\n RoleArn = \"\u003cAWS_ROLE_ARN\u003e\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := aws.NewSecretBackend(ctx, \"aws\", \u0026aws.SecretBackendArgs{\n\t\t\tIdentityTokenAudience: pulumi.String(\"\u003cTOKEN_AUDIENCE\u003e\"),\n\t\t\tIdentityTokenTtl: pulumi.Int(\"\u003cTOKEN_TTL\u003e\"),\n\t\t\tRoleArn: pulumi.String(\"\u003cAWS_ROLE_ARN\u003e\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_aws_secretbackend\" \"aws\" {\n identity_token_audience = \"\u003cTOKEN_AUDIENCE\u003e\"\n identity_token_ttl = \"\u003cTOKEN_TTL\u003e\"\n role_arn = \"\u003cAWS_ROLE_ARN\u003e\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.aws.SecretBackend;\nimport com.pulumi.vault.aws.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new SecretBackend(\"aws\", SecretBackendArgs.builder()\n .identityTokenAudience(\"\u003cTOKEN_AUDIENCE\u003e\")\n .identityTokenTtl(\"\u003cTOKEN_TTL\u003e\")\n .roleArn(\"\u003cAWS_ROLE_ARN\u003e\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:aws:SecretBackend\n properties:\n identityTokenAudience: \u003cTOKEN_AUDIENCE\u003e\n identityTokenTtl: \u003cTOKEN_TTL\u003e\n roleArn: \u003cAWS_ROLE_ARN\u003e\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThese attributes are write-only and will not be persisted to Terraform state. \nRequires Terraform 1.11+.\n\n* \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e - (Optional) The AWS Secret Key this backend should use to\nissue new credentials. This is a write-only field and will not be stored in state. \nVault uses the official AWS SDK to authenticate, and thus can also use standard AWS \nenvironment credentials, shared file credentials or IAM role/ECS task credentials. \nConflicts with \u003cspan pulumi-lang-nodejs=\"`secretKey`\" pulumi-lang-dotnet=\"`SecretKey`\" pulumi-lang-go=\"`secretKey`\" pulumi-lang-python=\"`secret_key`\" pulumi-lang-yaml=\"`secretKey`\" pulumi-lang-java=\"`secretKey`\" pulumi-lang-hcl=\"`secret_key`\"\u003e`secretKey`\u003c/span\u003e.\n\n* \u003cspan pulumi-lang-nodejs=\"`secretKeyWoVersion`\" pulumi-lang-dotnet=\"`SecretKeyWoVersion`\" pulumi-lang-go=\"`secretKeyWoVersion`\" pulumi-lang-python=\"`secret_key_wo_version`\" pulumi-lang-yaml=\"`secretKeyWoVersion`\" pulumi-lang-java=\"`secretKeyWoVersion`\" pulumi-lang-hcl=\"`secret_key_wo_version`\"\u003e`secretKeyWoVersion`\u003c/span\u003e - (Optional, Required if \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e is set) A version counter for the \n\u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e field. Incrementing this value will trigger an update to the secret key.\n\n## Tutorials\n\nRefer to the Inject Secrets into Terraform Using the Vault Provider tutorial for a step-by-step usage example.\n\n## Import\n\nAWS secret backends can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:aws/secretBackend:SecretBackend aws aws\n```\n\n", "properties": { "accessKey": { "type": "string", "description": "The AWS Access Key ID this backend should use to\nissue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.\n", "secret": true }, "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "iamEndpoint": { "type": "string", "description": "Specifies a custom HTTP IAM endpoint to use.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value. Requires Vault 1.16+.\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds. Requires Vault 1.16+.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Specifies if the secret backend is local only" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "maxRetries": { "type": "integer", "description": "Number of max retries the client should use for recoverable errors.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "region": { "type": "string", "description": "The AWS region for API calls. Defaults to `us-east-1`.\n\n\u003e **Important** The same limitation noted above for the \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e parameter\nalso applies to the \u003cspan pulumi-lang-nodejs=\"`region`\" pulumi-lang-dotnet=\"`Region`\" pulumi-lang-go=\"`region`\" pulumi-lang-python=\"`region`\" pulumi-lang-yaml=\"`region`\" pulumi-lang-java=\"`region`\" pulumi-lang-hcl=\"`region`\"\u003e`region`\u003c/span\u003e parameter. Vault versions 1.2.3 and older will not\nallow Terraform to detect (and thus correct) drift in the \u003cspan pulumi-lang-nodejs=\"`region`\" pulumi-lang-dotnet=\"`Region`\" pulumi-lang-go=\"`region`\" pulumi-lang-python=\"`region`\" pulumi-lang-yaml=\"`region`\" pulumi-lang-java=\"`region`\" pulumi-lang-hcl=\"`region`\"\u003e`region`\u003c/span\u003e parameter,\nwhile newer versions of Vault will.\n" }, "roleArn": { "type": "string", "description": "Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential. \nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "secretKey": { "type": "string", "description": "The AWS Secret Key this backend should use to\nissue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials. Conflicts with \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e.\n\n\u003e **Important** Vault version 1.2.3 and older does not support reading the configured\ncredentials back from the API, With these older versions, Terraform cannot detect and correct drift\non \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`secretKey`\" pulumi-lang-dotnet=\"`SecretKey`\" pulumi-lang-go=\"`secretKey`\" pulumi-lang-python=\"`secret_key`\" pulumi-lang-yaml=\"`secretKey`\" pulumi-lang-java=\"`secretKey`\" pulumi-lang-hcl=\"`secret_key`\"\u003e`secretKey`\u003c/span\u003e. Changing the values, however, _will_\noverwrite the previously stored values. With versions of Vault newer than\n1.2.3, reading the \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e only is supported, and so drifts of the\n\u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e will be detected and corrected, but drifts on the \u003cspan pulumi-lang-nodejs=\"`secretKey`\" pulumi-lang-dotnet=\"`SecretKey`\" pulumi-lang-go=\"`secretKey`\" pulumi-lang-python=\"`secret_key`\" pulumi-lang-yaml=\"`secretKey`\" pulumi-lang-java=\"`secretKey`\" pulumi-lang-hcl=\"`secret_key`\"\u003e`secretKey`\u003c/span\u003e\nwill not.\n", "secret": true }, "secretKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe AWS Secret Access Key to use when generating new credentials. This is a write-only field and will not be read back from Vault.", "secret": true }, "secretKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" secretKeyWo \" pulumi-lang-dotnet=\" SecretKeyWo \" pulumi-lang-go=\" secretKeyWo \" pulumi-lang-python=\" secret_key_wo \" pulumi-lang-yaml=\" secretKeyWo \" pulumi-lang-java=\" secretKeyWo \" pulumi-lang-hcl=\" secret_key_wo \"\u003e secretKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update to the secret_key." }, "stsEndpoint": { "type": "string", "description": "Specifies a custom HTTP STS endpoint to use.\n" }, "stsFallbackEndpoints": { "type": "array", "items": { "type": "string" }, "description": "Ordered list of \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003es to try if the defined one fails. Requires Vault 1.19+\n" }, "stsFallbackRegions": { "type": "array", "items": { "type": "string" }, "description": "Ordered list of \u003cspan pulumi-lang-nodejs=\"`stsRegion`\" pulumi-lang-dotnet=\"`StsRegion`\" pulumi-lang-go=\"`stsRegion`\" pulumi-lang-python=\"`sts_region`\" pulumi-lang-yaml=\"`stsRegion`\" pulumi-lang-java=\"`stsRegion`\" pulumi-lang-hcl=\"`sts_region`\"\u003e`stsRegion`\u003c/span\u003es matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+\n" }, "stsRegion": { "type": "string", "description": "Specifies the region of the STS endpoint. Should be included if \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003e is supplied. Requires Vault 1.19+\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:\n\n```\n{{ if (eq .Type \"STS\") }}\n{{ printf \"vault-%s-%s\" (unix_time) (random 20) | truncate 32 }}\n{{ else }}\n{{ printf \"vault-%s-%s-%s\" (printf \"%s-%s\" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}\n{{ end }}\n\n```\n" } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "defaultLeaseTtlSeconds", "forceNoCache", "identityTokenTtl", "maxLeaseTtlSeconds", "region", "sealWrap", "usernameTemplate" ], "inputProperties": { "accessKey": { "type": "string", "description": "The AWS Access Key ID this backend should use to\nissue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.\n", "secret": true }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "iamEndpoint": { "type": "string", "description": "Specifies a custom HTTP IAM endpoint to use.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value. Requires Vault 1.16+.\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds. Requires Vault 1.16+.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Specifies if the secret backend is local only", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "maxRetries": { "type": "integer", "description": "Number of max retries the client should use for recoverable errors.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "region": { "type": "string", "description": "The AWS region for API calls. Defaults to `us-east-1`.\n\n\u003e **Important** The same limitation noted above for the \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e parameter\nalso applies to the \u003cspan pulumi-lang-nodejs=\"`region`\" pulumi-lang-dotnet=\"`Region`\" pulumi-lang-go=\"`region`\" pulumi-lang-python=\"`region`\" pulumi-lang-yaml=\"`region`\" pulumi-lang-java=\"`region`\" pulumi-lang-hcl=\"`region`\"\u003e`region`\u003c/span\u003e parameter. Vault versions 1.2.3 and older will not\nallow Terraform to detect (and thus correct) drift in the \u003cspan pulumi-lang-nodejs=\"`region`\" pulumi-lang-dotnet=\"`Region`\" pulumi-lang-go=\"`region`\" pulumi-lang-python=\"`region`\" pulumi-lang-yaml=\"`region`\" pulumi-lang-java=\"`region`\" pulumi-lang-hcl=\"`region`\"\u003e`region`\u003c/span\u003e parameter,\nwhile newer versions of Vault will.\n" }, "roleArn": { "type": "string", "description": "Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential. \nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "secretKey": { "type": "string", "description": "The AWS Secret Key this backend should use to\nissue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials. Conflicts with \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e.\n\n\u003e **Important** Vault version 1.2.3 and older does not support reading the configured\ncredentials back from the API, With these older versions, Terraform cannot detect and correct drift\non \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`secretKey`\" pulumi-lang-dotnet=\"`SecretKey`\" pulumi-lang-go=\"`secretKey`\" pulumi-lang-python=\"`secret_key`\" pulumi-lang-yaml=\"`secretKey`\" pulumi-lang-java=\"`secretKey`\" pulumi-lang-hcl=\"`secret_key`\"\u003e`secretKey`\u003c/span\u003e. Changing the values, however, _will_\noverwrite the previously stored values. With versions of Vault newer than\n1.2.3, reading the \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e only is supported, and so drifts of the\n\u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e will be detected and corrected, but drifts on the \u003cspan pulumi-lang-nodejs=\"`secretKey`\" pulumi-lang-dotnet=\"`SecretKey`\" pulumi-lang-go=\"`secretKey`\" pulumi-lang-python=\"`secret_key`\" pulumi-lang-yaml=\"`secretKey`\" pulumi-lang-java=\"`secretKey`\" pulumi-lang-hcl=\"`secret_key`\"\u003e`secretKey`\u003c/span\u003e\nwill not.\n", "secret": true }, "secretKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe AWS Secret Access Key to use when generating new credentials. This is a write-only field and will not be read back from Vault.", "secret": true }, "secretKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" secretKeyWo \" pulumi-lang-dotnet=\" SecretKeyWo \" pulumi-lang-go=\" secretKeyWo \" pulumi-lang-python=\" secret_key_wo \" pulumi-lang-yaml=\" secretKeyWo \" pulumi-lang-java=\" secretKeyWo \" pulumi-lang-hcl=\" secret_key_wo \"\u003e secretKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update to the secret_key." }, "stsEndpoint": { "type": "string", "description": "Specifies a custom HTTP STS endpoint to use.\n" }, "stsFallbackEndpoints": { "type": "array", "items": { "type": "string" }, "description": "Ordered list of \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003es to try if the defined one fails. Requires Vault 1.19+\n" }, "stsFallbackRegions": { "type": "array", "items": { "type": "string" }, "description": "Ordered list of \u003cspan pulumi-lang-nodejs=\"`stsRegion`\" pulumi-lang-dotnet=\"`StsRegion`\" pulumi-lang-go=\"`stsRegion`\" pulumi-lang-python=\"`sts_region`\" pulumi-lang-yaml=\"`stsRegion`\" pulumi-lang-java=\"`stsRegion`\" pulumi-lang-hcl=\"`sts_region`\"\u003e`stsRegion`\u003c/span\u003es matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+\n" }, "stsRegion": { "type": "string", "description": "Specifies the region of the STS endpoint. Should be included if \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003e is supplied. Requires Vault 1.19+\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:\n\n```\n{{ if (eq .Type \"STS\") }}\n{{ printf \"vault-%s-%s\" (unix_time) (random 20) | truncate 32 }}\n{{ else }}\n{{ printf \"vault-%s-%s-%s\" (printf \"%s-%s\" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}\n{{ end }}\n\n```\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "accessKey": { "type": "string", "description": "The AWS Access Key ID this backend should use to\nissue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.\n", "secret": true }, "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "iamEndpoint": { "type": "string", "description": "Specifies a custom HTTP IAM endpoint to use.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value. Requires Vault 1.16+.\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds. Requires Vault 1.16+.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Specifies if the secret backend is local only", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "maxRetries": { "type": "integer", "description": "Number of max retries the client should use for recoverable errors.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "region": { "type": "string", "description": "The AWS region for API calls. Defaults to `us-east-1`.\n\n\u003e **Important** The same limitation noted above for the \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e parameter\nalso applies to the \u003cspan pulumi-lang-nodejs=\"`region`\" pulumi-lang-dotnet=\"`Region`\" pulumi-lang-go=\"`region`\" pulumi-lang-python=\"`region`\" pulumi-lang-yaml=\"`region`\" pulumi-lang-java=\"`region`\" pulumi-lang-hcl=\"`region`\"\u003e`region`\u003c/span\u003e parameter. Vault versions 1.2.3 and older will not\nallow Terraform to detect (and thus correct) drift in the \u003cspan pulumi-lang-nodejs=\"`region`\" pulumi-lang-dotnet=\"`Region`\" pulumi-lang-go=\"`region`\" pulumi-lang-python=\"`region`\" pulumi-lang-yaml=\"`region`\" pulumi-lang-java=\"`region`\" pulumi-lang-hcl=\"`region`\"\u003e`region`\u003c/span\u003e parameter,\nwhile newer versions of Vault will.\n" }, "roleArn": { "type": "string", "description": "Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential. \nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "secretKey": { "type": "string", "description": "The AWS Secret Key this backend should use to\nissue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials. Conflicts with \u003cspan pulumi-lang-nodejs=\"`secretKeyWo`\" pulumi-lang-dotnet=\"`SecretKeyWo`\" pulumi-lang-go=\"`secretKeyWo`\" pulumi-lang-python=\"`secret_key_wo`\" pulumi-lang-yaml=\"`secretKeyWo`\" pulumi-lang-java=\"`secretKeyWo`\" pulumi-lang-hcl=\"`secret_key_wo`\"\u003e`secretKeyWo`\u003c/span\u003e.\n\n\u003e **Important** Vault version 1.2.3 and older does not support reading the configured\ncredentials back from the API, With these older versions, Terraform cannot detect and correct drift\non \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`secretKey`\" pulumi-lang-dotnet=\"`SecretKey`\" pulumi-lang-go=\"`secretKey`\" pulumi-lang-python=\"`secret_key`\" pulumi-lang-yaml=\"`secretKey`\" pulumi-lang-java=\"`secretKey`\" pulumi-lang-hcl=\"`secret_key`\"\u003e`secretKey`\u003c/span\u003e. Changing the values, however, _will_\noverwrite the previously stored values. With versions of Vault newer than\n1.2.3, reading the \u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e only is supported, and so drifts of the\n\u003cspan pulumi-lang-nodejs=\"`accessKey`\" pulumi-lang-dotnet=\"`AccessKey`\" pulumi-lang-go=\"`accessKey`\" pulumi-lang-python=\"`access_key`\" pulumi-lang-yaml=\"`accessKey`\" pulumi-lang-java=\"`accessKey`\" pulumi-lang-hcl=\"`access_key`\"\u003e`accessKey`\u003c/span\u003e will be detected and corrected, but drifts on the \u003cspan pulumi-lang-nodejs=\"`secretKey`\" pulumi-lang-dotnet=\"`SecretKey`\" pulumi-lang-go=\"`secretKey`\" pulumi-lang-python=\"`secret_key`\" pulumi-lang-yaml=\"`secretKey`\" pulumi-lang-java=\"`secretKey`\" pulumi-lang-hcl=\"`secret_key`\"\u003e`secretKey`\u003c/span\u003e\nwill not.\n", "secret": true }, "secretKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe AWS Secret Access Key to use when generating new credentials. This is a write-only field and will not be read back from Vault.", "secret": true }, "secretKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" secretKeyWo \" pulumi-lang-dotnet=\" SecretKeyWo \" pulumi-lang-go=\" secretKeyWo \" pulumi-lang-python=\" secret_key_wo \" pulumi-lang-yaml=\" secretKeyWo \" pulumi-lang-java=\" secretKeyWo \" pulumi-lang-hcl=\" secret_key_wo \"\u003e secretKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update to the secret_key." }, "stsEndpoint": { "type": "string", "description": "Specifies a custom HTTP STS endpoint to use.\n" }, "stsFallbackEndpoints": { "type": "array", "items": { "type": "string" }, "description": "Ordered list of \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003es to try if the defined one fails. Requires Vault 1.19+\n" }, "stsFallbackRegions": { "type": "array", "items": { "type": "string" }, "description": "Ordered list of \u003cspan pulumi-lang-nodejs=\"`stsRegion`\" pulumi-lang-dotnet=\"`StsRegion`\" pulumi-lang-go=\"`stsRegion`\" pulumi-lang-python=\"`sts_region`\" pulumi-lang-yaml=\"`stsRegion`\" pulumi-lang-java=\"`stsRegion`\" pulumi-lang-hcl=\"`sts_region`\"\u003e`stsRegion`\u003c/span\u003es matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+\n" }, "stsRegion": { "type": "string", "description": "Specifies the region of the STS endpoint. Should be included if \u003cspan pulumi-lang-nodejs=\"`stsEndpoint`\" pulumi-lang-dotnet=\"`StsEndpoint`\" pulumi-lang-go=\"`stsEndpoint`\" pulumi-lang-python=\"`sts_endpoint`\" pulumi-lang-yaml=\"`stsEndpoint`\" pulumi-lang-java=\"`stsEndpoint`\" pulumi-lang-hcl=\"`sts_endpoint`\"\u003e`stsEndpoint`\u003c/span\u003e is supplied. Requires Vault 1.19+\n" }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:\n\n```\n{{ if (eq .Type \"STS\") }}\n{{ printf \"vault-%s-%s\" (unix_time) (random 20) | truncate 32 }}\n{{ else }}\n{{ printf \"vault-%s-%s-%s\" (printf \"%s-%s\" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}\n{{ end }}\n\n```\n" } }, "type": "object" } }, "vault:aws/secretBackendRole:SecretBackendRole": { "description": "Creates a role on an AWS Secret Backend for Vault. Roles are\nused to map credentials to the policies that generated them.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.aws.SecretBackend(\"aws\", {\n accessKey: \"AKIA.....\",\n secretKey: \"AWS secret key\",\n});\nconst role = new vault.aws.SecretBackendRole(\"role\", {\n backend: aws.path,\n name: \"deploy\",\n credentialType: \"iam_user\",\n policyDocument: `{\n \\\\\"Version\\\\\": \\\\\"2012-10-17\\\\\",\n \\\\\"Statement\\\\\": [\n {\n \\\\\"Effect\\\\\": \\\\\"Allow\\\\\",\n \\\\\"Action\\\\\": \\\\\"iam:*\\\\\",\n \\\\\"Resource\\\\\": \\\\\"*\\\\\"\n }\n ]\n}\n`,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.aws.SecretBackend(\"aws\",\n access_key=\"AKIA.....\",\n secret_key=\"AWS secret key\")\nrole = vault.aws.SecretBackendRole(\"role\",\n backend=aws.path,\n name=\"deploy\",\n credential_type=\"iam_user\",\n policy_document=\"\"\"{\n \\\"Version\\\": \\\"2012-10-17\\\",\n \\\"Statement\\\": [\n {\n \\\"Effect\\\": \\\"Allow\\\",\n \\\"Action\\\": \\\"iam:*\\\",\n \\\"Resource\\\": \\\"*\\\"\n }\n ]\n}\n\"\"\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.Aws.SecretBackend(\"aws\", new()\n {\n AccessKey = \"AKIA.....\",\n SecretKey = \"AWS secret key\",\n });\n\n var role = new Vault.Aws.SecretBackendRole(\"role\", new()\n {\n Backend = aws.Path,\n Name = \"deploy\",\n CredentialType = \"iam_user\",\n PolicyDocument = @\"{\n \\\"\"Version\\\"\": \\\"\"2012-10-17\\\"\",\n \\\"\"Statement\\\"\": [\n {\n \\\"\"Effect\\\"\": \\\"\"Allow\\\"\",\n \\\"\"Action\\\"\": \\\"\"iam:*\\\"\",\n \\\"\"Resource\\\"\": \\\"\"*\\\"\"\n }\n ]\n}\n\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\taws2, err := aws.NewSecretBackend(ctx, \"aws\", \u0026aws.SecretBackendArgs{\n\t\t\tAccessKey: pulumi.String(\"AKIA.....\"),\n\t\t\tSecretKey: pulumi.String(\"AWS secret key\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewSecretBackendRole(ctx, \"role\", \u0026aws.SecretBackendRoleArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tName: pulumi.String(\"deploy\"),\n\t\t\tCredentialType: pulumi.String(\"iam_user\"),\n\t\t\tPolicyDocument: pulumi.String(`{\n \\\"Version\\\": \\\"2012-10-17\\\",\n \\\"Statement\\\": [\n {\n \\\"Effect\\\": \\\"Allow\\\",\n \\\"Action\\\": \\\"iam:*\\\",\n \\\"Resource\\\": \\\"*\\\"\n }\n ]\n}\n`),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_aws_secretbackend\" \"aws\" {\n access_key = \"AKIA.....\"\n secret_key = \"AWS secret key\"\n}\nresource \"vault_aws_secretbackendrole\" \"role\" {\n backend = vault_aws_secretbackend.aws.path\n name = \"deploy\"\n credential_type = \"iam_user\"\n policy_document = \"{\\n \\\\\\\"Version\\\\\\\": \\\\\\\"2012-10-17\\\\\\\",\\n \\\\\\\"Statement\\\\\\\": [\\n {\\n \\\\\\\"Effect\\\\\\\": \\\\\\\"Allow\\\\\\\",\\n \\\\\\\"Action\\\\\\\": \\\\\\\"iam:*\\\\\\\",\\n \\\\\\\"Resource\\\\\\\": \\\\\\\"*\\\\\\\"\\n }\\n ]\\n}\\n\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.aws.SecretBackend;\nimport com.pulumi.vault.aws.SecretBackendArgs;\nimport com.pulumi.vault.aws.SecretBackendRole;\nimport com.pulumi.vault.aws.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new SecretBackend(\"aws\", SecretBackendArgs.builder()\n .accessKey(\"AKIA.....\")\n .secretKey(\"AWS secret key\")\n .build());\n\n var role = new SecretBackendRole(\"role\", SecretBackendRoleArgs.builder()\n .backend(aws.path())\n .name(\"deploy\")\n .credentialType(\"iam_user\")\n .policyDocument(\"\"\"\n{\n \\\"Version\\\": \\\"2012-10-17\\\",\n \\\"Statement\\\": [\n {\n \\\"Effect\\\": \\\"Allow\\\",\n \\\"Action\\\": \\\"iam:*\\\",\n \\\"Resource\\\": \\\"*\\\"\n }\n ]\n}\n \"\"\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:aws:SecretBackend\n properties:\n accessKey: AKIA.....\n secretKey: AWS secret key\n role:\n type: vault:aws:SecretBackendRole\n properties:\n backend: ${aws.path}\n name: deploy\n credentialType: iam_user\n policyDocument: |\n {\n \\\"Version\\\": \\\"2012-10-17\\\",\n \\\"Statement\\\": [\n {\n \\\"Effect\\\": \\\"Allow\\\",\n \\\"Action\\\": \\\"iam:*\\\",\n \\\"Resource\\\": \\\"*\\\"\n }\n ]\n }\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAWS secret backend roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:aws/secretBackendRole:SecretBackendRole role aws/roles/deploy\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the AWS secret backend is mounted at,\nwith no leading or trailing `/`s.\n" }, "credentialType": { "type": "string", "description": "Specifies the type of credential to be used when\nretrieving credentials from the role. Must be one of \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e, or\n\u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e.\n" }, "defaultStsTtl": { "type": "integer", "description": "The default TTL in seconds for STS credentials.\nWhen a TTL is not specified when STS credentials are requested,\nand a default TTL is specified on the role,\nthen this default TTL will be used. Valid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is one of\n\u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e.\n" }, "externalId": { "type": "string", "description": "External ID to set for assume role creds. \nValid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e.\n" }, "iamGroups": { "type": "array", "items": { "type": "string" }, "description": "A list of IAM group names. IAM users generated\nagainst this vault role will be added to these IAM Groups. For a credential\ntype of \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, the policies sent to the\ncorresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the\npolicies from each group in \u003cspan pulumi-lang-nodejs=\"`iamGroups`\" pulumi-lang-dotnet=\"`IamGroups`\" pulumi-lang-go=\"`iamGroups`\" pulumi-lang-python=\"`iam_groups`\" pulumi-lang-yaml=\"`iamGroups`\" pulumi-lang-java=\"`iamGroups`\" pulumi-lang-hcl=\"`iam_groups`\"\u003e`iamGroups`\u003c/span\u003e combined with the \u003cspan pulumi-lang-nodejs=\"`policyDocument`\" pulumi-lang-dotnet=\"`PolicyDocument`\" pulumi-lang-go=\"`policyDocument`\" pulumi-lang-python=\"`policy_document`\" pulumi-lang-yaml=\"`policyDocument`\" pulumi-lang-java=\"`policyDocument`\" pulumi-lang-hcl=\"`policy_document`\"\u003e`policyDocument`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`policyArns`\" pulumi-lang-dotnet=\"`PolicyArns`\" pulumi-lang-go=\"`policyArns`\" pulumi-lang-python=\"`policy_arns`\" pulumi-lang-yaml=\"`policyArns`\" pulumi-lang-java=\"`policyArns`\" pulumi-lang-hcl=\"`policy_arns`\"\u003e`policyArns`\u003c/span\u003e parameters.\n" }, "iamTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of strings representing key/value pairs\nto be used as tags for any IAM user that is created by this role.\n" }, "maxStsTtl": { "type": "integer", "description": "The max allowed TTL in seconds for STS credentials\n(credentials TTL are capped to \u003cspan pulumi-lang-nodejs=\"`maxStsTtl`\" pulumi-lang-dotnet=\"`MaxStsTtl`\" pulumi-lang-go=\"`maxStsTtl`\" pulumi-lang-python=\"`max_sts_ttl`\" pulumi-lang-yaml=\"`maxStsTtl`\" pulumi-lang-java=\"`maxStsTtl`\" pulumi-lang-hcl=\"`max_sts_ttl`\"\u003e`maxStsTtl`\u003c/span\u003e). Valid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is\none of \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e.\n" }, "mfaSerialNumber": { "type": "string", "description": "The ARN or hardware device number of the device configured to the IAM user for multi-factor authentication. Only required if the IAM user has an MFA device set up in AWS.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "permissionsBoundaryArn": { "type": "string", "description": "The ARN of the AWS Permissions \nBoundary to attach to IAM users created in the role. Valid only when\n\u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e. If not specified, then no permissions boundary\npolicy will be attached.\n" }, "policyArns": { "type": "array", "items": { "type": "string" }, "description": "Specifies a list of AWS managed policy ARNs. The\nbehavior depends on the credential type. With \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e, the policies will be\nattached to IAM users when they are requested. With \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, the policy ARNs will act as a filter on what the credentials\ncan do, similar to \u003cspan pulumi-lang-nodejs=\"`policyDocument`\" pulumi-lang-dotnet=\"`PolicyDocument`\" pulumi-lang-go=\"`policyDocument`\" pulumi-lang-python=\"`policy_document`\" pulumi-lang-yaml=\"`policyDocument`\" pulumi-lang-java=\"`policyDocument`\" pulumi-lang-hcl=\"`policy_document`\"\u003e`policyDocument`\u003c/span\u003e. When \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, at least one of \u003cspan pulumi-lang-nodejs=\"`policyDocument`\" pulumi-lang-dotnet=\"`PolicyDocument`\" pulumi-lang-go=\"`policyDocument`\" pulumi-lang-python=\"`policy_document`\" pulumi-lang-yaml=\"`policyDocument`\" pulumi-lang-java=\"`policyDocument`\" pulumi-lang-hcl=\"`policy_document`\"\u003e`policyDocument`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`policyArns`\" pulumi-lang-dotnet=\"`PolicyArns`\" pulumi-lang-go=\"`policyArns`\" pulumi-lang-python=\"`policy_arns`\" pulumi-lang-yaml=\"`policyArns`\" pulumi-lang-java=\"`policyArns`\" pulumi-lang-hcl=\"`policy_arns`\"\u003e`policyArns`\u003c/span\u003e must\nbe specified.\n" }, "policyDocument": { "type": "string", "description": "The IAM policy document for the role. The\nbehavior depends on the credential type. With \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e, the policy document\nwill be attached to the IAM user generated and augment the permissions the IAM\nuser has. With \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, the policy document will\nact as a filter on what the credentials can do, similar to \u003cspan pulumi-lang-nodejs=\"`policyArns`\" pulumi-lang-dotnet=\"`PolicyArns`\" pulumi-lang-go=\"`policyArns`\" pulumi-lang-python=\"`policy_arns`\" pulumi-lang-yaml=\"`policyArns`\" pulumi-lang-java=\"`policyArns`\" pulumi-lang-hcl=\"`policy_arns`\"\u003e`policyArns`\u003c/span\u003e.\n" }, "roleArns": { "type": "array", "items": { "type": "string" }, "description": "Specifies the ARNs of the AWS roles this Vault role\nis allowed to assume. Required when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e and\nprohibited otherwise.\n" }, "sessionTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of strings representing key/value pairs to be set\nduring assume role creds creation. Valid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is set to\n\u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e.\n" }, "userPath": { "type": "string", "description": "The path for the user name. Valid only when \n\u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e. Default is `/`.\n" } }, "required": [ "backend", "credentialType", "defaultStsTtl", "maxStsTtl", "name" ], "inputProperties": { "backend": { "type": "string", "description": "The path the AWS secret backend is mounted at,\nwith no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "credentialType": { "type": "string", "description": "Specifies the type of credential to be used when\nretrieving credentials from the role. Must be one of \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e, or\n\u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e.\n" }, "defaultStsTtl": { "type": "integer", "description": "The default TTL in seconds for STS credentials.\nWhen a TTL is not specified when STS credentials are requested,\nand a default TTL is specified on the role,\nthen this default TTL will be used. Valid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is one of\n\u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e.\n" }, "externalId": { "type": "string", "description": "External ID to set for assume role creds. \nValid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e.\n" }, "iamGroups": { "type": "array", "items": { "type": "string" }, "description": "A list of IAM group names. IAM users generated\nagainst this vault role will be added to these IAM Groups. For a credential\ntype of \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, the policies sent to the\ncorresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the\npolicies from each group in \u003cspan pulumi-lang-nodejs=\"`iamGroups`\" pulumi-lang-dotnet=\"`IamGroups`\" pulumi-lang-go=\"`iamGroups`\" pulumi-lang-python=\"`iam_groups`\" pulumi-lang-yaml=\"`iamGroups`\" pulumi-lang-java=\"`iamGroups`\" pulumi-lang-hcl=\"`iam_groups`\"\u003e`iamGroups`\u003c/span\u003e combined with the \u003cspan pulumi-lang-nodejs=\"`policyDocument`\" pulumi-lang-dotnet=\"`PolicyDocument`\" pulumi-lang-go=\"`policyDocument`\" pulumi-lang-python=\"`policy_document`\" pulumi-lang-yaml=\"`policyDocument`\" pulumi-lang-java=\"`policyDocument`\" pulumi-lang-hcl=\"`policy_document`\"\u003e`policyDocument`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`policyArns`\" pulumi-lang-dotnet=\"`PolicyArns`\" pulumi-lang-go=\"`policyArns`\" pulumi-lang-python=\"`policy_arns`\" pulumi-lang-yaml=\"`policyArns`\" pulumi-lang-java=\"`policyArns`\" pulumi-lang-hcl=\"`policy_arns`\"\u003e`policyArns`\u003c/span\u003e parameters.\n" }, "iamTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of strings representing key/value pairs\nto be used as tags for any IAM user that is created by this role.\n" }, "maxStsTtl": { "type": "integer", "description": "The max allowed TTL in seconds for STS credentials\n(credentials TTL are capped to \u003cspan pulumi-lang-nodejs=\"`maxStsTtl`\" pulumi-lang-dotnet=\"`MaxStsTtl`\" pulumi-lang-go=\"`maxStsTtl`\" pulumi-lang-python=\"`max_sts_ttl`\" pulumi-lang-yaml=\"`maxStsTtl`\" pulumi-lang-java=\"`maxStsTtl`\" pulumi-lang-hcl=\"`max_sts_ttl`\"\u003e`maxStsTtl`\u003c/span\u003e). Valid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is\none of \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e.\n" }, "mfaSerialNumber": { "type": "string", "description": "The ARN or hardware device number of the device configured to the IAM user for multi-factor authentication. Only required if the IAM user has an MFA device set up in AWS.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "permissionsBoundaryArn": { "type": "string", "description": "The ARN of the AWS Permissions \nBoundary to attach to IAM users created in the role. Valid only when\n\u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e. If not specified, then no permissions boundary\npolicy will be attached.\n" }, "policyArns": { "type": "array", "items": { "type": "string" }, "description": "Specifies a list of AWS managed policy ARNs. The\nbehavior depends on the credential type. With \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e, the policies will be\nattached to IAM users when they are requested. With \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, the policy ARNs will act as a filter on what the credentials\ncan do, similar to \u003cspan pulumi-lang-nodejs=\"`policyDocument`\" pulumi-lang-dotnet=\"`PolicyDocument`\" pulumi-lang-go=\"`policyDocument`\" pulumi-lang-python=\"`policy_document`\" pulumi-lang-yaml=\"`policyDocument`\" pulumi-lang-java=\"`policyDocument`\" pulumi-lang-hcl=\"`policy_document`\"\u003e`policyDocument`\u003c/span\u003e. When \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, at least one of \u003cspan pulumi-lang-nodejs=\"`policyDocument`\" pulumi-lang-dotnet=\"`PolicyDocument`\" pulumi-lang-go=\"`policyDocument`\" pulumi-lang-python=\"`policy_document`\" pulumi-lang-yaml=\"`policyDocument`\" pulumi-lang-java=\"`policyDocument`\" pulumi-lang-hcl=\"`policy_document`\"\u003e`policyDocument`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`policyArns`\" pulumi-lang-dotnet=\"`PolicyArns`\" pulumi-lang-go=\"`policyArns`\" pulumi-lang-python=\"`policy_arns`\" pulumi-lang-yaml=\"`policyArns`\" pulumi-lang-java=\"`policyArns`\" pulumi-lang-hcl=\"`policy_arns`\"\u003e`policyArns`\u003c/span\u003e must\nbe specified.\n" }, "policyDocument": { "type": "string", "description": "The IAM policy document for the role. The\nbehavior depends on the credential type. With \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e, the policy document\nwill be attached to the IAM user generated and augment the permissions the IAM\nuser has. With \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, the policy document will\nact as a filter on what the credentials can do, similar to \u003cspan pulumi-lang-nodejs=\"`policyArns`\" pulumi-lang-dotnet=\"`PolicyArns`\" pulumi-lang-go=\"`policyArns`\" pulumi-lang-python=\"`policy_arns`\" pulumi-lang-yaml=\"`policyArns`\" pulumi-lang-java=\"`policyArns`\" pulumi-lang-hcl=\"`policy_arns`\"\u003e`policyArns`\u003c/span\u003e.\n" }, "roleArns": { "type": "array", "items": { "type": "string" }, "description": "Specifies the ARNs of the AWS roles this Vault role\nis allowed to assume. Required when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e and\nprohibited otherwise.\n", "willReplaceOnChanges": true }, "sessionTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of strings representing key/value pairs to be set\nduring assume role creds creation. Valid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is set to\n\u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e.\n" }, "userPath": { "type": "string", "description": "The path for the user name. Valid only when \n\u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e. Default is `/`.\n" } }, "requiredInputs": [ "backend", "credentialType" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRole resources.\n", "properties": { "backend": { "type": "string", "description": "The path the AWS secret backend is mounted at,\nwith no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "credentialType": { "type": "string", "description": "Specifies the type of credential to be used when\nretrieving credentials from the role. Must be one of \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e, or\n\u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e.\n" }, "defaultStsTtl": { "type": "integer", "description": "The default TTL in seconds for STS credentials.\nWhen a TTL is not specified when STS credentials are requested,\nand a default TTL is specified on the role,\nthen this default TTL will be used. Valid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is one of\n\u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e.\n" }, "externalId": { "type": "string", "description": "External ID to set for assume role creds. \nValid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e.\n" }, "iamGroups": { "type": "array", "items": { "type": "string" }, "description": "A list of IAM group names. IAM users generated\nagainst this vault role will be added to these IAM Groups. For a credential\ntype of \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, the policies sent to the\ncorresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the\npolicies from each group in \u003cspan pulumi-lang-nodejs=\"`iamGroups`\" pulumi-lang-dotnet=\"`IamGroups`\" pulumi-lang-go=\"`iamGroups`\" pulumi-lang-python=\"`iam_groups`\" pulumi-lang-yaml=\"`iamGroups`\" pulumi-lang-java=\"`iamGroups`\" pulumi-lang-hcl=\"`iam_groups`\"\u003e`iamGroups`\u003c/span\u003e combined with the \u003cspan pulumi-lang-nodejs=\"`policyDocument`\" pulumi-lang-dotnet=\"`PolicyDocument`\" pulumi-lang-go=\"`policyDocument`\" pulumi-lang-python=\"`policy_document`\" pulumi-lang-yaml=\"`policyDocument`\" pulumi-lang-java=\"`policyDocument`\" pulumi-lang-hcl=\"`policy_document`\"\u003e`policyDocument`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`policyArns`\" pulumi-lang-dotnet=\"`PolicyArns`\" pulumi-lang-go=\"`policyArns`\" pulumi-lang-python=\"`policy_arns`\" pulumi-lang-yaml=\"`policyArns`\" pulumi-lang-java=\"`policyArns`\" pulumi-lang-hcl=\"`policy_arns`\"\u003e`policyArns`\u003c/span\u003e parameters.\n" }, "iamTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of strings representing key/value pairs\nto be used as tags for any IAM user that is created by this role.\n" }, "maxStsTtl": { "type": "integer", "description": "The max allowed TTL in seconds for STS credentials\n(credentials TTL are capped to \u003cspan pulumi-lang-nodejs=\"`maxStsTtl`\" pulumi-lang-dotnet=\"`MaxStsTtl`\" pulumi-lang-go=\"`maxStsTtl`\" pulumi-lang-python=\"`max_sts_ttl`\" pulumi-lang-yaml=\"`maxStsTtl`\" pulumi-lang-java=\"`maxStsTtl`\" pulumi-lang-hcl=\"`max_sts_ttl`\"\u003e`maxStsTtl`\u003c/span\u003e). Valid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is\none of \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e.\n" }, "mfaSerialNumber": { "type": "string", "description": "The ARN or hardware device number of the device configured to the IAM user for multi-factor authentication. Only required if the IAM user has an MFA device set up in AWS.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "permissionsBoundaryArn": { "type": "string", "description": "The ARN of the AWS Permissions \nBoundary to attach to IAM users created in the role. Valid only when\n\u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e. If not specified, then no permissions boundary\npolicy will be attached.\n" }, "policyArns": { "type": "array", "items": { "type": "string" }, "description": "Specifies a list of AWS managed policy ARNs. The\nbehavior depends on the credential type. With \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e, the policies will be\nattached to IAM users when they are requested. With \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, the policy ARNs will act as a filter on what the credentials\ncan do, similar to \u003cspan pulumi-lang-nodejs=\"`policyDocument`\" pulumi-lang-dotnet=\"`PolicyDocument`\" pulumi-lang-go=\"`policyDocument`\" pulumi-lang-python=\"`policy_document`\" pulumi-lang-yaml=\"`policyDocument`\" pulumi-lang-java=\"`policyDocument`\" pulumi-lang-hcl=\"`policy_document`\"\u003e`policyDocument`\u003c/span\u003e. When \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e or\n\u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, at least one of \u003cspan pulumi-lang-nodejs=\"`policyDocument`\" pulumi-lang-dotnet=\"`PolicyDocument`\" pulumi-lang-go=\"`policyDocument`\" pulumi-lang-python=\"`policy_document`\" pulumi-lang-yaml=\"`policyDocument`\" pulumi-lang-java=\"`policyDocument`\" pulumi-lang-hcl=\"`policy_document`\"\u003e`policyDocument`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`policyArns`\" pulumi-lang-dotnet=\"`PolicyArns`\" pulumi-lang-go=\"`policyArns`\" pulumi-lang-python=\"`policy_arns`\" pulumi-lang-yaml=\"`policyArns`\" pulumi-lang-java=\"`policyArns`\" pulumi-lang-hcl=\"`policy_arns`\"\u003e`policyArns`\u003c/span\u003e must\nbe specified.\n" }, "policyDocument": { "type": "string", "description": "The IAM policy document for the role. The\nbehavior depends on the credential type. With \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e, the policy document\nwill be attached to the IAM user generated and augment the permissions the IAM\nuser has. With \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`federationToken`\" pulumi-lang-dotnet=\"`FederationToken`\" pulumi-lang-go=\"`federationToken`\" pulumi-lang-python=\"`federation_token`\" pulumi-lang-yaml=\"`federationToken`\" pulumi-lang-java=\"`federationToken`\" pulumi-lang-hcl=\"`federation_token`\"\u003e`federationToken`\u003c/span\u003e, the policy document will\nact as a filter on what the credentials can do, similar to \u003cspan pulumi-lang-nodejs=\"`policyArns`\" pulumi-lang-dotnet=\"`PolicyArns`\" pulumi-lang-go=\"`policyArns`\" pulumi-lang-python=\"`policy_arns`\" pulumi-lang-yaml=\"`policyArns`\" pulumi-lang-java=\"`policyArns`\" pulumi-lang-hcl=\"`policy_arns`\"\u003e`policyArns`\u003c/span\u003e.\n" }, "roleArns": { "type": "array", "items": { "type": "string" }, "description": "Specifies the ARNs of the AWS roles this Vault role\nis allowed to assume. Required when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e and\nprohibited otherwise.\n", "willReplaceOnChanges": true }, "sessionTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of strings representing key/value pairs to be set\nduring assume role creds creation. Valid only when \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is set to\n\u003cspan pulumi-lang-nodejs=\"`assumedRole`\" pulumi-lang-dotnet=\"`AssumedRole`\" pulumi-lang-go=\"`assumedRole`\" pulumi-lang-python=\"`assumed_role`\" pulumi-lang-yaml=\"`assumedRole`\" pulumi-lang-java=\"`assumedRole`\" pulumi-lang-hcl=\"`assumed_role`\"\u003e`assumedRole`\u003c/span\u003e.\n" }, "userPath": { "type": "string", "description": "The path for the user name. Valid only when \n\u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`iamUser`\" pulumi-lang-dotnet=\"`IamUser`\" pulumi-lang-go=\"`iamUser`\" pulumi-lang-python=\"`iam_user`\" pulumi-lang-yaml=\"`iamUser`\" pulumi-lang-java=\"`iamUser`\" pulumi-lang-hcl=\"`iam_user`\"\u003e`iamUser`\u003c/span\u003e. Default is `/`.\n" } }, "type": "object" } }, "vault:aws/secretBackendStaticRole:SecretBackendStaticRole": { "description": "Creates a static role for AWS Secret Backend for Vault.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.aws.SecretBackend(\"aws\", {\n path: \"my-aws\",\n description: \"Obtain AWS credentials.\",\n});\nconst role = new vault.aws.SecretBackendStaticRole(\"role\", {\n backend: aws.path,\n name: \"test\",\n username: \"my-test-user\",\n rotationPeriod: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.aws.SecretBackend(\"aws\",\n path=\"my-aws\",\n description=\"Obtain AWS credentials.\")\nrole = vault.aws.SecretBackendStaticRole(\"role\",\n backend=aws.path,\n name=\"test\",\n username=\"my-test-user\",\n rotation_period=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.Aws.SecretBackend(\"aws\", new()\n {\n Path = \"my-aws\",\n Description = \"Obtain AWS credentials.\",\n });\n\n var role = new Vault.Aws.SecretBackendStaticRole(\"role\", new()\n {\n Backend = aws.Path,\n Name = \"test\",\n Username = \"my-test-user\",\n RotationPeriod = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\taws2, err := aws.NewSecretBackend(ctx, \"aws\", \u0026aws.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"my-aws\"),\n\t\t\tDescription: pulumi.String(\"Obtain AWS credentials.\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewSecretBackendStaticRole(ctx, \"role\", \u0026aws.SecretBackendStaticRoleArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tName: pulumi.String(\"test\"),\n\t\t\tUsername: pulumi.String(\"my-test-user\"),\n\t\t\tRotationPeriod: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_aws_secretbackend\" \"aws\" {\n path = \"my-aws\"\n description = \"Obtain AWS credentials.\"\n}\nresource \"vault_aws_secretbackendstaticrole\" \"role\" {\n backend = vault_aws_secretbackend.aws.path\n name = \"test\"\n username = \"my-test-user\"\n rotation_period = \"3600\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.aws.SecretBackend;\nimport com.pulumi.vault.aws.SecretBackendArgs;\nimport com.pulumi.vault.aws.SecretBackendStaticRole;\nimport com.pulumi.vault.aws.SecretBackendStaticRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new SecretBackend(\"aws\", SecretBackendArgs.builder()\n .path(\"my-aws\")\n .description(\"Obtain AWS credentials.\")\n .build());\n\n var role = new SecretBackendStaticRole(\"role\", SecretBackendStaticRoleArgs.builder()\n .backend(aws.path())\n .name(\"test\")\n .username(\"my-test-user\")\n .rotationPeriod(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:aws:SecretBackend\n properties:\n path: my-aws\n description: Obtain AWS credentials.\n role:\n type: vault:aws:SecretBackendStaticRole\n properties:\n backend: ${aws.path}\n name: test\n username: my-test-user\n rotationPeriod: '3600'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.aws.SecretBackend(\"aws\", {\n path: \"my-aws\",\n description: \"Obtain AWS credentials.\",\n});\nconst assume_role = new vault.aws.SecretBackendStaticRole(\"assume-role\", {\n backend: aws.path,\n name: \"assume-role-test\",\n username: \"my-assume-role-user\",\n assumeRoleArn: \"arn:aws:iam::123456789012:role/assume-role\",\n assumeRoleSessionName: \"assume-role-session\",\n externalId: \"test-id\",\n rotationPeriod: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.aws.SecretBackend(\"aws\",\n path=\"my-aws\",\n description=\"Obtain AWS credentials.\")\nassume_role = vault.aws.SecretBackendStaticRole(\"assume-role\",\n backend=aws.path,\n name=\"assume-role-test\",\n username=\"my-assume-role-user\",\n assume_role_arn=\"arn:aws:iam::123456789012:role/assume-role\",\n assume_role_session_name=\"assume-role-session\",\n external_id=\"test-id\",\n rotation_period=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.Aws.SecretBackend(\"aws\", new()\n {\n Path = \"my-aws\",\n Description = \"Obtain AWS credentials.\",\n });\n\n var assume_role = new Vault.Aws.SecretBackendStaticRole(\"assume-role\", new()\n {\n Backend = aws.Path,\n Name = \"assume-role-test\",\n Username = \"my-assume-role-user\",\n AssumeRoleArn = \"arn:aws:iam::123456789012:role/assume-role\",\n AssumeRoleSessionName = \"assume-role-session\",\n ExternalId = \"test-id\",\n RotationPeriod = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/aws\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\taws2, err := aws.NewSecretBackend(ctx, \"aws\", \u0026aws.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"my-aws\"),\n\t\t\tDescription: pulumi.String(\"Obtain AWS credentials.\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = aws.NewSecretBackendStaticRole(ctx, \"assume-role\", \u0026aws.SecretBackendStaticRoleArgs{\n\t\t\tBackend: aws2.Path,\n\t\t\tName: pulumi.String(\"assume-role-test\"),\n\t\t\tUsername: pulumi.String(\"my-assume-role-user\"),\n\t\t\tAssumeRoleArn: pulumi.String(\"arn:aws:iam::123456789012:role/assume-role\"),\n\t\t\tAssumeRoleSessionName: pulumi.String(\"assume-role-session\"),\n\t\t\tExternalId: pulumi.String(\"test-id\"),\n\t\t\tRotationPeriod: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_aws_secretbackend\" \"aws\" {\n path = \"my-aws\"\n description = \"Obtain AWS credentials.\"\n}\nresource \"vault_aws_secretbackendstaticrole\" \"assume-role\" {\n backend = vault_aws_secretbackend.aws.path\n name = \"assume-role-test\"\n username = \"my-assume-role-user\"\n assume_role_arn = \"arn:aws:iam::123456789012:role/assume-role\"\n assume_role_session_name = \"assume-role-session\"\n external_id = \"test-id\"\n rotation_period = \"3600\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.aws.SecretBackend;\nimport com.pulumi.vault.aws.SecretBackendArgs;\nimport com.pulumi.vault.aws.SecretBackendStaticRole;\nimport com.pulumi.vault.aws.SecretBackendStaticRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new SecretBackend(\"aws\", SecretBackendArgs.builder()\n .path(\"my-aws\")\n .description(\"Obtain AWS credentials.\")\n .build());\n\n var assume_role = new SecretBackendStaticRole(\"assume-role\", SecretBackendStaticRoleArgs.builder()\n .backend(aws.path())\n .name(\"assume-role-test\")\n .username(\"my-assume-role-user\")\n .assumeRoleArn(\"arn:aws:iam::123456789012:role/assume-role\")\n .assumeRoleSessionName(\"assume-role-session\")\n .externalId(\"test-id\")\n .rotationPeriod(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:aws:SecretBackend\n properties:\n path: my-aws\n description: Obtain AWS credentials.\n assume-role:\n type: vault:aws:SecretBackendStaticRole\n properties:\n backend: ${aws.path}\n name: assume-role-test\n username: my-assume-role-user\n assumeRoleArn: arn:aws:iam::123456789012:role/assume-role\n assumeRoleSessionName: assume-role-session\n externalId: test-id\n rotationPeriod: '3600'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAWS secret backend static role can be imported using the full path to the role\nof the form: `\u003cmount_path\u003e/static-roles/\u003crole_name\u003e` e.g.\n\n```sh\n$ pulumi import vault:aws/secretBackendStaticRole:SecretBackendStaticRole role aws/static-roles/example-role\n```\n\n", "properties": { "assumeRoleArn": { "type": "string", "description": "Specifies the ARN of the role that Vault should assume.\nWhen provided, Vault will use AWS STS to assume this role and generate temporary credentials.\nIf \u003cspan pulumi-lang-nodejs=\"`assumeRoleArn`\" pulumi-lang-dotnet=\"`AssumeRoleArn`\" pulumi-lang-go=\"`assumeRoleArn`\" pulumi-lang-python=\"`assume_role_arn`\" pulumi-lang-yaml=\"`assumeRoleArn`\" pulumi-lang-java=\"`assumeRoleArn`\" pulumi-lang-hcl=\"`assume_role_arn`\"\u003e`assumeRoleArn`\u003c/span\u003e is provided, \u003cspan pulumi-lang-nodejs=\"`assumeRoleSessionName`\" pulumi-lang-dotnet=\"`AssumeRoleSessionName`\" pulumi-lang-go=\"`assumeRoleSessionName`\" pulumi-lang-python=\"`assume_role_session_name`\" pulumi-lang-yaml=\"`assumeRoleSessionName`\" pulumi-lang-java=\"`assumeRoleSessionName`\" pulumi-lang-hcl=\"`assume_role_session_name`\"\u003e`assumeRoleSessionName`\u003c/span\u003e must also be provided.\nRequires Vault 1.19+. *Available only for Vault Enterprise*.\n" }, "assumeRoleSessionName": { "type": "string", "description": "Specifies the session name to use when assuming the role.\nIf \u003cspan pulumi-lang-nodejs=\"`assumeRoleSessionName`\" pulumi-lang-dotnet=\"`AssumeRoleSessionName`\" pulumi-lang-go=\"`assumeRoleSessionName`\" pulumi-lang-python=\"`assume_role_session_name`\" pulumi-lang-yaml=\"`assumeRoleSessionName`\" pulumi-lang-java=\"`assumeRoleSessionName`\" pulumi-lang-hcl=\"`assume_role_session_name`\"\u003e`assumeRoleSessionName`\u003c/span\u003e is provided, \u003cspan pulumi-lang-nodejs=\"`assumeRoleArn`\" pulumi-lang-dotnet=\"`AssumeRoleArn`\" pulumi-lang-go=\"`assumeRoleArn`\" pulumi-lang-python=\"`assume_role_arn`\" pulumi-lang-yaml=\"`assumeRoleArn`\" pulumi-lang-java=\"`assumeRoleArn`\" pulumi-lang-hcl=\"`assume_role_arn`\"\u003e`assumeRoleArn`\u003c/span\u003e must also be provided.\nRequires Vault 1.19+. *Available only for Vault Enterprise*.\n" }, "backend": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e\n" }, "externalId": { "type": "string", "description": "Specifies the external ID to use when assuming the role.\nRequires Vault 1.19+. *Available only for Vault Enterprise*.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "rotationPeriod": { "type": "integer", "description": "How often Vault should rotate the password of the user entry.\n" }, "username": { "type": "string", "description": "The username of the existing AWS IAM to manage password rotation for.\n" } }, "required": [ "name", "rotationPeriod", "username" ], "inputProperties": { "assumeRoleArn": { "type": "string", "description": "Specifies the ARN of the role that Vault should assume.\nWhen provided, Vault will use AWS STS to assume this role and generate temporary credentials.\nIf \u003cspan pulumi-lang-nodejs=\"`assumeRoleArn`\" pulumi-lang-dotnet=\"`AssumeRoleArn`\" pulumi-lang-go=\"`assumeRoleArn`\" pulumi-lang-python=\"`assume_role_arn`\" pulumi-lang-yaml=\"`assumeRoleArn`\" pulumi-lang-java=\"`assumeRoleArn`\" pulumi-lang-hcl=\"`assume_role_arn`\"\u003e`assumeRoleArn`\u003c/span\u003e is provided, \u003cspan pulumi-lang-nodejs=\"`assumeRoleSessionName`\" pulumi-lang-dotnet=\"`AssumeRoleSessionName`\" pulumi-lang-go=\"`assumeRoleSessionName`\" pulumi-lang-python=\"`assume_role_session_name`\" pulumi-lang-yaml=\"`assumeRoleSessionName`\" pulumi-lang-java=\"`assumeRoleSessionName`\" pulumi-lang-hcl=\"`assume_role_session_name`\"\u003e`assumeRoleSessionName`\u003c/span\u003e must also be provided.\nRequires Vault 1.19+. *Available only for Vault Enterprise*.\n" }, "assumeRoleSessionName": { "type": "string", "description": "Specifies the session name to use when assuming the role.\nIf \u003cspan pulumi-lang-nodejs=\"`assumeRoleSessionName`\" pulumi-lang-dotnet=\"`AssumeRoleSessionName`\" pulumi-lang-go=\"`assumeRoleSessionName`\" pulumi-lang-python=\"`assume_role_session_name`\" pulumi-lang-yaml=\"`assumeRoleSessionName`\" pulumi-lang-java=\"`assumeRoleSessionName`\" pulumi-lang-hcl=\"`assume_role_session_name`\"\u003e`assumeRoleSessionName`\u003c/span\u003e is provided, \u003cspan pulumi-lang-nodejs=\"`assumeRoleArn`\" pulumi-lang-dotnet=\"`AssumeRoleArn`\" pulumi-lang-go=\"`assumeRoleArn`\" pulumi-lang-python=\"`assume_role_arn`\" pulumi-lang-yaml=\"`assumeRoleArn`\" pulumi-lang-java=\"`assumeRoleArn`\" pulumi-lang-hcl=\"`assume_role_arn`\"\u003e`assumeRoleArn`\u003c/span\u003e must also be provided.\nRequires Vault 1.19+. *Available only for Vault Enterprise*.\n" }, "backend": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e\n" }, "externalId": { "type": "string", "description": "Specifies the external ID to use when assuming the role.\nRequires Vault 1.19+. *Available only for Vault Enterprise*.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "rotationPeriod": { "type": "integer", "description": "How often Vault should rotate the password of the user entry.\n" }, "username": { "type": "string", "description": "The username of the existing AWS IAM to manage password rotation for.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "rotationPeriod", "username" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendStaticRole resources.\n", "properties": { "assumeRoleArn": { "type": "string", "description": "Specifies the ARN of the role that Vault should assume.\nWhen provided, Vault will use AWS STS to assume this role and generate temporary credentials.\nIf \u003cspan pulumi-lang-nodejs=\"`assumeRoleArn`\" pulumi-lang-dotnet=\"`AssumeRoleArn`\" pulumi-lang-go=\"`assumeRoleArn`\" pulumi-lang-python=\"`assume_role_arn`\" pulumi-lang-yaml=\"`assumeRoleArn`\" pulumi-lang-java=\"`assumeRoleArn`\" pulumi-lang-hcl=\"`assume_role_arn`\"\u003e`assumeRoleArn`\u003c/span\u003e is provided, \u003cspan pulumi-lang-nodejs=\"`assumeRoleSessionName`\" pulumi-lang-dotnet=\"`AssumeRoleSessionName`\" pulumi-lang-go=\"`assumeRoleSessionName`\" pulumi-lang-python=\"`assume_role_session_name`\" pulumi-lang-yaml=\"`assumeRoleSessionName`\" pulumi-lang-java=\"`assumeRoleSessionName`\" pulumi-lang-hcl=\"`assume_role_session_name`\"\u003e`assumeRoleSessionName`\u003c/span\u003e must also be provided.\nRequires Vault 1.19+. *Available only for Vault Enterprise*.\n" }, "assumeRoleSessionName": { "type": "string", "description": "Specifies the session name to use when assuming the role.\nIf \u003cspan pulumi-lang-nodejs=\"`assumeRoleSessionName`\" pulumi-lang-dotnet=\"`AssumeRoleSessionName`\" pulumi-lang-go=\"`assumeRoleSessionName`\" pulumi-lang-python=\"`assume_role_session_name`\" pulumi-lang-yaml=\"`assumeRoleSessionName`\" pulumi-lang-java=\"`assumeRoleSessionName`\" pulumi-lang-hcl=\"`assume_role_session_name`\"\u003e`assumeRoleSessionName`\u003c/span\u003e is provided, \u003cspan pulumi-lang-nodejs=\"`assumeRoleArn`\" pulumi-lang-dotnet=\"`AssumeRoleArn`\" pulumi-lang-go=\"`assumeRoleArn`\" pulumi-lang-python=\"`assume_role_arn`\" pulumi-lang-yaml=\"`assumeRoleArn`\" pulumi-lang-java=\"`assumeRoleArn`\" pulumi-lang-hcl=\"`assume_role_arn`\"\u003e`assumeRoleArn`\u003c/span\u003e must also be provided.\nRequires Vault 1.19+. *Available only for Vault Enterprise*.\n" }, "backend": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`aws`\" pulumi-lang-dotnet=\"`Aws`\" pulumi-lang-go=\"`aws`\" pulumi-lang-python=\"`aws`\" pulumi-lang-yaml=\"`aws`\" pulumi-lang-java=\"`aws`\" pulumi-lang-hcl=\"`aws`\"\u003e`aws`\u003c/span\u003e\n" }, "externalId": { "type": "string", "description": "Specifies the external ID to use when assuming the role.\nRequires Vault 1.19+. *Available only for Vault Enterprise*.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "rotationPeriod": { "type": "integer", "description": "How often Vault should rotate the password of the user entry.\n" }, "username": { "type": "string", "description": "The username of the existing AWS IAM to manage password rotation for.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:azure/authBackendConfig:AuthBackendConfig": { "description": "Configures the Azure Auth Backend in Vault.\n\nThis resource sets the access key and secret key that Vault will use\nwhen making API requests on behalf of an Azure Auth Backend. It can also\nbe used to override the URLs Vault uses when making those API requests.\n\nFor more information, see the\n[Vault docs](https://www.vaultproject.io/api-docs/auth/azure#configure).\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\nYou can setup the Azure auth engine with Workload Identity Federation (WIF) for a secret-less configuration:\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.AuthBackend(\"example\", {\n type: \"azure\",\n identityTokenKey: \"example-key\",\n});\nconst exampleAuthBackendConfig = new vault.azure.AuthBackendConfig(\"example\", {\n backend: example.path,\n tenantId: \"11111111-2222-3333-4444-555555555555\",\n clientId: \"11111111-2222-3333-4444-555555555555\",\n identityTokenAudience: \"\u003cTOKEN_AUDIENCE\u003e\",\n identityTokenTtl: Number(\"\u003cTOKEN_TTL\u003e\"),\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.AuthBackend(\"example\",\n type=\"azure\",\n identity_token_key=\"example-key\")\nexample_auth_backend_config = vault.azure.AuthBackendConfig(\"example\",\n backend=example.path,\n tenant_id=\"11111111-2222-3333-4444-555555555555\",\n client_id=\"11111111-2222-3333-4444-555555555555\",\n identity_token_audience=\"\u003cTOKEN_AUDIENCE\u003e\",\n identity_token_ttl=int(\"\u003cTOKEN_TTL\u003e\"),\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.AuthBackend(\"example\", new()\n {\n Type = \"azure\",\n IdentityTokenKey = \"example-key\",\n });\n\n var exampleAuthBackendConfig = new Vault.Azure.AuthBackendConfig(\"example\", new()\n {\n Backend = example.Path,\n TenantId = \"11111111-2222-3333-4444-555555555555\",\n ClientId = \"11111111-2222-3333-4444-555555555555\",\n IdentityTokenAudience = \"\u003cTOKEN_AUDIENCE\u003e\",\n IdentityTokenTtl = \"\u003cTOKEN_TTL\u003e\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewAuthBackend(ctx, \"example\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"azure\"),\n\t\t\tIdentityTokenKey: pulumi.String(\"example-key\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = azure.NewAuthBackendConfig(ctx, \"example\", \u0026azure.AuthBackendConfigArgs{\n\t\t\tBackend: example.Path,\n\t\t\tTenantId: pulumi.String(\"11111111-2222-3333-4444-555555555555\"),\n\t\t\tClientId: pulumi.String(\"11111111-2222-3333-4444-555555555555\"),\n\t\t\tIdentityTokenAudience: pulumi.String(\"\u003cTOKEN_AUDIENCE\u003e\"),\n\t\t\tIdentityTokenTtl: pulumi.Int(\"\u003cTOKEN_TTL\u003e\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"example\" {\n type = \"azure\"\n identity_token_key = \"example-key\"\n}\nresource \"vault_azure_authbackendconfig\" \"example\" {\n backend = vault_authbackend.example.path\n tenant_id = \"11111111-2222-3333-4444-555555555555\"\n client_id = \"11111111-2222-3333-4444-555555555555\"\n identity_token_audience = \"\u003cTOKEN_AUDIENCE\u003e\"\n identity_token_ttl = \"\u003cTOKEN_TTL\u003e\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.azure.AuthBackendConfig;\nimport com.pulumi.vault.azure.AuthBackendConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .type(\"azure\")\n .identityTokenKey(\"example-key\")\n .build());\n\n var exampleAuthBackendConfig = new AuthBackendConfig(\"exampleAuthBackendConfig\", AuthBackendConfigArgs.builder()\n .backend(example.path())\n .tenantId(\"11111111-2222-3333-4444-555555555555\")\n .clientId(\"11111111-2222-3333-4444-555555555555\")\n .identityTokenAudience(\"\u003cTOKEN_AUDIENCE\u003e\")\n .identityTokenTtl(\"\u003cTOKEN_TTL\u003e\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:AuthBackend\n properties:\n type: azure\n identityTokenKey: example-key\n exampleAuthBackendConfig:\n type: vault:azure:AuthBackendConfig\n name: example\n properties:\n backend: ${example.path}\n tenantId: 11111111-2222-3333-4444-555555555555\n clientId: 11111111-2222-3333-4444-555555555555\n identityTokenAudience: \u003cTOKEN_AUDIENCE\u003e\n identityTokenTtl: \u003cTOKEN_TTL\u003e\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.AuthBackend(\"example\", {type: \"azure\"});\nconst exampleAuthBackendConfig = new vault.azure.AuthBackendConfig(\"example\", {\n backend: example.path,\n tenantId: \"11111111-2222-3333-4444-555555555555\",\n clientId: \"11111111-2222-3333-4444-555555555555\",\n clientSecret: \"01234567890123456789\",\n resource: \"https://vault.hashicorp.com\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.AuthBackend(\"example\", type=\"azure\")\nexample_auth_backend_config = vault.azure.AuthBackendConfig(\"example\",\n backend=example.path,\n tenant_id=\"11111111-2222-3333-4444-555555555555\",\n client_id=\"11111111-2222-3333-4444-555555555555\",\n client_secret=\"01234567890123456789\",\n resource=\"https://vault.hashicorp.com\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.AuthBackend(\"example\", new()\n {\n Type = \"azure\",\n });\n\n var exampleAuthBackendConfig = new Vault.Azure.AuthBackendConfig(\"example\", new()\n {\n Backend = example.Path,\n TenantId = \"11111111-2222-3333-4444-555555555555\",\n ClientId = \"11111111-2222-3333-4444-555555555555\",\n ClientSecret = \"01234567890123456789\",\n Resource = \"https://vault.hashicorp.com\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewAuthBackend(ctx, \"example\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"azure\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = azure.NewAuthBackendConfig(ctx, \"example\", \u0026azure.AuthBackendConfigArgs{\n\t\t\tBackend: example.Path,\n\t\t\tTenantId: pulumi.String(\"11111111-2222-3333-4444-555555555555\"),\n\t\t\tClientId: pulumi.String(\"11111111-2222-3333-4444-555555555555\"),\n\t\t\tClientSecret: pulumi.String(\"01234567890123456789\"),\n\t\t\tResource: pulumi.String(\"https://vault.hashicorp.com\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"example\" {\n type = \"azure\"\n}\nresource \"vault_azure_authbackendconfig\" \"example\" {\n backend = vault_authbackend.example.path\n tenant_id = \"11111111-2222-3333-4444-555555555555\"\n client_id = \"11111111-2222-3333-4444-555555555555\"\n client_secret = \"01234567890123456789\"\n resource = \"https://vault.hashicorp.com\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.azure.AuthBackendConfig;\nimport com.pulumi.vault.azure.AuthBackendConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .type(\"azure\")\n .build());\n\n var exampleAuthBackendConfig = new AuthBackendConfig(\"exampleAuthBackendConfig\", AuthBackendConfigArgs.builder()\n .backend(example.path())\n .tenantId(\"11111111-2222-3333-4444-555555555555\")\n .clientId(\"11111111-2222-3333-4444-555555555555\")\n .clientSecret(\"01234567890123456789\")\n .resource(\"https://vault.hashicorp.com\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:AuthBackend\n properties:\n type: azure\n exampleAuthBackendConfig:\n type: vault:azure:AuthBackendConfig\n name: example\n properties:\n backend: ${example.path}\n tenantId: 11111111-2222-3333-4444-555555555555\n clientId: 11111111-2222-3333-4444-555555555555\n clientSecret: '01234567890123456789'\n resource: https://vault.hashicorp.com\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nYou can use the write-only fields to prevent the client secret from being stored in Terraform state:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.AuthBackend(\"example\", {type: \"azure\"});\nconst exampleAuthBackendConfig = new vault.azure.AuthBackendConfig(\"example\", {\n backend: example.path,\n tenantId: \"11111111-2222-3333-4444-555555555555\",\n clientId: \"11111111-2222-3333-4444-555555555555\",\n clientSecretWo: azureClientSecret,\n clientSecretWoVersion: 1,\n resource: \"https://vault.hashicorp.com\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.AuthBackend(\"example\", type=\"azure\")\nexample_auth_backend_config = vault.azure.AuthBackendConfig(\"example\",\n backend=example.path,\n tenant_id=\"11111111-2222-3333-4444-555555555555\",\n client_id=\"11111111-2222-3333-4444-555555555555\",\n client_secret_wo=azure_client_secret,\n client_secret_wo_version=1,\n resource=\"https://vault.hashicorp.com\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.AuthBackend(\"example\", new()\n {\n Type = \"azure\",\n });\n\n var exampleAuthBackendConfig = new Vault.Azure.AuthBackendConfig(\"example\", new()\n {\n Backend = example.Path,\n TenantId = \"11111111-2222-3333-4444-555555555555\",\n ClientId = \"11111111-2222-3333-4444-555555555555\",\n ClientSecretWo = azureClientSecret,\n ClientSecretWoVersion = 1,\n Resource = \"https://vault.hashicorp.com\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewAuthBackend(ctx, \"example\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"azure\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = azure.NewAuthBackendConfig(ctx, \"example\", \u0026azure.AuthBackendConfigArgs{\n\t\t\tBackend: example.Path,\n\t\t\tTenantId: pulumi.String(\"11111111-2222-3333-4444-555555555555\"),\n\t\t\tClientId: pulumi.String(\"11111111-2222-3333-4444-555555555555\"),\n\t\t\tClientSecretWo: pulumi.Any(azureClientSecret),\n\t\t\tClientSecretWoVersion: pulumi.Int(1),\n\t\t\tResource: pulumi.String(\"https://vault.hashicorp.com\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"example\" {\n type = \"azure\"\n}\nresource \"vault_azure_authbackendconfig\" \"example\" {\n backend = vault_authbackend.example.path\n tenant_id = \"11111111-2222-3333-4444-555555555555\"\n client_id = \"11111111-2222-3333-4444-555555555555\"\n client_secret_wo = azureClientSecret\n client_secret_wo_version = 1 # Increment to rotate\n resource = \"https://vault.hashicorp.com\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.azure.AuthBackendConfig;\nimport com.pulumi.vault.azure.AuthBackendConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .type(\"azure\")\n .build());\n\n var exampleAuthBackendConfig = new AuthBackendConfig(\"exampleAuthBackendConfig\", AuthBackendConfigArgs.builder()\n .backend(example.path())\n .tenantId(\"11111111-2222-3333-4444-555555555555\")\n .clientId(\"11111111-2222-3333-4444-555555555555\")\n .clientSecretWo(azureClientSecret)\n .clientSecretWoVersion(1)\n .resource(\"https://vault.hashicorp.com\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:AuthBackend\n properties:\n type: azure\n exampleAuthBackendConfig:\n type: vault:azure:AuthBackendConfig\n name: example\n properties:\n backend: ${example.path}\n tenantId: 11111111-2222-3333-4444-555555555555\n clientId: 11111111-2222-3333-4444-555555555555\n clientSecretWo: ${azureClientSecret}\n clientSecretWoVersion: 1 # Increment to rotate\n resource: https://vault.hashicorp.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e - (Optional) The client secret for credentials to query the Azure APIs,\n\tprovided as a write-only field. This value will **never** be stored in Terraform state.\n\tMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`clientSecret`\" pulumi-lang-dotnet=\"`ClientSecret`\" pulumi-lang-go=\"`clientSecret`\" pulumi-lang-python=\"`client_secret`\" pulumi-lang-yaml=\"`clientSecret`\" pulumi-lang-java=\"`clientSecret`\" pulumi-lang-hcl=\"`client_secret`\"\u003e`clientSecret`\u003c/span\u003e. Must be used with \u003cspan pulumi-lang-nodejs=\"`clientSecretWoVersion`\" pulumi-lang-dotnet=\"`ClientSecretWoVersion`\" pulumi-lang-go=\"`clientSecretWoVersion`\" pulumi-lang-python=\"`client_secret_wo_version`\" pulumi-lang-yaml=\"`clientSecretWoVersion`\" pulumi-lang-java=\"`clientSecretWoVersion`\" pulumi-lang-hcl=\"`client_secret_wo_version`\"\u003e`clientSecretWoVersion`\u003c/span\u003e.\n\tTo rotate the secret, update the value and increment \u003cspan pulumi-lang-nodejs=\"`clientSecretWoVersion`\" pulumi-lang-dotnet=\"`ClientSecretWoVersion`\" pulumi-lang-go=\"`clientSecretWoVersion`\" pulumi-lang-python=\"`client_secret_wo_version`\" pulumi-lang-yaml=\"`clientSecretWoVersion`\" pulumi-lang-java=\"`clientSecretWoVersion`\" pulumi-lang-hcl=\"`client_secret_wo_version`\"\u003e`clientSecretWoVersion`\u003c/span\u003e.\n\n## Import\n\nAzure auth backends can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e path, and `/config` e.g.\n\n```sh\n$ pulumi import vault:azure/authBackendConfig:AuthBackendConfig example auth/azure/config\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the Azure auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`azure`\" pulumi-lang-dotnet=\"`Azure`\" pulumi-lang-go=\"`azure`\" pulumi-lang-python=\"`azure`\" pulumi-lang-yaml=\"`azure`\" pulumi-lang-java=\"`azure`\" pulumi-lang-hcl=\"`azure`\"\u003e`azure`\u003c/span\u003e.\n" }, "clientId": { "type": "string", "description": "The client id for credentials to query the Azure APIs.\nCurrently read permissions to query compute resources are required.\n", "secret": true }, "clientSecret": { "type": "string", "description": "The client secret for credentials to query the\nAzure APIs. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e. **Note:** This field will be\nstored in Terraform state. Consider using \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "clientSecretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe client secret for credentials to query the Azure APIs. This field is write-only and will never be stored in state. Mutually exclusive with 'client_secret'. Requires 'client_secret_wo_version' to trigger updates.", "secret": true }, "clientSecretWoVersion": { "type": "integer", "description": "Version counter for the write-only client secret.\nIncrement this value to trigger an update of the client secret in Vault.\nRequired when using \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "environment": { "type": "string", "description": "The Azure cloud environment. Valid values:\nAzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud,\nAzureGermanCloud. Defaults to `AzurePublicCloud`.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value for plugin identity tokens. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds.\nDefaults to 1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).\nRequires Vault 1.17+. *Available only for Vault Enterprise*\n" }, "maxRetries": { "type": "integer", "description": "Maximum number of retries for Azure API requests. \nDefaults to \u003cspan pulumi-lang-nodejs=\"`3`\" pulumi-lang-dotnet=\"`3`\" pulumi-lang-go=\"`3`\" pulumi-lang-python=\"`3`\" pulumi-lang-yaml=\"`3`\" pulumi-lang-java=\"`3`\" pulumi-lang-hcl=\"`3`\"\u003e`3`\u003c/span\u003e.\n" }, "maxRetryDelay": { "type": "integer", "description": "The maximum delay in seconds between retries for Azure API requests.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "resource": { "type": "string", "description": "The configured URL for the application registered in\nAzure Active Directory.\n" }, "retryDelay": { "type": "integer", "description": "The initial delay in seconds between retries for Azure API requests.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`4`\" pulumi-lang-dotnet=\"`4`\" pulumi-lang-go=\"`4`\" pulumi-lang-python=\"`4`\" pulumi-lang-yaml=\"`4`\" pulumi-lang-java=\"`4`\" pulumi-lang-hcl=\"`4`\"\u003e`4`\u003c/span\u003e.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "tenantId": { "type": "string", "description": "The tenant id for the Azure Active Directory\norganization.\n", "secret": true } }, "required": [ "identityTokenTtl", "resource", "tenantId" ], "inputProperties": { "backend": { "type": "string", "description": "The path the Azure auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`azure`\" pulumi-lang-dotnet=\"`Azure`\" pulumi-lang-go=\"`azure`\" pulumi-lang-python=\"`azure`\" pulumi-lang-yaml=\"`azure`\" pulumi-lang-java=\"`azure`\" pulumi-lang-hcl=\"`azure`\"\u003e`azure`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "clientId": { "type": "string", "description": "The client id for credentials to query the Azure APIs.\nCurrently read permissions to query compute resources are required.\n", "secret": true }, "clientSecret": { "type": "string", "description": "The client secret for credentials to query the\nAzure APIs. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e. **Note:** This field will be\nstored in Terraform state. Consider using \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "clientSecretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe client secret for credentials to query the Azure APIs. This field is write-only and will never be stored in state. Mutually exclusive with 'client_secret'. Requires 'client_secret_wo_version' to trigger updates.", "secret": true }, "clientSecretWoVersion": { "type": "integer", "description": "Version counter for the write-only client secret.\nIncrement this value to trigger an update of the client secret in Vault.\nRequired when using \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "environment": { "type": "string", "description": "The Azure cloud environment. Valid values:\nAzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud,\nAzureGermanCloud. Defaults to `AzurePublicCloud`.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value for plugin identity tokens. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds.\nDefaults to 1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).\nRequires Vault 1.17+. *Available only for Vault Enterprise*\n" }, "maxRetries": { "type": "integer", "description": "Maximum number of retries for Azure API requests. \nDefaults to \u003cspan pulumi-lang-nodejs=\"`3`\" pulumi-lang-dotnet=\"`3`\" pulumi-lang-go=\"`3`\" pulumi-lang-python=\"`3`\" pulumi-lang-yaml=\"`3`\" pulumi-lang-java=\"`3`\" pulumi-lang-hcl=\"`3`\"\u003e`3`\u003c/span\u003e.\n" }, "maxRetryDelay": { "type": "integer", "description": "The maximum delay in seconds between retries for Azure API requests.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "resource": { "type": "string", "description": "The configured URL for the application registered in\nAzure Active Directory.\n" }, "retryDelay": { "type": "integer", "description": "The initial delay in seconds between retries for Azure API requests.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`4`\" pulumi-lang-dotnet=\"`4`\" pulumi-lang-go=\"`4`\" pulumi-lang-python=\"`4`\" pulumi-lang-yaml=\"`4`\" pulumi-lang-java=\"`4`\" pulumi-lang-hcl=\"`4`\"\u003e`4`\u003c/span\u003e.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "tenantId": { "type": "string", "description": "The tenant id for the Azure Active Directory\norganization.\n", "secret": true } }, "requiredInputs": [ "resource", "tenantId" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendConfig resources.\n", "properties": { "backend": { "type": "string", "description": "The path the Azure auth backend being configured was\nmounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`azure`\" pulumi-lang-dotnet=\"`Azure`\" pulumi-lang-go=\"`azure`\" pulumi-lang-python=\"`azure`\" pulumi-lang-yaml=\"`azure`\" pulumi-lang-java=\"`azure`\" pulumi-lang-hcl=\"`azure`\"\u003e`azure`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "clientId": { "type": "string", "description": "The client id for credentials to query the Azure APIs.\nCurrently read permissions to query compute resources are required.\n", "secret": true }, "clientSecret": { "type": "string", "description": "The client secret for credentials to query the\nAzure APIs. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e. **Note:** This field will be\nstored in Terraform state. Consider using \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "clientSecretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe client secret for credentials to query the Azure APIs. This field is write-only and will never be stored in state. Mutually exclusive with 'client_secret'. Requires 'client_secret_wo_version' to trigger updates.", "secret": true }, "clientSecretWoVersion": { "type": "integer", "description": "Version counter for the write-only client secret.\nIncrement this value to trigger an update of the client secret in Vault.\nRequired when using \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "environment": { "type": "string", "description": "The Azure cloud environment. Valid values:\nAzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud,\nAzureGermanCloud. Defaults to `AzurePublicCloud`.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value for plugin identity tokens. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds.\nDefaults to 1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).\nRequires Vault 1.17+. *Available only for Vault Enterprise*\n" }, "maxRetries": { "type": "integer", "description": "Maximum number of retries for Azure API requests. \nDefaults to \u003cspan pulumi-lang-nodejs=\"`3`\" pulumi-lang-dotnet=\"`3`\" pulumi-lang-go=\"`3`\" pulumi-lang-python=\"`3`\" pulumi-lang-yaml=\"`3`\" pulumi-lang-java=\"`3`\" pulumi-lang-hcl=\"`3`\"\u003e`3`\u003c/span\u003e.\n" }, "maxRetryDelay": { "type": "integer", "description": "The maximum delay in seconds between retries for Azure API requests.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "resource": { "type": "string", "description": "The configured URL for the application registered in\nAzure Active Directory.\n" }, "retryDelay": { "type": "integer", "description": "The initial delay in seconds between retries for Azure API requests.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`4`\" pulumi-lang-dotnet=\"`4`\" pulumi-lang-go=\"`4`\" pulumi-lang-python=\"`4`\" pulumi-lang-yaml=\"`4`\" pulumi-lang-java=\"`4`\" pulumi-lang-hcl=\"`4`\"\u003e`4`\u003c/span\u003e.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "tenantId": { "type": "string", "description": "The tenant id for the Azure Active Directory\norganization.\n", "secret": true } }, "type": "object" } }, "vault:azure/authBackendRole:AuthBackendRole": { "description": "Manages an Azure auth backend role in a Vault server. Roles constrain the\ninstances or principals that can perform the login operation against the\nbackend. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/azure.html) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst azure = new vault.AuthBackend(\"azure\", {type: \"azure\"});\nconst example = new vault.azure.AuthBackendRole(\"example\", {\n backend: azure.path,\n role: \"test-role\",\n boundSubscriptionIds: [\"11111111-2222-3333-4444-555555555555\"],\n boundResourceGroups: [\"123456789012\"],\n tokenTtl: 60,\n tokenMaxTtl: 120,\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nazure = vault.AuthBackend(\"azure\", type=\"azure\")\nexample = vault.azure.AuthBackendRole(\"example\",\n backend=azure.path,\n role=\"test-role\",\n bound_subscription_ids=[\"11111111-2222-3333-4444-555555555555\"],\n bound_resource_groups=[\"123456789012\"],\n token_ttl=60,\n token_max_ttl=120,\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var azure = new Vault.AuthBackend(\"azure\", new()\n {\n Type = \"azure\",\n });\n\n var example = new Vault.Azure.AuthBackendRole(\"example\", new()\n {\n Backend = azure.Path,\n Role = \"test-role\",\n BoundSubscriptionIds = new[]\n {\n \"11111111-2222-3333-4444-555555555555\",\n },\n BoundResourceGroups = new[]\n {\n \"123456789012\",\n },\n TokenTtl = 60,\n TokenMaxTtl = 120,\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tazure2, err := vault.NewAuthBackend(ctx, \"azure\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"azure\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = azure.NewAuthBackendRole(ctx, \"example\", \u0026azure.AuthBackendRoleArgs{\n\t\t\tBackend: azure2.Path,\n\t\t\tRole: pulumi.String(\"test-role\"),\n\t\t\tBoundSubscriptionIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"11111111-2222-3333-4444-555555555555\"),\n\t\t\t},\n\t\t\tBoundResourceGroups: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"123456789012\"),\n\t\t\t},\n\t\t\tTokenTtl: pulumi.Int(60),\n\t\t\tTokenMaxTtl: pulumi.Int(120),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"azure\" {\n type = \"azure\"\n}\nresource \"vault_azure_authbackendrole\" \"example\" {\n backend = vault_authbackend.azure.path\n role = \"test-role\"\n bound_subscription_ids = [\"11111111-2222-3333-4444-555555555555\"]\n bound_resource_groups = [\"123456789012\"]\n token_ttl = 60\n token_max_ttl = 120\n token_policies = [\"default\", \"dev\", \"prod\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.azure.AuthBackendRole;\nimport com.pulumi.vault.azure.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var azure = new AuthBackend(\"azure\", AuthBackendArgs.builder()\n .type(\"azure\")\n .build());\n\n var example = new AuthBackendRole(\"example\", AuthBackendRoleArgs.builder()\n .backend(azure.path())\n .role(\"test-role\")\n .boundSubscriptionIds(\"11111111-2222-3333-4444-555555555555\")\n .boundResourceGroups(\"123456789012\")\n .tokenTtl(60)\n .tokenMaxTtl(120)\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n azure:\n type: vault:AuthBackend\n properties:\n type: azure\n example:\n type: vault:azure:AuthBackendRole\n properties:\n backend: ${azure.path}\n role: test-role\n boundSubscriptionIds:\n - 11111111-2222-3333-4444-555555555555\n boundResourceGroups:\n - '123456789012'\n tokenTtl: 60\n tokenMaxTtl: 120\n tokenPolicies:\n - default\n - dev\n - prod\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAzure auth backend roles can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e path, `/role/`, and the \u003cspan pulumi-lang-nodejs=\"`role`\" pulumi-lang-dotnet=\"`Role`\" pulumi-lang-go=\"`role`\" pulumi-lang-python=\"`role`\" pulumi-lang-yaml=\"`role`\" pulumi-lang-java=\"`role`\" pulumi-lang-hcl=\"`role`\"\u003e`role`\u003c/span\u003e name e.g.\n\n```sh\n$ pulumi import vault:azure/authBackendRole:AuthBackendRole example auth/azure/role/test-role\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "backend": { "type": "string", "description": "Unique name of the auth backend to configure." }, "boundGroupIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the groups\nthat can perform the login operation that they should be using the group\nID specified by this field.\n" }, "boundLocations": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the virtual machines\nthat can perform the login operation that the location in their identity\ndocument must match the one specified by this field.\n" }, "boundResourceGroups": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the virtual\nmachines that can perform the login operation that they be associated with\nthe resource group that matches the value specified by this field.\n" }, "boundScaleSets": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the virtual\nmachines that can perform the login operation that they must match the scale set\nspecified by this field.\n" }, "boundServicePrincipalIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the\nservice principals that can perform the login operation that they should be possess\nthe ids specified by this field.\n" }, "boundSubscriptionIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the subscriptions\nthat can perform the login operation to ones which matches the value specified by this\nfield.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "role": { "type": "string", "description": "The name of the role.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "role" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "backend": { "type": "string", "description": "Unique name of the auth backend to configure.", "willReplaceOnChanges": true }, "boundGroupIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the groups\nthat can perform the login operation that they should be using the group\nID specified by this field.\n" }, "boundLocations": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the virtual machines\nthat can perform the login operation that the location in their identity\ndocument must match the one specified by this field.\n" }, "boundResourceGroups": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the virtual\nmachines that can perform the login operation that they be associated with\nthe resource group that matches the value specified by this field.\n" }, "boundScaleSets": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the virtual\nmachines that can perform the login operation that they must match the scale set\nspecified by this field.\n" }, "boundServicePrincipalIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the\nservice principals that can perform the login operation that they should be possess\nthe ids specified by this field.\n" }, "boundSubscriptionIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the subscriptions\nthat can perform the login operation to ones which matches the value specified by this\nfield.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "requiredInputs": [ "role" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "backend": { "type": "string", "description": "Unique name of the auth backend to configure.", "willReplaceOnChanges": true }, "boundGroupIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the groups\nthat can perform the login operation that they should be using the group\nID specified by this field.\n" }, "boundLocations": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the virtual machines\nthat can perform the login operation that the location in their identity\ndocument must match the one specified by this field.\n" }, "boundResourceGroups": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the virtual\nmachines that can perform the login operation that they be associated with\nthe resource group that matches the value specified by this field.\n" }, "boundScaleSets": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the virtual\nmachines that can perform the login operation that they must match the scale set\nspecified by this field.\n" }, "boundServicePrincipalIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the\nservice principals that can perform the login operation that they should be possess\nthe ids specified by this field.\n" }, "boundSubscriptionIds": { "type": "array", "items": { "type": "string" }, "description": "If set, defines a constraint on the subscriptions\nthat can perform the login operation to ones which matches the value specified by this\nfield.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:azure/backend:Backend": { "description": "Creates an Azure Secret Backend for Vault.\n\nThe Azure secrets engine dynamically generates Azure service principals and role assignments. Vault roles can be mapped to one or more Azure roles, providing a simple, flexible way to manage the permissions granted to generated service principals.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n\u003e It is highly recommended that one transition to the Microsoft Graph API.\nSee \u003cspan pulumi-lang-nodejs=\"[useMicrosoftGraphApi \" pulumi-lang-dotnet=\"[UseMicrosoftGraphApi \" pulumi-lang-go=\"[useMicrosoftGraphApi \" pulumi-lang-python=\"[use_microsoft_graph_api \" pulumi-lang-yaml=\"[useMicrosoftGraphApi \" pulumi-lang-java=\"[useMicrosoftGraphApi \" pulumi-lang-hcl=\"[use_microsoft_graph_api \"\u003e[useMicrosoftGraphApi \u003c/span\u003e](https://www.vaultproject.io/api-docs/secret/azure#use_microsoft_graph_api)\nfor more information. The example below demonstrates how to do this. \n\n## Example Usage\n\n### \n\nYou can setup the Azure secrets engine with Workload Identity Federation (WIF) for a secret-less configuration:\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst azure = new vault.azure.Backend(\"azure\", {\n subscriptionId: \"11111111-2222-3333-4444-111111111111\",\n tenantId: \"11111111-2222-3333-4444-222222222222\",\n clientId: \"11111111-2222-3333-4444-333333333333\",\n identityTokenAudience: \"\u003cTOKEN_AUDIENCE\u003e\",\n identityTokenTtl: Number(\"\u003cTOKEN_TTL\u003e\"),\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nazure = vault.azure.Backend(\"azure\",\n subscription_id=\"11111111-2222-3333-4444-111111111111\",\n tenant_id=\"11111111-2222-3333-4444-222222222222\",\n client_id=\"11111111-2222-3333-4444-333333333333\",\n identity_token_audience=\"\u003cTOKEN_AUDIENCE\u003e\",\n identity_token_ttl=int(\"\u003cTOKEN_TTL\u003e\"),\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var azure = new Vault.Azure.Backend(\"azure\", new()\n {\n SubscriptionId = \"11111111-2222-3333-4444-111111111111\",\n TenantId = \"11111111-2222-3333-4444-222222222222\",\n ClientId = \"11111111-2222-3333-4444-333333333333\",\n IdentityTokenAudience = \"\u003cTOKEN_AUDIENCE\u003e\",\n IdentityTokenTtl = \"\u003cTOKEN_TTL\u003e\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := azure.NewBackend(ctx, \"azure\", \u0026azure.BackendArgs{\n\t\t\tSubscriptionId: pulumi.String(\"11111111-2222-3333-4444-111111111111\"),\n\t\t\tTenantId: pulumi.String(\"11111111-2222-3333-4444-222222222222\"),\n\t\t\tClientId: pulumi.String(\"11111111-2222-3333-4444-333333333333\"),\n\t\t\tIdentityTokenAudience: pulumi.String(\"\u003cTOKEN_AUDIENCE\u003e\"),\n\t\t\tIdentityTokenTtl: pulumi.Int(\"\u003cTOKEN_TTL\u003e\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_azure_backend\" \"azure\" {\n subscription_id = \"11111111-2222-3333-4444-111111111111\"\n tenant_id = \"11111111-2222-3333-4444-222222222222\"\n client_id = \"11111111-2222-3333-4444-333333333333\"\n identity_token_audience = \"\u003cTOKEN_AUDIENCE\u003e\"\n identity_token_ttl = \"\u003cTOKEN_TTL\u003e\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.azure.Backend;\nimport com.pulumi.vault.azure.BackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var azure = new Backend(\"azure\", BackendArgs.builder()\n .subscriptionId(\"11111111-2222-3333-4444-111111111111\")\n .tenantId(\"11111111-2222-3333-4444-222222222222\")\n .clientId(\"11111111-2222-3333-4444-333333333333\")\n .identityTokenAudience(\"\u003cTOKEN_AUDIENCE\u003e\")\n .identityTokenTtl(\"\u003cTOKEN_TTL\u003e\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n azure:\n type: vault:azure:Backend\n properties:\n subscriptionId: 11111111-2222-3333-4444-111111111111\n tenantId: 11111111-2222-3333-4444-222222222222\n clientId: 11111111-2222-3333-4444-333333333333\n identityTokenAudience: \u003cTOKEN_AUDIENCE\u003e\n identityTokenTtl: \u003cTOKEN_TTL\u003e\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst azure = new vault.azure.Backend(\"azure\", {\n subscriptionId: \"11111111-2222-3333-4444-111111111111\",\n tenantId: \"11111111-2222-3333-4444-222222222222\",\n clientId: \"11111111-2222-3333-4444-333333333333\",\n clientSecret: \"12345678901234567890\",\n environment: \"AzurePublicCloud\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nazure = vault.azure.Backend(\"azure\",\n subscription_id=\"11111111-2222-3333-4444-111111111111\",\n tenant_id=\"11111111-2222-3333-4444-222222222222\",\n client_id=\"11111111-2222-3333-4444-333333333333\",\n client_secret=\"12345678901234567890\",\n environment=\"AzurePublicCloud\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var azure = new Vault.Azure.Backend(\"azure\", new()\n {\n SubscriptionId = \"11111111-2222-3333-4444-111111111111\",\n TenantId = \"11111111-2222-3333-4444-222222222222\",\n ClientId = \"11111111-2222-3333-4444-333333333333\",\n ClientSecret = \"12345678901234567890\",\n Environment = \"AzurePublicCloud\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := azure.NewBackend(ctx, \"azure\", \u0026azure.BackendArgs{\n\t\t\tSubscriptionId: pulumi.String(\"11111111-2222-3333-4444-111111111111\"),\n\t\t\tTenantId: pulumi.String(\"11111111-2222-3333-4444-222222222222\"),\n\t\t\tClientId: pulumi.String(\"11111111-2222-3333-4444-333333333333\"),\n\t\t\tClientSecret: pulumi.String(\"12345678901234567890\"),\n\t\t\tEnvironment: pulumi.String(\"AzurePublicCloud\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_azure_backend\" \"azure\" {\n subscription_id = \"11111111-2222-3333-4444-111111111111\"\n tenant_id = \"11111111-2222-3333-4444-222222222222\"\n client_id = \"11111111-2222-3333-4444-333333333333\"\n client_secret = \"12345678901234567890\"\n environment = \"AzurePublicCloud\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.azure.Backend;\nimport com.pulumi.vault.azure.BackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var azure = new Backend(\"azure\", BackendArgs.builder()\n .subscriptionId(\"11111111-2222-3333-4444-111111111111\")\n .tenantId(\"11111111-2222-3333-4444-222222222222\")\n .clientId(\"11111111-2222-3333-4444-333333333333\")\n .clientSecret(\"12345678901234567890\")\n .environment(\"AzurePublicCloud\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n azure:\n type: vault:azure:Backend\n properties:\n subscriptionId: 11111111-2222-3333-4444-111111111111\n tenantId: 11111111-2222-3333-4444-222222222222\n clientId: 11111111-2222-3333-4444-333333333333\n clientSecret: '12345678901234567890'\n environment: AzurePublicCloud\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nUsing \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e to configure the client secret as a write-only attribute (requires Terraform 1.11+):\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst azure = new vault.azure.Backend(\"azure\", {\n subscriptionId: \"11111111-2222-3333-4444-111111111111\",\n tenantId: \"11111111-2222-3333-4444-222222222222\",\n clientId: \"11111111-2222-3333-4444-333333333333\",\n clientSecretWo: azureClientSecret,\n clientSecretWoVersion: 1,\n environment: \"AzurePublicCloud\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nazure = vault.azure.Backend(\"azure\",\n subscription_id=\"11111111-2222-3333-4444-111111111111\",\n tenant_id=\"11111111-2222-3333-4444-222222222222\",\n client_id=\"11111111-2222-3333-4444-333333333333\",\n client_secret_wo=azure_client_secret,\n client_secret_wo_version=1,\n environment=\"AzurePublicCloud\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var azure = new Vault.Azure.Backend(\"azure\", new()\n {\n SubscriptionId = \"11111111-2222-3333-4444-111111111111\",\n TenantId = \"11111111-2222-3333-4444-222222222222\",\n ClientId = \"11111111-2222-3333-4444-333333333333\",\n ClientSecretWo = azureClientSecret,\n ClientSecretWoVersion = 1,\n Environment = \"AzurePublicCloud\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := azure.NewBackend(ctx, \"azure\", \u0026azure.BackendArgs{\n\t\t\tSubscriptionId: pulumi.String(\"11111111-2222-3333-4444-111111111111\"),\n\t\t\tTenantId: pulumi.String(\"11111111-2222-3333-4444-222222222222\"),\n\t\t\tClientId: pulumi.String(\"11111111-2222-3333-4444-333333333333\"),\n\t\t\tClientSecretWo: pulumi.Any(azureClientSecret),\n\t\t\tClientSecretWoVersion: pulumi.Int(1),\n\t\t\tEnvironment: pulumi.String(\"AzurePublicCloud\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_azure_backend\" \"azure\" {\n subscription_id = \"11111111-2222-3333-4444-111111111111\"\n tenant_id = \"11111111-2222-3333-4444-222222222222\"\n client_id = \"11111111-2222-3333-4444-333333333333\"\n client_secret_wo = azureClientSecret\n client_secret_wo_version = 1\n environment = \"AzurePublicCloud\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.azure.Backend;\nimport com.pulumi.vault.azure.BackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var azure = new Backend(\"azure\", BackendArgs.builder()\n .subscriptionId(\"11111111-2222-3333-4444-111111111111\")\n .tenantId(\"11111111-2222-3333-4444-222222222222\")\n .clientId(\"11111111-2222-3333-4444-333333333333\")\n .clientSecretWo(azureClientSecret)\n .clientSecretWoVersion(1)\n .environment(\"AzurePublicCloud\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n azure:\n type: vault:azure:Backend\n properties:\n subscriptionId: 11111111-2222-3333-4444-111111111111\n tenantId: 11111111-2222-3333-4444-222222222222\n clientId: 11111111-2222-3333-4444-333333333333\n clientSecretWo: ${azureClientSecret}\n clientSecretWoVersion: 1\n environment: AzurePublicCloud\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThese attributes are write-only and will not be persisted to Terraform state.\nRequires Terraform 1.11+.\n\n* \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e (`string:\"\"`) - The OAuth2 client secret to connect to Azure.\n This is a write-only field and will not be read back from Vault.\n Conflicts with \u003cspan pulumi-lang-nodejs=\"`clientSecret`\" pulumi-lang-dotnet=\"`ClientSecret`\" pulumi-lang-go=\"`clientSecret`\" pulumi-lang-python=\"`client_secret`\" pulumi-lang-yaml=\"`clientSecret`\" pulumi-lang-java=\"`clientSecret`\" pulumi-lang-hcl=\"`client_secret`\"\u003e`clientSecret`\u003c/span\u003e.\n\n* \u003cspan pulumi-lang-nodejs=\"`clientSecretWoVersion`\" pulumi-lang-dotnet=\"`ClientSecretWoVersion`\" pulumi-lang-go=\"`clientSecretWoVersion`\" pulumi-lang-python=\"`client_secret_wo_version`\" pulumi-lang-yaml=\"`clientSecretWoVersion`\" pulumi-lang-java=\"`clientSecretWoVersion`\" pulumi-lang-hcl=\"`client_secret_wo_version`\"\u003e`clientSecretWoVersion`\u003c/span\u003e (`int:0`) - A version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e field.\n Incrementing this value will trigger an update to the client secret.\n Required when using \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e.\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "clientId": { "type": "string", "description": "The OAuth2 client id to connect to Azure.\n", "secret": true }, "clientSecret": { "type": "string", "description": "The OAuth2 client secret to connect to Azure.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e.\n", "secret": true }, "clientSecretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe client secret for credentials to query the Azure APIs. This is a write-only field and will not be read back from Vault.", "secret": true }, "clientSecretWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" clientSecretWo \" pulumi-lang-dotnet=\" ClientSecretWo \" pulumi-lang-go=\" clientSecretWo \" pulumi-lang-python=\" client_secret_wo \" pulumi-lang-yaml=\" clientSecretWo \" pulumi-lang-java=\" clientSecretWo \" pulumi-lang-hcl=\" client_secret_wo \"\u003e clientSecretWo \u003c/span\u003efield. Incrementing this value will trigger an update to the client secret." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "environment": { "type": "string", "description": "The Azure environment.\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenAudience": { "type": "string", "description": "The audience claim value. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`azure`\" pulumi-lang-dotnet=\"`Azure`\" pulumi-lang-go=\"`azure`\" pulumi-lang-python=\"`azure`\" pulumi-lang-yaml=\"`azure`\" pulumi-lang-java=\"`azure`\" pulumi-lang-hcl=\"`azure`\"\u003e`azure`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "rootPasswordTtl": { "type": "integer", "description": "Specifies the TTL of the root password when rotate-root generates a new client secret. Requires Vault 1.15+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "subscriptionId": { "type": "string", "description": "The subscription id for the Azure Active Directory.\n", "secret": true }, "tenantId": { "type": "string", "description": "The tenant id for the Azure Active Directory.\n", "secret": true } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "defaultLeaseTtlSeconds", "forceNoCache", "identityTokenTtl", "maxLeaseTtlSeconds", "rootPasswordTtl", "sealWrap", "subscriptionId", "tenantId" ], "inputProperties": { "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "clientId": { "type": "string", "description": "The OAuth2 client id to connect to Azure.\n", "secret": true }, "clientSecret": { "type": "string", "description": "The OAuth2 client secret to connect to Azure.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e.\n", "secret": true }, "clientSecretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe client secret for credentials to query the Azure APIs. This is a write-only field and will not be read back from Vault.", "secret": true }, "clientSecretWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" clientSecretWo \" pulumi-lang-dotnet=\" ClientSecretWo \" pulumi-lang-go=\" clientSecretWo \" pulumi-lang-python=\" client_secret_wo \" pulumi-lang-yaml=\" clientSecretWo \" pulumi-lang-java=\" clientSecretWo \" pulumi-lang-hcl=\" client_secret_wo \"\u003e clientSecretWo \u003c/span\u003efield. Incrementing this value will trigger an update to the client secret." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "environment": { "type": "string", "description": "The Azure environment.\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenAudience": { "type": "string", "description": "The audience claim value. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`azure`\" pulumi-lang-dotnet=\"`Azure`\" pulumi-lang-go=\"`azure`\" pulumi-lang-python=\"`azure`\" pulumi-lang-yaml=\"`azure`\" pulumi-lang-java=\"`azure`\" pulumi-lang-hcl=\"`azure`\"\u003e`azure`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "rootPasswordTtl": { "type": "integer", "description": "Specifies the TTL of the root password when rotate-root generates a new client secret. Requires Vault 1.15+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "subscriptionId": { "type": "string", "description": "The subscription id for the Azure Active Directory.\n", "secret": true, "willReplaceOnChanges": true }, "tenantId": { "type": "string", "description": "The tenant id for the Azure Active Directory.\n", "secret": true } }, "requiredInputs": [ "subscriptionId", "tenantId" ], "stateInputs": { "description": "Input properties used for looking up and filtering Backend resources.\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "clientId": { "type": "string", "description": "The OAuth2 client id to connect to Azure.\n", "secret": true }, "clientSecret": { "type": "string", "description": "The OAuth2 client secret to connect to Azure.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`clientSecretWo`\" pulumi-lang-dotnet=\"`ClientSecretWo`\" pulumi-lang-go=\"`clientSecretWo`\" pulumi-lang-python=\"`client_secret_wo`\" pulumi-lang-yaml=\"`clientSecretWo`\" pulumi-lang-java=\"`clientSecretWo`\" pulumi-lang-hcl=\"`client_secret_wo`\"\u003e`clientSecretWo`\u003c/span\u003e.\n", "secret": true }, "clientSecretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe client secret for credentials to query the Azure APIs. This is a write-only field and will not be read back from Vault.", "secret": true }, "clientSecretWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" clientSecretWo \" pulumi-lang-dotnet=\" ClientSecretWo \" pulumi-lang-go=\" clientSecretWo \" pulumi-lang-python=\" client_secret_wo \" pulumi-lang-yaml=\" clientSecretWo \" pulumi-lang-java=\" clientSecretWo \" pulumi-lang-hcl=\" client_secret_wo \"\u003e clientSecretWo \u003c/span\u003efield. Incrementing this value will trigger an update to the client secret." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "environment": { "type": "string", "description": "The Azure environment.\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenAudience": { "type": "string", "description": "The audience claim value. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated identity tokens in seconds. Requires Vault 1.17+.\n*Available only for Vault Enterprise*\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Defaults to \u003cspan pulumi-lang-nodejs=\"`azure`\" pulumi-lang-dotnet=\"`Azure`\" pulumi-lang-go=\"`azure`\" pulumi-lang-python=\"`azure`\" pulumi-lang-yaml=\"`azure`\" pulumi-lang-java=\"`azure`\" pulumi-lang-hcl=\"`azure`\"\u003e`azure`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "rootPasswordTtl": { "type": "integer", "description": "Specifies the TTL of the root password when rotate-root generates a new client secret. Requires Vault 1.15+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "subscriptionId": { "type": "string", "description": "The subscription id for the Azure Active Directory.\n", "secret": true, "willReplaceOnChanges": true }, "tenantId": { "type": "string", "description": "The tenant id for the Azure Active Directory.\n", "secret": true } }, "type": "object" } }, "vault:azure/backendRole:BackendRole": { "description": "Creates an Azure Secret Backend Role for Vault.\n\nThe Azure secrets engine dynamically generates Azure service principals and role assignments. Vault roles can be mapped to one or more Azure roles, providing a simple, flexible way to manage the permissions granted to generated service principals.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst azure = new vault.azure.Backend(\"azure\", {\n subscriptionId: subscriptionId,\n tenantId: tenantId,\n clientSecret: clientSecret,\n clientId: clientId,\n});\nconst generatedRole = new vault.azure.BackendRole(\"generated_role\", {\n backend: azure.path,\n role: \"generated_role\",\n signInAudience: \"AzureADMyOrg\",\n tags: [\n \"team:engineering\",\n \"environment:development\",\n ],\n ttl: \"300\",\n maxTtl: \"600\",\n metadata: {\n team: \"test\",\n owner: \"vault\",\n },\n azureRoles: [{\n roleName: \"Reader\",\n scope: `/subscriptions/${subscriptionId}/resourceGroups/azure-vault-group`,\n }],\n});\nconst existingObjectId = new vault.azure.BackendRole(\"existing_object_id\", {\n backend: azure.path,\n role: \"existing_object_id\",\n applicationObjectId: \"11111111-2222-3333-4444-44444444444\",\n ttl: \"300\",\n maxTtl: \"600\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nazure = vault.azure.Backend(\"azure\",\n subscription_id=subscription_id,\n tenant_id=tenant_id,\n client_secret=client_secret,\n client_id=client_id)\ngenerated_role = vault.azure.BackendRole(\"generated_role\",\n backend=azure.path,\n role=\"generated_role\",\n sign_in_audience=\"AzureADMyOrg\",\n tags=[\n \"team:engineering\",\n \"environment:development\",\n ],\n ttl=\"300\",\n max_ttl=\"600\",\n metadata={\n \"team\": \"test\",\n \"owner\": \"vault\",\n },\n azure_roles=[{\n \"role_name\": \"Reader\",\n \"scope\": f\"/subscriptions/{subscription_id}/resourceGroups/azure-vault-group\",\n }])\nexisting_object_id = vault.azure.BackendRole(\"existing_object_id\",\n backend=azure.path,\n role=\"existing_object_id\",\n application_object_id=\"11111111-2222-3333-4444-44444444444\",\n ttl=\"300\",\n max_ttl=\"600\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var azure = new Vault.Azure.Backend(\"azure\", new()\n {\n SubscriptionId = subscriptionId,\n TenantId = tenantId,\n ClientSecret = clientSecret,\n ClientId = clientId,\n });\n\n var generatedRole = new Vault.Azure.BackendRole(\"generated_role\", new()\n {\n Backend = azure.Path,\n Role = \"generated_role\",\n SignInAudience = \"AzureADMyOrg\",\n Tags = new[]\n {\n \"team:engineering\",\n \"environment:development\",\n },\n Ttl = \"300\",\n MaxTtl = \"600\",\n Metadata = \n {\n { \"team\", \"test\" },\n { \"owner\", \"vault\" },\n },\n AzureRoles = new[]\n {\n new Vault.Azure.Inputs.BackendRoleAzureRoleArgs\n {\n RoleName = \"Reader\",\n Scope = $\"/subscriptions/{subscriptionId}/resourceGroups/azure-vault-group\",\n },\n },\n });\n\n var existingObjectId = new Vault.Azure.BackendRole(\"existing_object_id\", new()\n {\n Backend = azure.Path,\n Role = \"existing_object_id\",\n ApplicationObjectId = \"11111111-2222-3333-4444-44444444444\",\n Ttl = \"300\",\n MaxTtl = \"600\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tazure2, err := azure.NewBackend(ctx, \"azure\", \u0026azure.BackendArgs{\n\t\t\tSubscriptionId: pulumi.Any(subscriptionId),\n\t\t\tTenantId: pulumi.Any(tenantId),\n\t\t\tClientSecret: pulumi.Any(clientSecret),\n\t\t\tClientId: pulumi.Any(clientId),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = azure.NewBackendRole(ctx, \"generated_role\", \u0026azure.BackendRoleArgs{\n\t\t\tBackend: azure2.Path,\n\t\t\tRole: pulumi.String(\"generated_role\"),\n\t\t\tSignInAudience: pulumi.String(\"AzureADMyOrg\"),\n\t\t\tTags: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"team:engineering\"),\n\t\t\t\tpulumi.String(\"environment:development\"),\n\t\t\t},\n\t\t\tTtl: pulumi.String(\"300\"),\n\t\t\tMaxTtl: pulumi.String(\"600\"),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"team\": pulumi.String(\"test\"),\n\t\t\t\t\"owner\": pulumi.String(\"vault\"),\n\t\t\t},\n\t\t\tAzureRoles: azure.BackendRoleAzureRoleArray{\n\t\t\t\t\u0026azure.BackendRoleAzureRoleArgs{\n\t\t\t\t\tRoleName: pulumi.String(\"Reader\"),\n\t\t\t\t\tScope: pulumi.Sprintf(\"/subscriptions/%v/resourceGroups/azure-vault-group\", subscriptionId),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = azure.NewBackendRole(ctx, \"existing_object_id\", \u0026azure.BackendRoleArgs{\n\t\t\tBackend: azure2.Path,\n\t\t\tRole: pulumi.String(\"existing_object_id\"),\n\t\t\tApplicationObjectId: pulumi.String(\"11111111-2222-3333-4444-44444444444\"),\n\t\t\tTtl: pulumi.String(\"300\"),\n\t\t\tMaxTtl: pulumi.String(\"600\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_azure_backend\" \"azure\" {\n subscription_id = subscriptionId\n tenant_id = tenantId\n client_secret = clientSecret\n client_id = clientId\n}\nresource \"vault_azure_backendrole\" \"generated_role\" {\n backend = vault_azure_backend.azure.path\n role = \"generated_role\"\n sign_in_audience = \"AzureADMyOrg\"\n tags = [\"team:engineering\", \"environment:development\"]\n ttl = 300\n max_ttl = 600\n metadata = {\n \"team\" = \"test\"\n \"owner\" = \"vault\"\n }\n azure_roles {\n role_name = \"Reader\"\n scope =\"/subscriptions/${subscriptionId}/resourceGroups/azure-vault-group\"\n }\n}\nresource \"vault_azure_backendrole\" \"existing_object_id\" {\n backend = vault_azure_backend.azure.path\n role = \"existing_object_id\"\n application_object_id = \"11111111-2222-3333-4444-44444444444\"\n ttl = 300\n max_ttl = 600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.azure.Backend;\nimport com.pulumi.vault.azure.BackendArgs;\nimport com.pulumi.vault.azure.BackendRole;\nimport com.pulumi.vault.azure.BackendRoleArgs;\nimport com.pulumi.vault.azure.inputs.BackendRoleAzureRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var azure = new Backend(\"azure\", BackendArgs.builder()\n .subscriptionId(subscriptionId)\n .tenantId(tenantId)\n .clientSecret(clientSecret)\n .clientId(clientId)\n .build());\n\n var generatedRole = new BackendRole(\"generatedRole\", BackendRoleArgs.builder()\n .backend(azure.path())\n .role(\"generated_role\")\n .signInAudience(\"AzureADMyOrg\")\n .tags( \n \"team:engineering\",\n \"environment:development\")\n .ttl(\"300\")\n .maxTtl(\"600\")\n .metadata(Map.ofEntries(\n Map.entry(\"team\", \"test\"),\n Map.entry(\"owner\", \"vault\")\n ))\n .azureRoles(BackendRoleAzureRoleArgs.builder()\n .roleName(\"Reader\")\n .scope(String.format(\"/subscriptions/%s/resourceGroups/azure-vault-group\", subscriptionId))\n .build())\n .build());\n\n var existingObjectId = new BackendRole(\"existingObjectId\", BackendRoleArgs.builder()\n .backend(azure.path())\n .role(\"existing_object_id\")\n .applicationObjectId(\"11111111-2222-3333-4444-44444444444\")\n .ttl(\"300\")\n .maxTtl(\"600\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n azure:\n type: vault:azure:Backend\n properties:\n subscriptionId: ${subscriptionId}\n tenantId: ${tenantId}\n clientSecret: ${clientSecret}\n clientId: ${clientId}\n generatedRole:\n type: vault:azure:BackendRole\n name: generated_role\n properties:\n backend: ${azure.path}\n role: generated_role\n signInAudience: AzureADMyOrg\n tags:\n - team:engineering\n - environment:development\n ttl: 300\n maxTtl: 600\n metadata:\n team: test\n owner: vault\n azureRoles:\n - roleName: Reader\n scope: /subscriptions/${subscriptionId}/resourceGroups/azure-vault-group\n existingObjectId:\n type: vault:azure:BackendRole\n name: existing_object_id\n properties:\n backend: ${azure.path}\n role: existing_object_id\n applicationObjectId: 11111111-2222-3333-4444-44444444444\n ttl: 300\n maxTtl: 600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "applicationObjectId": { "type": "string", "description": "Application Object ID for an existing service principal that will\nbe used instead of creating dynamic service principals. If present, \u003cspan pulumi-lang-nodejs=\"`azureRoles`\" pulumi-lang-dotnet=\"`AzureRoles`\" pulumi-lang-go=\"`azureRoles`\" pulumi-lang-python=\"`azure_roles`\" pulumi-lang-yaml=\"`azureRoles`\" pulumi-lang-java=\"`azureRoles`\" pulumi-lang-hcl=\"`azure_roles`\"\u003e`azureRoles`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`permanentlyDelete`\" pulumi-lang-dotnet=\"`PermanentlyDelete`\" pulumi-lang-go=\"`permanentlyDelete`\" pulumi-lang-python=\"`permanently_delete`\" pulumi-lang-yaml=\"`permanentlyDelete`\" pulumi-lang-java=\"`permanentlyDelete`\" pulumi-lang-hcl=\"`permanently_delete`\"\u003e`permanentlyDelete`\u003c/span\u003e will be ignored.\n" }, "azureGroups": { "type": "array", "items": { "$ref": "#/types/vault:azure/BackendRoleAzureGroup:BackendRoleAzureGroup" }, "description": "List of Azure groups to be assigned to the generated service principal.\n" }, "azureRoles": { "type": "array", "items": { "$ref": "#/types/vault:azure/BackendRoleAzureRole:BackendRoleAzureRole" }, "description": "List of Azure roles to be assigned to the generated service principal.\n" }, "backend": { "type": "string", "description": "Path to the mounted Azure auth backend\n" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "explicitMaxTtl": { "type": "string", "description": "Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.\n" }, "maxTtl": { "type": "string", "description": "Specifies the maximum TTL for service principals generated using this role. Accepts time\nsuffixed strings (\"1h\") or an integer number of seconds. Defaults to the system/engine max TTL time.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string key-value pairs that are stored alongside the role and returned with generated\ncredentials.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "permanentlyDelete": { "type": "boolean", "description": "Indicates whether the applications and service principals created by Vault will be permanently\ndeleted when the corresponding leases expire. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. For Vault v1.12+.\n" }, "persistApp": { "type": "boolean", "description": "If set to true, persists the created service principal and application for the lifetime of the role\n" }, "role": { "type": "string", "description": "Name of the Azure role\n" }, "signInAudience": { "type": "string", "description": "Specifies the security principal types that are allowed to sign in to the application.\nValid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.\n" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "A list of Azure tags to attach to an application. Requires Vault 1.16+.\n" }, "ttl": { "type": "string", "description": "Specifies the default TTL for service principals generated using this role.\nAccepts time suffixed strings (\"1h\") or an integer number of seconds. Defaults to the system/engine default TTL time.\n" } }, "required": [ "permanentlyDelete", "role" ], "inputProperties": { "applicationObjectId": { "type": "string", "description": "Application Object ID for an existing service principal that will\nbe used instead of creating dynamic service principals. If present, \u003cspan pulumi-lang-nodejs=\"`azureRoles`\" pulumi-lang-dotnet=\"`AzureRoles`\" pulumi-lang-go=\"`azureRoles`\" pulumi-lang-python=\"`azure_roles`\" pulumi-lang-yaml=\"`azureRoles`\" pulumi-lang-java=\"`azureRoles`\" pulumi-lang-hcl=\"`azure_roles`\"\u003e`azureRoles`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`permanentlyDelete`\" pulumi-lang-dotnet=\"`PermanentlyDelete`\" pulumi-lang-go=\"`permanentlyDelete`\" pulumi-lang-python=\"`permanently_delete`\" pulumi-lang-yaml=\"`permanentlyDelete`\" pulumi-lang-java=\"`permanentlyDelete`\" pulumi-lang-hcl=\"`permanently_delete`\"\u003e`permanentlyDelete`\u003c/span\u003e will be ignored.\n" }, "azureGroups": { "type": "array", "items": { "$ref": "#/types/vault:azure/BackendRoleAzureGroup:BackendRoleAzureGroup" }, "description": "List of Azure groups to be assigned to the generated service principal.\n" }, "azureRoles": { "type": "array", "items": { "$ref": "#/types/vault:azure/BackendRoleAzureRole:BackendRoleAzureRole" }, "description": "List of Azure roles to be assigned to the generated service principal.\n" }, "backend": { "type": "string", "description": "Path to the mounted Azure auth backend\n", "willReplaceOnChanges": true }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "explicitMaxTtl": { "type": "string", "description": "Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.\n" }, "maxTtl": { "type": "string", "description": "Specifies the maximum TTL for service principals generated using this role. Accepts time\nsuffixed strings (\"1h\") or an integer number of seconds. Defaults to the system/engine max TTL time.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string key-value pairs that are stored alongside the role and returned with generated\ncredentials.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "permanentlyDelete": { "type": "boolean", "description": "Indicates whether the applications and service principals created by Vault will be permanently\ndeleted when the corresponding leases expire. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. For Vault v1.12+.\n" }, "persistApp": { "type": "boolean", "description": "If set to true, persists the created service principal and application for the lifetime of the role\n" }, "role": { "type": "string", "description": "Name of the Azure role\n", "willReplaceOnChanges": true }, "signInAudience": { "type": "string", "description": "Specifies the security principal types that are allowed to sign in to the application.\nValid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.\n" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "A list of Azure tags to attach to an application. Requires Vault 1.16+.\n" }, "ttl": { "type": "string", "description": "Specifies the default TTL for service principals generated using this role.\nAccepts time suffixed strings (\"1h\") or an integer number of seconds. Defaults to the system/engine default TTL time.\n" } }, "requiredInputs": [ "role" ], "stateInputs": { "description": "Input properties used for looking up and filtering BackendRole resources.\n", "properties": { "applicationObjectId": { "type": "string", "description": "Application Object ID for an existing service principal that will\nbe used instead of creating dynamic service principals. If present, \u003cspan pulumi-lang-nodejs=\"`azureRoles`\" pulumi-lang-dotnet=\"`AzureRoles`\" pulumi-lang-go=\"`azureRoles`\" pulumi-lang-python=\"`azure_roles`\" pulumi-lang-yaml=\"`azureRoles`\" pulumi-lang-java=\"`azureRoles`\" pulumi-lang-hcl=\"`azure_roles`\"\u003e`azureRoles`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`permanentlyDelete`\" pulumi-lang-dotnet=\"`PermanentlyDelete`\" pulumi-lang-go=\"`permanentlyDelete`\" pulumi-lang-python=\"`permanently_delete`\" pulumi-lang-yaml=\"`permanentlyDelete`\" pulumi-lang-java=\"`permanentlyDelete`\" pulumi-lang-hcl=\"`permanently_delete`\"\u003e`permanentlyDelete`\u003c/span\u003e will be ignored.\n" }, "azureGroups": { "type": "array", "items": { "$ref": "#/types/vault:azure/BackendRoleAzureGroup:BackendRoleAzureGroup" }, "description": "List of Azure groups to be assigned to the generated service principal.\n" }, "azureRoles": { "type": "array", "items": { "$ref": "#/types/vault:azure/BackendRoleAzureRole:BackendRoleAzureRole" }, "description": "List of Azure roles to be assigned to the generated service principal.\n" }, "backend": { "type": "string", "description": "Path to the mounted Azure auth backend\n", "willReplaceOnChanges": true }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "explicitMaxTtl": { "type": "string", "description": "Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.\n" }, "maxTtl": { "type": "string", "description": "Specifies the maximum TTL for service principals generated using this role. Accepts time\nsuffixed strings (\"1h\") or an integer number of seconds. Defaults to the system/engine max TTL time.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string key-value pairs that are stored alongside the role and returned with generated\ncredentials.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "permanentlyDelete": { "type": "boolean", "description": "Indicates whether the applications and service principals created by Vault will be permanently\ndeleted when the corresponding leases expire. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. For Vault v1.12+.\n" }, "persistApp": { "type": "boolean", "description": "If set to true, persists the created service principal and application for the lifetime of the role\n" }, "role": { "type": "string", "description": "Name of the Azure role\n", "willReplaceOnChanges": true }, "signInAudience": { "type": "string", "description": "Specifies the security principal types that are allowed to sign in to the application.\nValid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.\n" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "A list of Azure tags to attach to an application. Requires Vault 1.16+.\n" }, "ttl": { "type": "string", "description": "Specifies the default TTL for service principals generated using this role.\nAccepts time suffixed strings (\"1h\") or an integer number of seconds. Defaults to the system/engine default TTL time.\n" } }, "type": "object" } }, "vault:azure/secretBackendStaticRole:SecretBackendStaticRole": { "description": "Manages a static role in the Azure Secrets Engine. \nStatic roles in Vault are linked to existing Azure AD applications, and manage long-lived credentials for those\napplications.\n\nUnlike dynamic roles, static roles do not generate new service principals — they manage a fixed application and rotate\nor import its credentials as needed.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst azure = new vault.azure.Backend(\"azure\", {\n subscriptionId: subscriptionId,\n tenantId: tenantId,\n clientSecret: clientSecret,\n clientId: clientId,\n});\nconst static_role = new vault.azure.SecretBackendStaticRole(\"static-role\", {\n backend: azure.path,\n role: \"static-role\",\n applicationObjectId: \"11111111-2222-3333-4444-44444444444\",\n ttl: Number(\"8760h\"),\n metadata: {\n team: \"test\",\n owner: \"vault\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nazure = vault.azure.Backend(\"azure\",\n subscription_id=subscription_id,\n tenant_id=tenant_id,\n client_secret=client_secret,\n client_id=client_id)\nstatic_role = vault.azure.SecretBackendStaticRole(\"static-role\",\n backend=azure.path,\n role=\"static-role\",\n application_object_id=\"11111111-2222-3333-4444-44444444444\",\n ttl=int(\"8760h\"),\n metadata={\n \"team\": \"test\",\n \"owner\": \"vault\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var azure = new Vault.Azure.Backend(\"azure\", new()\n {\n SubscriptionId = subscriptionId,\n TenantId = tenantId,\n ClientSecret = clientSecret,\n ClientId = clientId,\n });\n\n var static_role = new Vault.Azure.SecretBackendStaticRole(\"static-role\", new()\n {\n Backend = azure.Path,\n Role = \"static-role\",\n ApplicationObjectId = \"11111111-2222-3333-4444-44444444444\",\n Ttl = \"8760h\",\n Metadata = \n {\n { \"team\", \"test\" },\n { \"owner\", \"vault\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/azure\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tazure2, err := azure.NewBackend(ctx, \"azure\", \u0026azure.BackendArgs{\n\t\t\tSubscriptionId: pulumi.Any(subscriptionId),\n\t\t\tTenantId: pulumi.Any(tenantId),\n\t\t\tClientSecret: pulumi.Any(clientSecret),\n\t\t\tClientId: pulumi.Any(clientId),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = azure.NewSecretBackendStaticRole(ctx, \"static-role\", \u0026azure.SecretBackendStaticRoleArgs{\n\t\t\tBackend: azure2.Path,\n\t\t\tRole: pulumi.String(\"static-role\"),\n\t\t\tApplicationObjectId: pulumi.String(\"11111111-2222-3333-4444-44444444444\"),\n\t\t\tTtl: pulumi.Int(\"8760h\"),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"team\": pulumi.String(\"test\"),\n\t\t\t\t\"owner\": pulumi.String(\"vault\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_azure_backend\" \"azure\" {\n subscription_id = subscriptionId\n tenant_id = tenantId\n client_secret = clientSecret\n client_id = clientId\n}\nresource \"vault_azure_secretbackendstaticrole\" \"static-role\" {\n backend = vault_azure_backend.azure.path\n role = \"static-role\"\n application_object_id = \"11111111-2222-3333-4444-44444444444\"\n ttl = \"8760h\"\n metadata = {\n \"team\" = \"test\"\n \"owner\" = \"vault\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.azure.Backend;\nimport com.pulumi.vault.azure.BackendArgs;\nimport com.pulumi.vault.azure.SecretBackendStaticRole;\nimport com.pulumi.vault.azure.SecretBackendStaticRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var azure = new Backend(\"azure\", BackendArgs.builder()\n .subscriptionId(subscriptionId)\n .tenantId(tenantId)\n .clientSecret(clientSecret)\n .clientId(clientId)\n .build());\n\n var static_role = new SecretBackendStaticRole(\"static-role\", SecretBackendStaticRoleArgs.builder()\n .backend(azure.path())\n .role(\"static-role\")\n .applicationObjectId(\"11111111-2222-3333-4444-44444444444\")\n .ttl(\"8760h\")\n .metadata(Map.ofEntries(\n Map.entry(\"team\", \"test\"),\n Map.entry(\"owner\", \"vault\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n azure:\n type: vault:azure:Backend\n properties:\n subscriptionId: ${subscriptionId}\n tenantId: ${tenantId}\n clientSecret: ${clientSecret}\n clientId: ${clientId}\n static-role:\n type: vault:azure:SecretBackendStaticRole\n properties:\n backend: ${azure.path}\n role: static-role\n applicationObjectId: 11111111-2222-3333-4444-44444444444\n ttl: 8760h\n metadata:\n team: test\n owner: vault\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "applicationObjectId": { "type": "string", "description": "The Azure AD Application Object ID associated with the existing application whose\ncredentials Vault will manage.\n" }, "backend": { "type": "string", "description": "Path where the Azure Secrets Engine is mounted.\n" }, "clientSecret": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWhen importing an existing credential, provides the existing client secret\nvalue.\n", "secret": true }, "deferInitialCreds": { "type": "boolean", "description": "If true, the initial credential generation will be deferred until the\nfirst read of credentials from this role. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "expiration": { "type": "string", "description": "**Deprecated** - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. \nVault reads expiration from Azure.\n", "deprecationMessage": "This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure." }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string key-value pairs that are stored alongside the role and returned with generated\ncredentials.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's\nconfigured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "role": { "type": "string", "description": "Name of the static role to create or manage.\n" }, "secretId": { "type": "string", "description": "When importing an existing credential, specifies the Azure secret’s key ID.\n" }, "skipImportRotation": { "type": "boolean", "description": "If true, Vault will import the provided credential without performing\nrotation. Valid only during creation. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be\nat least 1 month.\nAccepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.\n" } }, "required": [ "applicationObjectId", "backend", "metadata", "role", "ttl" ], "inputProperties": { "applicationObjectId": { "type": "string", "description": "The Azure AD Application Object ID associated with the existing application whose\ncredentials Vault will manage.\n" }, "backend": { "type": "string", "description": "Path where the Azure Secrets Engine is mounted.\n" }, "clientSecret": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWhen importing an existing credential, provides the existing client secret\nvalue.\n", "secret": true }, "deferInitialCreds": { "type": "boolean", "description": "If true, the initial credential generation will be deferred until the\nfirst read of credentials from this role. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "expiration": { "type": "string", "description": "**Deprecated** - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. \nVault reads expiration from Azure.\n", "deprecationMessage": "This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure." }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string key-value pairs that are stored alongside the role and returned with generated\ncredentials.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's\nconfigured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "role": { "type": "string", "description": "Name of the static role to create or manage.\n" }, "secretId": { "type": "string", "description": "When importing an existing credential, specifies the Azure secret’s key ID.\n" }, "skipImportRotation": { "type": "boolean", "description": "If true, Vault will import the provided credential without performing\nrotation. Valid only during creation. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be\nat least 1 month.\nAccepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.\n" } }, "requiredInputs": [ "applicationObjectId", "backend", "role" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendStaticRole resources.\n", "properties": { "applicationObjectId": { "type": "string", "description": "The Azure AD Application Object ID associated with the existing application whose\ncredentials Vault will manage.\n" }, "backend": { "type": "string", "description": "Path where the Azure Secrets Engine is mounted.\n" }, "clientSecret": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWhen importing an existing credential, provides the existing client secret\nvalue.\n", "secret": true }, "deferInitialCreds": { "type": "boolean", "description": "If true, the initial credential generation will be deferred until the\nfirst read of credentials from this role. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "expiration": { "type": "string", "description": "**Deprecated** - Expiration timestamp (UTC, RFC3339 format) of the existing credential being imported. \nVault reads expiration from Azure.\n", "deprecationMessage": "This field is deprecated and will be removed in a future release. Vault will always read the expiration from Azure." }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string key-value pairs that are stored alongside the role and returned with generated\ncredentials.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's\nconfigured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "role": { "type": "string", "description": "Name of the static role to create or manage.\n" }, "secretId": { "type": "string", "description": "When importing an existing credential, specifies the Azure secret’s key ID.\n" }, "skipImportRotation": { "type": "boolean", "description": "If true, Vault will import the provided credential without performing\nrotation. Valid only during creation. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "Duration that defines the validity period of the managed credential. Defaults to 2 years. Must be\nat least 1 month.\nAccepts an integer number of seconds (31536000). Defaults to the system/engine default TTL time.\n" } }, "type": "object" } }, "vault:cf/authBackendConfig:AuthBackendConfig": { "description": "Manages the configuration for the [CloudFoundry (CF) auth method](https://developer.hashicorp.com/vault/docs/auth/cf) in Vault.\n\n\u003e **Important** The \u003cspan pulumi-lang-nodejs=\"`cfPasswordWo`\" pulumi-lang-dotnet=\"`CfPasswordWo`\" pulumi-lang-go=\"`cfPasswordWo`\" pulumi-lang-python=\"`cf_password_wo`\" pulumi-lang-yaml=\"`cfPasswordWo`\" pulumi-lang-java=\"`cfPasswordWo`\" pulumi-lang-hcl=\"`cf_password_wo`\"\u003e`cfPasswordWo`\u003c/span\u003e field is write-only and will never be\nstored in Terraform state. The password is sent to Vault on every update.\nSee Ephemeral Attributes Reference below.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst cf = new vault.AuthBackend(\"cf\", {\n type: \"cf\",\n path: \"cf\",\n});\nconst config = new vault.cf.AuthBackendConfig(\"config\", {\n mount: cf.path,\n identityCaCertificates: [std.file({\n input: \"ca.pem\",\n }).then(invoke =\u003e std.trimspace({\n input: invoke.result,\n })).then(invoke =\u003e invoke.result)],\n cfApiAddr: \"https://api.my-cf.example.com\",\n cfUsername: \"admin\",\n cfPasswordWo: cfPassword,\n cfPasswordWoVersion: 1,\n loginMaxSecondsNotBefore: 300,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ncf = vault.AuthBackend(\"cf\",\n type=\"cf\",\n path=\"cf\")\nconfig = vault.cf.AuthBackendConfig(\"config\",\n mount=cf.path,\n identity_ca_certificates=[std.trimspace(input=std.file(input=\"ca.pem\").result).result],\n cf_api_addr=\"https://api.my-cf.example.com\",\n cf_username=\"admin\",\n cf_password_wo=cf_password,\n cf_password_wo_version=1,\n login_max_seconds_not_before=300)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var cf = new Vault.AuthBackend(\"cf\", new()\n {\n Type = \"cf\",\n Path = \"cf\",\n });\n\n var config = new Vault.Cf.AuthBackendConfig(\"config\", new()\n {\n Mount = cf.Path,\n IdentityCaCertificates = new[]\n {\n Std.File.Invoke(new()\n {\n Input = \"ca.pem\",\n }).Apply(invoke =\u003e Std.Trimspace.Invoke(new()\n {\n Input = invoke.Result,\n })).Apply(invoke =\u003e invoke.Result),\n },\n CfApiAddr = \"https://api.my-cf.example.com\",\n CfUsername = \"admin\",\n CfPasswordWo = cfPassword,\n CfPasswordWoVersion = 1,\n LoginMaxSecondsNotBefore = 300,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/cf\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tcf2, err := vault.NewAuthBackend(ctx, \"cf\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"cf\"),\n\t\t\tPath: pulumi.String(\"cf\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeTrimspace, err := std.Trimspace(ctx, \u0026std.TrimspaceArgs{\n\t\t\tInput: std.File(ctx, std.FileArgs{\n\t\t\t\tInput: \"ca.pem\",\n\t\t\t}, nil).Result,\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = cf.NewAuthBackendConfig(ctx, \"config\", \u0026cf.AuthBackendConfigArgs{\n\t\t\tMount: cf2.Path,\n\t\t\tIdentityCaCertificates: pulumi.StringArray{\n\t\t\t\tpulumi.String(invokeTrimspace.Result),\n\t\t\t},\n\t\t\tCfApiAddr: pulumi.String(\"https://api.my-cf.example.com\"),\n\t\t\tCfUsername: pulumi.String(\"admin\"),\n\t\t\tCfPasswordWo: pulumi.Any(cfPassword),\n\t\t\tCfPasswordWoVersion: pulumi.Int(1),\n\t\t\tLoginMaxSecondsNotBefore: pulumi.Int(300),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"cf\" {\n type = \"cf\"\n path = \"cf\"\n}\nresource \"vault_cf_authbackendconfig\" \"config\" {\n mount = vault_authbackend.cf.path\n identity_ca_certificates = [trimspace(file(\"ca.pem\"))]\n cf_api_addr = \"https://api.my-cf.example.com\"\n cf_username = \"admin\"\n cf_password_wo = cfPassword\n cf_password_wo_version = 1\n login_max_seconds_not_before = 300\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.cf.AuthBackendConfig;\nimport com.pulumi.vault.cf.AuthBackendConfigArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.std.inputs.TrimspaceArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var cf = new AuthBackend(\"cf\", AuthBackendArgs.builder()\n .type(\"cf\")\n .path(\"cf\")\n .build());\n\n var config = new AuthBackendConfig(\"config\", AuthBackendConfigArgs.builder()\n .mount(cf.path())\n .identityCaCertificates(StdFunctions.trimspace(TrimspaceArgs.builder()\n .input(StdFunctions.file(FileArgs.builder()\n .input(\"ca.pem\")\n .build()).result())\n .build()).result())\n .cfApiAddr(\"https://api.my-cf.example.com\")\n .cfUsername(\"admin\")\n .cfPasswordWo(cfPassword)\n .cfPasswordWoVersion(1)\n .loginMaxSecondsNotBefore(300)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n cf:\n type: vault:AuthBackend\n properties:\n type: cf\n path: cf\n config:\n type: vault:cf:AuthBackendConfig\n properties:\n mount: ${cf.path}\n identityCaCertificates:\n - fn::invoke:\n function: std:trimspace\n arguments:\n input:\n fn::invoke:\n function: std:file\n arguments:\n input: ca.pem\n return: result\n return: result\n cfApiAddr: https://api.my-cf.example.com\n cfUsername: admin\n cfPasswordWo: ${cfPassword}\n cfPasswordWoVersion: 1\n loginMaxSecondsNotBefore: 300\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`cfPasswordWo`\" pulumi-lang-dotnet=\"`CfPasswordWo`\" pulumi-lang-go=\"`cfPasswordWo`\" pulumi-lang-python=\"`cf_password_wo`\" pulumi-lang-yaml=\"`cfPasswordWo`\" pulumi-lang-java=\"`cfPasswordWo`\" pulumi-lang-hcl=\"`cf_password_wo`\"\u003e`cfPasswordWo`\u003c/span\u003e - (Required) The password for authenticating to the CF API.\n This attribute is write-only and is never stored in Terraform state. It is sent\n to Vault on create and on every update. Because Terraform cannot detect changes\n to write-only values, increment \u003cspan pulumi-lang-nodejs=\"`cfPasswordWoVersion`\" pulumi-lang-dotnet=\"`CfPasswordWoVersion`\" pulumi-lang-go=\"`cfPasswordWoVersion`\" pulumi-lang-python=\"`cf_password_wo_version`\" pulumi-lang-yaml=\"`cfPasswordWoVersion`\" pulumi-lang-java=\"`cfPasswordWoVersion`\" pulumi-lang-hcl=\"`cf_password_wo_version`\"\u003e`cfPasswordWoVersion`\u003c/span\u003e to trigger an update\n when only this password changes.\n\n* \u003cspan pulumi-lang-nodejs=\"`cfPasswordWoVersion`\" pulumi-lang-dotnet=\"`CfPasswordWoVersion`\" pulumi-lang-go=\"`cfPasswordWoVersion`\" pulumi-lang-python=\"`cf_password_wo_version`\" pulumi-lang-yaml=\"`cfPasswordWoVersion`\" pulumi-lang-java=\"`cfPasswordWoVersion`\" pulumi-lang-hcl=\"`cf_password_wo_version`\"\u003e`cfPasswordWoVersion`\u003c/span\u003e - (Required) Version counter for \u003cspan pulumi-lang-nodejs=\"`cfPasswordWo`\" pulumi-lang-dotnet=\"`CfPasswordWo`\" pulumi-lang-go=\"`cfPasswordWo`\" pulumi-lang-python=\"`cf_password_wo`\" pulumi-lang-yaml=\"`cfPasswordWo`\" pulumi-lang-java=\"`cfPasswordWo`\" pulumi-lang-hcl=\"`cf_password_wo`\"\u003e`cfPasswordWo`\u003c/span\u003e.\n Increment this value to trigger an update when only the write-only password changes.\n\n## Import\n\nCF auth backend configs can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e path, and\n`/config`, e.g.\n\n```sh\n$ pulumi import vault:cf/authBackendConfig:AuthBackendConfig config auth/cf/config\n```\n\nThe namespace can be set using the environment variable `TERRAFORM_VAULT_NAMESPACE`.\n\n", "properties": { "cfApiAddr": { "type": "string", "description": "The full API address of the CF deployment, used to\nverify that a given `CF_INSTANCE_CERT` references an application, space, and\norganization that currently exist.\n" }, "cfApiTrustedCertificates": { "type": "array", "items": { "type": "string" }, "description": "A set of PEM-encoded certificates\npresented by the CF API. Configures Vault to trust these certificates when\nmaking API calls.\n" }, "cfPasswordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe password for authenticating to the CF API. This attribute is write-only and is never stored in Terraform state.", "secret": true }, "cfPasswordWoVersion": { "type": "integer", "description": "Version counter for 'cf_password_wo'. Increment this value to trigger an update when only the write-only password changes." }, "cfTimeout": { "type": "integer", "description": "The timeout for CF API calls in seconds. Defaults to\n\u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e (no timeout). Removing this field from your configuration resets the value\nto \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e in Vault. Requires Vault 1.19.4 or later due to a bug fix in that release.\n" }, "cfUsername": { "type": "string", "description": "The username for authenticating to the CF API.\n" }, "identityCaCertificates": { "type": "array", "items": { "type": "string" }, "description": "A set of root CA PEM certificates used\nto verify that `CF_INSTANCE_CERT` presented at login was issued by the proper\nauthority.\n" }, "loginMaxSecondsNotAfter": { "type": "integer", "description": "The maximum number of\nseconds in the future when a login signature could have been created. Defaults\nto \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e. Because this field is `Computed`, removing it from your configuration\ndoes **not** reset the value in Vault — Vault retains whatever was previously\nset. To reset to the default, set the field explicitly to \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e.\n" }, "loginMaxSecondsNotBefore": { "type": "integer", "description": "The maximum number of\nseconds in the past when a login signature could have been created. Defaults\nto \u003cspan pulumi-lang-nodejs=\"`300`\" pulumi-lang-dotnet=\"`300`\" pulumi-lang-go=\"`300`\" pulumi-lang-python=\"`300`\" pulumi-lang-yaml=\"`300`\" pulumi-lang-java=\"`300`\" pulumi-lang-hcl=\"`300`\"\u003e`300`\u003c/span\u003e. Because this field is `Computed`, removing it from your configuration\ndoes **not** reset the value in Vault — Vault retains whatever was previously\nset. To reset to the default, set the field explicitly to \u003cspan pulumi-lang-nodejs=\"`300`\" pulumi-lang-dotnet=\"`300`\" pulumi-lang-go=\"`300`\" pulumi-lang-python=\"`300`\" pulumi-lang-yaml=\"`300`\" pulumi-lang-java=\"`300`\" pulumi-lang-hcl=\"`300`\"\u003e`300`\u003c/span\u003e.\n" }, "mount": { "type": "string", "description": "The mount path for the CF auth engine in Vault.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "cfApiAddr", "cfPasswordWo", "cfPasswordWoVersion", "cfUsername", "identityCaCertificates", "loginMaxSecondsNotAfter", "loginMaxSecondsNotBefore", "mount" ], "inputProperties": { "cfApiAddr": { "type": "string", "description": "The full API address of the CF deployment, used to\nverify that a given `CF_INSTANCE_CERT` references an application, space, and\norganization that currently exist.\n" }, "cfApiTrustedCertificates": { "type": "array", "items": { "type": "string" }, "description": "A set of PEM-encoded certificates\npresented by the CF API. Configures Vault to trust these certificates when\nmaking API calls.\n" }, "cfPasswordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe password for authenticating to the CF API. This attribute is write-only and is never stored in Terraform state.", "secret": true }, "cfPasswordWoVersion": { "type": "integer", "description": "Version counter for 'cf_password_wo'. Increment this value to trigger an update when only the write-only password changes." }, "cfTimeout": { "type": "integer", "description": "The timeout for CF API calls in seconds. Defaults to\n\u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e (no timeout). Removing this field from your configuration resets the value\nto \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e in Vault. Requires Vault 1.19.4 or later due to a bug fix in that release.\n" }, "cfUsername": { "type": "string", "description": "The username for authenticating to the CF API.\n" }, "identityCaCertificates": { "type": "array", "items": { "type": "string" }, "description": "A set of root CA PEM certificates used\nto verify that `CF_INSTANCE_CERT` presented at login was issued by the proper\nauthority.\n" }, "loginMaxSecondsNotAfter": { "type": "integer", "description": "The maximum number of\nseconds in the future when a login signature could have been created. Defaults\nto \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e. Because this field is `Computed`, removing it from your configuration\ndoes **not** reset the value in Vault — Vault retains whatever was previously\nset. To reset to the default, set the field explicitly to \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e.\n" }, "loginMaxSecondsNotBefore": { "type": "integer", "description": "The maximum number of\nseconds in the past when a login signature could have been created. Defaults\nto \u003cspan pulumi-lang-nodejs=\"`300`\" pulumi-lang-dotnet=\"`300`\" pulumi-lang-go=\"`300`\" pulumi-lang-python=\"`300`\" pulumi-lang-yaml=\"`300`\" pulumi-lang-java=\"`300`\" pulumi-lang-hcl=\"`300`\"\u003e`300`\u003c/span\u003e. Because this field is `Computed`, removing it from your configuration\ndoes **not** reset the value in Vault — Vault retains whatever was previously\nset. To reset to the default, set the field explicitly to \u003cspan pulumi-lang-nodejs=\"`300`\" pulumi-lang-dotnet=\"`300`\" pulumi-lang-go=\"`300`\" pulumi-lang-python=\"`300`\" pulumi-lang-yaml=\"`300`\" pulumi-lang-java=\"`300`\" pulumi-lang-hcl=\"`300`\"\u003e`300`\u003c/span\u003e.\n" }, "mount": { "type": "string", "description": "The mount path for the CF auth engine in Vault.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "cfApiAddr", "cfPasswordWo", "cfPasswordWoVersion", "cfUsername", "identityCaCertificates", "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendConfig resources.\n", "properties": { "cfApiAddr": { "type": "string", "description": "The full API address of the CF deployment, used to\nverify that a given `CF_INSTANCE_CERT` references an application, space, and\norganization that currently exist.\n" }, "cfApiTrustedCertificates": { "type": "array", "items": { "type": "string" }, "description": "A set of PEM-encoded certificates\npresented by the CF API. Configures Vault to trust these certificates when\nmaking API calls.\n" }, "cfPasswordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe password for authenticating to the CF API. This attribute is write-only and is never stored in Terraform state.", "secret": true }, "cfPasswordWoVersion": { "type": "integer", "description": "Version counter for 'cf_password_wo'. Increment this value to trigger an update when only the write-only password changes." }, "cfTimeout": { "type": "integer", "description": "The timeout for CF API calls in seconds. Defaults to\n\u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e (no timeout). Removing this field from your configuration resets the value\nto \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e in Vault. Requires Vault 1.19.4 or later due to a bug fix in that release.\n" }, "cfUsername": { "type": "string", "description": "The username for authenticating to the CF API.\n" }, "identityCaCertificates": { "type": "array", "items": { "type": "string" }, "description": "A set of root CA PEM certificates used\nto verify that `CF_INSTANCE_CERT` presented at login was issued by the proper\nauthority.\n" }, "loginMaxSecondsNotAfter": { "type": "integer", "description": "The maximum number of\nseconds in the future when a login signature could have been created. Defaults\nto \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e. Because this field is `Computed`, removing it from your configuration\ndoes **not** reset the value in Vault — Vault retains whatever was previously\nset. To reset to the default, set the field explicitly to \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e.\n" }, "loginMaxSecondsNotBefore": { "type": "integer", "description": "The maximum number of\nseconds in the past when a login signature could have been created. Defaults\nto \u003cspan pulumi-lang-nodejs=\"`300`\" pulumi-lang-dotnet=\"`300`\" pulumi-lang-go=\"`300`\" pulumi-lang-python=\"`300`\" pulumi-lang-yaml=\"`300`\" pulumi-lang-java=\"`300`\" pulumi-lang-hcl=\"`300`\"\u003e`300`\u003c/span\u003e. Because this field is `Computed`, removing it from your configuration\ndoes **not** reset the value in Vault — Vault retains whatever was previously\nset. To reset to the default, set the field explicitly to \u003cspan pulumi-lang-nodejs=\"`300`\" pulumi-lang-dotnet=\"`300`\" pulumi-lang-go=\"`300`\" pulumi-lang-python=\"`300`\" pulumi-lang-yaml=\"`300`\" pulumi-lang-java=\"`300`\" pulumi-lang-hcl=\"`300`\"\u003e`300`\u003c/span\u003e.\n" }, "mount": { "type": "string", "description": "The mount path for the CF auth engine in Vault.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:cf/authBackendRole:AuthBackendRole": { "description": "Manages a role for the [CloudFoundry (CF) auth method](https://developer.hashicorp.com/vault/docs/auth/cf) in Vault.\nRoles define the constraints that must be satisfied by a CF instance certificate\nat login time, and the token parameters issued on a successful login.\n\n\u003e **Note** Roles can be created independently of the backend configuration,\nbut a \u003cspan pulumi-lang-nodejs=\"`vault.cf.AuthBackendConfig`\" pulumi-lang-dotnet=\"`vault.cf.AuthBackendConfig`\" pulumi-lang-go=\"`cf.AuthBackendConfig`\" pulumi-lang-python=\"`cf.AuthBackendConfig`\" pulumi-lang-yaml=\"`vault.cf.AuthBackendConfig`\" pulumi-lang-java=\"`vault.cf.AuthBackendConfig`\" pulumi-lang-hcl=\"`vault_cf_auth_backend_config`\"\u003e`vault.cf.AuthBackendConfig`\u003c/span\u003e must be\nin place before any login attempt will succeed.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst cf = new vault.AuthBackend(\"cf\", {\n type: \"cf\",\n path: \"cf\",\n});\nconst cfPolicy = new vault.Policy(\"cf_policy\", {\n name: \"cf-policy\",\n policy: `path \\\\\"secret/*\\\\\" {\n capabilities = [\\\\\"read\\\\\"]\n}\n`,\n});\nconst role = new vault.cf.AuthBackendRole(\"role\", {\n mount: cf.path,\n name: \"my-role\",\n boundSpaceIds: [\"space-uuid-1\"],\n boundOrganizationIds: [\"org-uuid-1\"],\n disableIpMatching: true,\n tokenTtl: 3600,\n tokenPolicies: [cfPolicy.name],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ncf = vault.AuthBackend(\"cf\",\n type=\"cf\",\n path=\"cf\")\ncf_policy = vault.Policy(\"cf_policy\",\n name=\"cf-policy\",\n policy=\"\"\"path \\\"secret/*\\\" {\n capabilities = [\\\"read\\\"]\n}\n\"\"\")\nrole = vault.cf.AuthBackendRole(\"role\",\n mount=cf.path,\n name=\"my-role\",\n bound_space_ids=[\"space-uuid-1\"],\n bound_organization_ids=[\"org-uuid-1\"],\n disable_ip_matching=True,\n token_ttl=3600,\n token_policies=[cf_policy.name])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var cf = new Vault.AuthBackend(\"cf\", new()\n {\n Type = \"cf\",\n Path = \"cf\",\n });\n\n var cfPolicy = new Vault.Policy(\"cf_policy\", new()\n {\n Name = \"cf-policy\",\n PolicyContents = @\"path \\\"\"secret/*\\\"\" {\n capabilities = [\\\"\"read\\\"\"]\n}\n\",\n });\n\n var role = new Vault.Cf.AuthBackendRole(\"role\", new()\n {\n Mount = cf.Path,\n Name = \"my-role\",\n BoundSpaceIds = new[]\n {\n \"space-uuid-1\",\n },\n BoundOrganizationIds = new[]\n {\n \"org-uuid-1\",\n },\n DisableIpMatching = true,\n TokenTtl = 3600,\n TokenPolicies = new[]\n {\n cfPolicy.Name,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/cf\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tcf2, err := vault.NewAuthBackend(ctx, \"cf\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"cf\"),\n\t\t\tPath: pulumi.String(\"cf\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tcfPolicy, err := vault.NewPolicy(ctx, \"cf_policy\", \u0026vault.PolicyArgs{\n\t\t\tName: pulumi.String(\"cf-policy\"),\n\t\t\tPolicy: pulumi.String(\"path \\\\\\\"secret/*\\\\\\\" {\\n capabilities = [\\\\\\\"read\\\\\\\"]\\n}\\n\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = cf.NewAuthBackendRole(ctx, \"role\", \u0026cf.AuthBackendRoleArgs{\n\t\t\tMount: cf2.Path,\n\t\t\tName: pulumi.String(\"my-role\"),\n\t\t\tBoundSpaceIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"space-uuid-1\"),\n\t\t\t},\n\t\t\tBoundOrganizationIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"org-uuid-1\"),\n\t\t\t},\n\t\t\tDisableIpMatching: pulumi.Bool(true),\n\t\t\tTokenTtl: pulumi.Int(3600),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tcfPolicy.Name,\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"cf\" {\n type = \"cf\"\n path = \"cf\"\n}\nresource \"vault_policy\" \"cf_policy\" {\n name = \"cf-policy\"\n policy = \"path \\\\\\\"secret/*\\\\\\\" {\\n capabilities = [\\\\\\\"read\\\\\\\"]\\n}\\n\"\n}\nresource \"vault_cf_authbackendrole\" \"role\" {\n mount = vault_authbackend.cf.path\n name = \"my-role\"\n bound_space_ids = [\"space-uuid-1\"]\n bound_organization_ids = [\"org-uuid-1\"]\n disable_ip_matching = true\n token_ttl = 3600\n token_policies = [vault_policy.cf_policy.name]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.Policy;\nimport com.pulumi.vault.PolicyArgs;\nimport com.pulumi.vault.cf.AuthBackendRole;\nimport com.pulumi.vault.cf.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var cf = new AuthBackend(\"cf\", AuthBackendArgs.builder()\n .type(\"cf\")\n .path(\"cf\")\n .build());\n\n var cfPolicy = new Policy(\"cfPolicy\", PolicyArgs.builder()\n .name(\"cf-policy\")\n .policy(\"\"\"\npath \\\"secret/*\\\" {\n capabilities = [\\\"read\\\"]\n}\n \"\"\")\n .build());\n\n var role = new AuthBackendRole(\"role\", AuthBackendRoleArgs.builder()\n .mount(cf.path())\n .name(\"my-role\")\n .boundSpaceIds(\"space-uuid-1\")\n .boundOrganizationIds(\"org-uuid-1\")\n .disableIpMatching(true)\n .tokenTtl(3600)\n .tokenPolicies(cfPolicy.name())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n cf:\n type: vault:AuthBackend\n properties:\n type: cf\n path: cf\n cfPolicy:\n type: vault:Policy\n name: cf_policy\n properties:\n name: cf-policy\n policy: |\n path \\\"secret/*\\\" {\n capabilities = [\\\"read\\\"]\n }\n role:\n type: vault:cf:AuthBackendRole\n properties:\n mount: ${cf.path}\n name: my-role\n boundSpaceIds:\n - space-uuid-1\n boundOrganizationIds:\n - org-uuid-1\n disableIpMatching: true\n tokenTtl: 3600\n tokenPolicies:\n - ${cfPolicy.name}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nCF auth backend roles can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e path, `/roles/`,\nand the role \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:cf/authBackendRole:AuthBackendRole role auth/cf/roles/my-role\n```\n\nThe namespace can be set using the environment variable `TERRAFORM_VAULT_NAMESPACE`.\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "boundApplicationIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF application IDs. If\nset, a logging-in instance must belong to one of these applications.\n" }, "boundInstanceIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF instance IDs. If set,\nthe logging-in instance's ID must appear in this list.\n" }, "boundOrganizationIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF organization IDs.\nIf set, a logging-in instance must belong to one of these organizations.\n" }, "boundSpaceIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF space IDs. If set, a\nlogging-in instance must belong to one of these spaces.\n" }, "disableIpMatching": { "type": "boolean", "description": "If \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, disables the default behavior\nthat requires login requests to originate from an IP address listed in the\ninstance certificate. Useful when CF instances sit behind a load balancer or\nNAT. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Removing this field from your configuration resets\nthe value to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e in Vault.\n" }, "mount": { "type": "string", "description": "The mount path for the CF auth engine in Vault.\n" }, "name": { "type": "string", "description": "The name of the CF auth role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "mount", "name", "tokenType" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "boundApplicationIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF application IDs. If\nset, a logging-in instance must belong to one of these applications.\n" }, "boundInstanceIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF instance IDs. If set,\nthe logging-in instance's ID must appear in this list.\n" }, "boundOrganizationIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF organization IDs.\nIf set, a logging-in instance must belong to one of these organizations.\n" }, "boundSpaceIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF space IDs. If set, a\nlogging-in instance must belong to one of these spaces.\n" }, "disableIpMatching": { "type": "boolean", "description": "If \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, disables the default behavior\nthat requires login requests to originate from an IP address listed in the\ninstance certificate. Useful when CF instances sit behind a load balancer or\nNAT. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Removing this field from your configuration resets\nthe value to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e in Vault.\n" }, "mount": { "type": "string", "description": "The mount path for the CF auth engine in Vault.\n" }, "name": { "type": "string", "description": "The name of the CF auth role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "requiredInputs": [ "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "boundApplicationIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF application IDs. If\nset, a logging-in instance must belong to one of these applications.\n" }, "boundInstanceIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF instance IDs. If set,\nthe logging-in instance's ID must appear in this list.\n" }, "boundOrganizationIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF organization IDs.\nIf set, a logging-in instance must belong to one of these organizations.\n" }, "boundSpaceIds": { "type": "array", "items": { "type": "string" }, "description": "An optional set of CF space IDs. If set, a\nlogging-in instance must belong to one of these spaces.\n" }, "disableIpMatching": { "type": "boolean", "description": "If \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, disables the default behavior\nthat requires login requests to originate from an IP address listed in the\ninstance certificate. Useful when CF instances sit behind a load balancer or\nNAT. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Removing this field from your configuration resets\nthe value to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e in Vault.\n" }, "mount": { "type": "string", "description": "The mount path for the CF auth engine in Vault.\n" }, "name": { "type": "string", "description": "The name of the CF auth role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:config/controlGroup:ControlGroup": { "description": "Manages the Control Group configuration in Vault. This endpoint is used to configure Control Group settings.\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.config.ControlGroup(\"example\", {maxTtl: \"24h\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.config.ControlGroup(\"example\", max_ttl=\"24h\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Config.ControlGroup(\"example\", new()\n {\n MaxTtl = \"24h\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewControlGroup(ctx, \"example\", \u0026config.ControlGroupArgs{\n\t\t\tMaxTtl: pulumi.String(\"24h\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_controlgroup\" \"example\" {\n max_ttl = \"24h\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.ControlGroup;\nimport com.pulumi.vault.config.ControlGroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new ControlGroup(\"example\", ControlGroupArgs.builder()\n .maxTtl(\"24h\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:config:ControlGroup\n properties:\n maxTtl: 24h\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nControl Group configuration can be imported using the path `sys/config/control-group`, e.g.\n\n```sh\n$ pulumi import vault:config/controlGroup:ControlGroup example sys/config/control-group\n```\n\n", "properties": { "maxTtl": { "type": "string", "description": "The maximum TTL for a control group wrapping token. This value can be specified as a duration string (e.g., \"24h\", \"1h30m\") or as an integer number of seconds (e.g., \"86400\").\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "maxTtl" ], "inputProperties": { "maxTtl": { "type": "string", "description": "The maximum TTL for a control group wrapping token. This value can be specified as a duration string (e.g., \"24h\", \"1h30m\") or as an integer number of seconds (e.g., \"86400\").\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "maxTtl" ], "stateInputs": { "description": "Input properties used for looking up and filtering ControlGroup resources.\n", "properties": { "maxTtl": { "type": "string", "description": "The maximum TTL for a control group wrapping token. This value can be specified as a duration string (e.g., \"24h\", \"1h30m\") or as an integer number of seconds (e.g., \"86400\").\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:config/groupPolicyApplication:GroupPolicyApplication": { "description": "Manages the global group policy application mode for Vault Enterprise. This resource controls how policies attached to identity groups are applied across namespace boundaries.\n\n**Important:** This is a singleton resource - only one instance can exist per Vault cluster. The resource must be managed from the root or administrative namespace.\n\n**Note** this feature is available only with Vault Enterprise 1.13.8+.\n\n## Example Usage\n\n### Basic Usage (Root Namespace)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\n// Configure group policy application mode in root namespace\n// Using the default mode\nconst test = new vault.config.GroupPolicyApplication(\"test\", {groupPolicyApplicationMode: \"within_namespace_hierarchy\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\n# Configure group policy application mode in root namespace\n# Using the default mode\ntest = vault.config.GroupPolicyApplication(\"test\", group_policy_application_mode=\"within_namespace_hierarchy\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n // Configure group policy application mode in root namespace\n // Using the default mode\n var test = new Vault.Config.GroupPolicyApplication(\"test\", new()\n {\n GroupPolicyApplicationMode = \"within_namespace_hierarchy\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t// Configure group policy application mode in root namespace\n\t\t// Using the default mode\n\t\t_, err := config.NewGroupPolicyApplication(ctx, \"test\", \u0026config.GroupPolicyApplicationArgs{\n\t\t\tGroupPolicyApplicationMode: pulumi.String(\"within_namespace_hierarchy\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\n# Configure group policy application mode in root namespace\n# Using the default mode\nresource \"vault_config_grouppolicyapplication\" \"test\" {\n group_policy_application_mode = \"within_namespace_hierarchy\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.GroupPolicyApplication;\nimport com.pulumi.vault.config.GroupPolicyApplicationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n // Configure group policy application mode in root namespace\n // Using the default mode\n var test = new GroupPolicyApplication(\"test\", GroupPolicyApplicationArgs.builder()\n .groupPolicyApplicationMode(\"within_namespace_hierarchy\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n # Configure group policy application mode in root namespace\n # Using the default mode\n test:\n type: vault:config:GroupPolicyApplication\n properties:\n groupPolicyApplicationMode: within_namespace_hierarchy\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using \"any\" Mode\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.config.GroupPolicyApplication(\"config\", {groupPolicyApplicationMode: \"any\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.config.GroupPolicyApplication(\"config\", group_policy_application_mode=\"any\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Config.GroupPolicyApplication(\"config\", new()\n {\n GroupPolicyApplicationMode = \"any\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewGroupPolicyApplication(ctx, \"config\", \u0026config.GroupPolicyApplicationArgs{\n\t\t\tGroupPolicyApplicationMode: pulumi.String(\"any\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_grouppolicyapplication\" \"config\" {\n group_policy_application_mode = \"any\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.GroupPolicyApplication;\nimport com.pulumi.vault.config.GroupPolicyApplicationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new GroupPolicyApplication(\"config\", GroupPolicyApplicationArgs.builder()\n .groupPolicyApplicationMode(\"any\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:config:GroupPolicyApplication\n properties:\n groupPolicyApplicationMode: any\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Explicit Root Namespace\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.config.GroupPolicyApplication(\"config\", {groupPolicyApplicationMode: \"within_namespace_hierarchy\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.config.GroupPolicyApplication(\"config\", group_policy_application_mode=\"within_namespace_hierarchy\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Config.GroupPolicyApplication(\"config\", new()\n {\n GroupPolicyApplicationMode = \"within_namespace_hierarchy\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewGroupPolicyApplication(ctx, \"config\", \u0026config.GroupPolicyApplicationArgs{\n\t\t\tGroupPolicyApplicationMode: pulumi.String(\"within_namespace_hierarchy\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_grouppolicyapplication\" \"config\" {\n group_policy_application_mode = \"within_namespace_hierarchy\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.GroupPolicyApplication;\nimport com.pulumi.vault.config.GroupPolicyApplicationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new GroupPolicyApplication(\"config\", GroupPolicyApplicationArgs.builder()\n .groupPolicyApplicationMode(\"within_namespace_hierarchy\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:config:GroupPolicyApplication\n properties:\n groupPolicyApplicationMode: within_namespace_hierarchy\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Administrative Namespace\n\nWhen working with an administrative namespace, you can specify it directly in the resource:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.config.GroupPolicyApplication(\"config\", {\n groupPolicyApplicationMode: \"within_namespace_hierarchy\",\n namespace: \"admin\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.config.GroupPolicyApplication(\"config\",\n group_policy_application_mode=\"within_namespace_hierarchy\",\n namespace=\"admin\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Config.GroupPolicyApplication(\"config\", new()\n {\n GroupPolicyApplicationMode = \"within_namespace_hierarchy\",\n Namespace = \"admin\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewGroupPolicyApplication(ctx, \"config\", \u0026config.GroupPolicyApplicationArgs{\n\t\t\tGroupPolicyApplicationMode: pulumi.String(\"within_namespace_hierarchy\"),\n\t\t\tNamespace: pulumi.String(\"admin\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_grouppolicyapplication\" \"config\" {\n group_policy_application_mode = \"within_namespace_hierarchy\"\n namespace = \"admin\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.GroupPolicyApplication;\nimport com.pulumi.vault.config.GroupPolicyApplicationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new GroupPolicyApplication(\"config\", GroupPolicyApplicationArgs.builder()\n .groupPolicyApplicationMode(\"within_namespace_hierarchy\")\n .namespace(\"admin\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:config:GroupPolicyApplication\n properties:\n groupPolicyApplicationMode: within_namespace_hierarchy\n namespace: admin\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Behavior Notes\n\n### Singleton Resource\n\nThis resource is a singleton, meaning only one instance can exist per Vault cluster. Multiple \u003cspan pulumi-lang-nodejs=\"`vault.config.GroupPolicyApplication`\" pulumi-lang-dotnet=\"`vault.config.GroupPolicyApplication`\" pulumi-lang-go=\"`config.GroupPolicyApplication`\" pulumi-lang-python=\"`config.GroupPolicyApplication`\" pulumi-lang-yaml=\"`vault.config.GroupPolicyApplication`\" pulumi-lang-java=\"`vault.config.GroupPolicyApplication`\" pulumi-lang-hcl=\"`vault_config_group_policy_application`\"\u003e`vault.config.GroupPolicyApplication`\u003c/span\u003e resources in your Terraform configuration will conflict.\n\n### Deletion Behavior\n\nWhen this resource is destroyed via `terraform destroy`, it does not delete the configuration from Vault. Instead, it resets the mode to the default value \u003cspan pulumi-lang-nodejs=\"`withinNamespaceHierarchy`\" pulumi-lang-dotnet=\"`WithinNamespaceHierarchy`\" pulumi-lang-go=\"`withinNamespaceHierarchy`\" pulumi-lang-python=\"`within_namespace_hierarchy`\" pulumi-lang-yaml=\"`withinNamespaceHierarchy`\" pulumi-lang-java=\"`withinNamespaceHierarchy`\" pulumi-lang-hcl=\"`within_namespace_hierarchy`\"\u003e`withinNamespaceHierarchy`\u003c/span\u003e. This ensures that Vault always has a valid group policy application mode configured.\n\n### Namespace Requirements\n\nThis resource can only be managed from:\n- The root namespace\n- The administrative namespace (`\"admin\"`)\n\nAttempting to manage this resource from any other namespace will result in an error.\n\n### Policy Application Scope\n\n**Important:** The group policy application mode only applies to ACL policies and no longer affects Sentinel RGPs for Vault ≥ 1.13.8, 1.14.4, 1.15.0.\n\n### Replication Behavior\n\nThis configuration will be replicated between primary and secondary clusters. Primaries cannot have a different mode than secondaries.\n\n## Version Requirements\n\n- Requires Vault Enterprise 1.15.0 or later (TFVP support)\n\n## Import\n\nThe group policy application configuration can be imported using the path `sys/config/group-policy-application`:\n\n```sh\n$ pulumi import vault:config/groupPolicyApplication:GroupPolicyApplication config sys/config/group-policy-application\n```\n\n", "properties": { "groupPolicyApplicationMode": { "type": "string", "description": "Mode for group policy application. Must be either \u003cspan pulumi-lang-nodejs=\"`withinNamespaceHierarchy`\" pulumi-lang-dotnet=\"`WithinNamespaceHierarchy`\" pulumi-lang-go=\"`withinNamespaceHierarchy`\" pulumi-lang-python=\"`within_namespace_hierarchy`\" pulumi-lang-yaml=\"`withinNamespaceHierarchy`\" pulumi-lang-java=\"`withinNamespaceHierarchy`\" pulumi-lang-hcl=\"`within_namespace_hierarchy`\"\u003e`withinNamespaceHierarchy`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`any`\" pulumi-lang-dotnet=\"`Any`\" pulumi-lang-go=\"`any`\" pulumi-lang-python=\"`any`\" pulumi-lang-yaml=\"`any`\" pulumi-lang-java=\"`any`\" pulumi-lang-hcl=\"`any`\"\u003e`any`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`withinNamespaceHierarchy`\" pulumi-lang-dotnet=\"`WithinNamespaceHierarchy`\" pulumi-lang-go=\"`withinNamespaceHierarchy`\" pulumi-lang-python=\"`within_namespace_hierarchy`\" pulumi-lang-yaml=\"`withinNamespaceHierarchy`\" pulumi-lang-java=\"`withinNamespaceHierarchy`\" pulumi-lang-hcl=\"`within_namespace_hierarchy`\"\u003e`withinNamespaceHierarchy`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "Target namespace. Must be root (`\"\"`) or administrative (`\"admin\"`) namespace. If omitted, the provider's configured namespace is used.\nSet this to `\"\"` to explicitly target the root namespace. The value should not contain leading or trailing forward slashes.\n*Available only for Vault Enterprise*.\n" } }, "required": [ "groupPolicyApplicationMode" ], "inputProperties": { "groupPolicyApplicationMode": { "type": "string", "description": "Mode for group policy application. Must be either \u003cspan pulumi-lang-nodejs=\"`withinNamespaceHierarchy`\" pulumi-lang-dotnet=\"`WithinNamespaceHierarchy`\" pulumi-lang-go=\"`withinNamespaceHierarchy`\" pulumi-lang-python=\"`within_namespace_hierarchy`\" pulumi-lang-yaml=\"`withinNamespaceHierarchy`\" pulumi-lang-java=\"`withinNamespaceHierarchy`\" pulumi-lang-hcl=\"`within_namespace_hierarchy`\"\u003e`withinNamespaceHierarchy`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`any`\" pulumi-lang-dotnet=\"`Any`\" pulumi-lang-go=\"`any`\" pulumi-lang-python=\"`any`\" pulumi-lang-yaml=\"`any`\" pulumi-lang-java=\"`any`\" pulumi-lang-hcl=\"`any`\"\u003e`any`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`withinNamespaceHierarchy`\" pulumi-lang-dotnet=\"`WithinNamespaceHierarchy`\" pulumi-lang-go=\"`withinNamespaceHierarchy`\" pulumi-lang-python=\"`within_namespace_hierarchy`\" pulumi-lang-yaml=\"`withinNamespaceHierarchy`\" pulumi-lang-java=\"`withinNamespaceHierarchy`\" pulumi-lang-hcl=\"`within_namespace_hierarchy`\"\u003e`withinNamespaceHierarchy`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "Target namespace. Must be root (`\"\"`) or administrative (`\"admin\"`) namespace. If omitted, the provider's configured namespace is used.\nSet this to `\"\"` to explicitly target the root namespace. The value should not contain leading or trailing forward slashes.\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "groupPolicyApplicationMode" ], "stateInputs": { "description": "Input properties used for looking up and filtering GroupPolicyApplication resources.\n", "properties": { "groupPolicyApplicationMode": { "type": "string", "description": "Mode for group policy application. Must be either \u003cspan pulumi-lang-nodejs=\"`withinNamespaceHierarchy`\" pulumi-lang-dotnet=\"`WithinNamespaceHierarchy`\" pulumi-lang-go=\"`withinNamespaceHierarchy`\" pulumi-lang-python=\"`within_namespace_hierarchy`\" pulumi-lang-yaml=\"`withinNamespaceHierarchy`\" pulumi-lang-java=\"`withinNamespaceHierarchy`\" pulumi-lang-hcl=\"`within_namespace_hierarchy`\"\u003e`withinNamespaceHierarchy`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`any`\" pulumi-lang-dotnet=\"`Any`\" pulumi-lang-go=\"`any`\" pulumi-lang-python=\"`any`\" pulumi-lang-yaml=\"`any`\" pulumi-lang-java=\"`any`\" pulumi-lang-hcl=\"`any`\"\u003e`any`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`withinNamespaceHierarchy`\" pulumi-lang-dotnet=\"`WithinNamespaceHierarchy`\" pulumi-lang-go=\"`withinNamespaceHierarchy`\" pulumi-lang-python=\"`within_namespace_hierarchy`\" pulumi-lang-yaml=\"`withinNamespaceHierarchy`\" pulumi-lang-java=\"`withinNamespaceHierarchy`\" pulumi-lang-hcl=\"`within_namespace_hierarchy`\"\u003e`withinNamespaceHierarchy`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "Target namespace. Must be root (`\"\"`) or administrative (`\"admin\"`) namespace. If omitted, the provider's configured namespace is used.\nSet this to `\"\"` to explicitly target the root namespace. The value should not contain leading or trailing forward slashes.\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:config/uiCustomMessage:UiCustomMessage": { "properties": { "authenticated": { "type": "boolean", "description": "A flag indicating whether the custom message is displayed pre-login (false) or post-login (true)" }, "endTime": { "type": "string", "description": "The ending time of the active period of the custom message. Can be omitted for non-expiring message" }, "link": { "$ref": "#/types/vault:config/UiCustomMessageLink:UiCustomMessageLink", "description": "A block containing a hyperlink associated with the custom message" }, "messageBase64": { "type": "string", "description": "The base64-encoded content of the custom message" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map containing additional options for the custom message" }, "startTime": { "type": "string", "description": "The starting time of the active period of the custom message" }, "title": { "type": "string", "description": "The title of the custom message" }, "type": { "type": "string", "description": "The display type of custom message. Allowed values are banner and modal" } }, "required": [ "messageBase64", "startTime", "title" ], "inputProperties": { "authenticated": { "type": "boolean", "description": "A flag indicating whether the custom message is displayed pre-login (false) or post-login (true)" }, "endTime": { "type": "string", "description": "The ending time of the active period of the custom message. Can be omitted for non-expiring message" }, "link": { "$ref": "#/types/vault:config/UiCustomMessageLink:UiCustomMessageLink", "description": "A block containing a hyperlink associated with the custom message" }, "messageBase64": { "type": "string", "description": "The base64-encoded content of the custom message" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map containing additional options for the custom message" }, "startTime": { "type": "string", "description": "The starting time of the active period of the custom message" }, "title": { "type": "string", "description": "The title of the custom message" }, "type": { "type": "string", "description": "The display type of custom message. Allowed values are banner and modal" } }, "requiredInputs": [ "messageBase64", "startTime", "title" ], "stateInputs": { "description": "Input properties used for looking up and filtering UiCustomMessage resources.\n", "properties": { "authenticated": { "type": "boolean", "description": "A flag indicating whether the custom message is displayed pre-login (false) or post-login (true)" }, "endTime": { "type": "string", "description": "The ending time of the active period of the custom message. Can be omitted for non-expiring message" }, "link": { "$ref": "#/types/vault:config/UiCustomMessageLink:UiCustomMessageLink", "description": "A block containing a hyperlink associated with the custom message" }, "messageBase64": { "type": "string", "description": "The base64-encoded content of the custom message" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map containing additional options for the custom message" }, "startTime": { "type": "string", "description": "The starting time of the active period of the custom message" }, "title": { "type": "string", "description": "The title of the custom message" }, "type": { "type": "string", "description": "The display type of custom message. Allowed values are banner and modal" } }, "type": "object" } }, "vault:config/uiDefaultAuth:UiDefaultAuth": { "description": "Manages the UI default authentication configuration for the Vault GUI login form. This resource configures which authentication method is displayed by default on the Vault UI login page, along with optional backup authentication methods that appear in the \"Sign in with other methods\" tab.\n\n\u003e **Important** This feature is available only with Vault Enterprise 1.20.0 or later.\n\n## Example Usage\n\n### Basic Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.config.UiDefaultAuth(\"example\", {\n name: \"my-auth-config\",\n defaultAuthType: \"ldap\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.config.UiDefaultAuth(\"example\",\n name=\"my-auth-config\",\n default_auth_type=\"ldap\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Config.UiDefaultAuth(\"example\", new()\n {\n Name = \"my-auth-config\",\n DefaultAuthType = \"ldap\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewUiDefaultAuth(ctx, \"example\", \u0026config.UiDefaultAuthArgs{\n\t\t\tName: pulumi.String(\"my-auth-config\"),\n\t\t\tDefaultAuthType: pulumi.String(\"ldap\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_uidefaultauth\" \"example\" {\n name = \"my-auth-config\"\n default_auth_type = \"ldap\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiDefaultAuth;\nimport com.pulumi.vault.config.UiDefaultAuthArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new UiDefaultAuth(\"example\", UiDefaultAuthArgs.builder()\n .name(\"my-auth-config\")\n .defaultAuthType(\"ldap\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:config:UiDefaultAuth\n properties:\n name: my-auth-config\n defaultAuthType: ldap\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Configuration with Backup Methods\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.config.UiDefaultAuth(\"example\", {\n name: \"my-auth-config\",\n defaultAuthType: \"oidc\",\n backupAuthTypes: [\n \"ldap\",\n \"userpass\",\n \"token\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.config.UiDefaultAuth(\"example\",\n name=\"my-auth-config\",\n default_auth_type=\"oidc\",\n backup_auth_types=[\n \"ldap\",\n \"userpass\",\n \"token\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Config.UiDefaultAuth(\"example\", new()\n {\n Name = \"my-auth-config\",\n DefaultAuthType = \"oidc\",\n BackupAuthTypes = new[]\n {\n \"ldap\",\n \"userpass\",\n \"token\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewUiDefaultAuth(ctx, \"example\", \u0026config.UiDefaultAuthArgs{\n\t\t\tName: pulumi.String(\"my-auth-config\"),\n\t\t\tDefaultAuthType: pulumi.String(\"oidc\"),\n\t\t\tBackupAuthTypes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"ldap\"),\n\t\t\t\tpulumi.String(\"userpass\"),\n\t\t\t\tpulumi.String(\"token\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_uidefaultauth\" \"example\" {\n name = \"my-auth-config\"\n default_auth_type = \"oidc\"\n backup_auth_types = [\"ldap\", \"userpass\", \"token\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiDefaultAuth;\nimport com.pulumi.vault.config.UiDefaultAuthArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new UiDefaultAuth(\"example\", UiDefaultAuthArgs.builder()\n .name(\"my-auth-config\")\n .defaultAuthType(\"oidc\")\n .backupAuthTypes( \n \"ldap\",\n \"userpass\",\n \"token\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:config:UiDefaultAuth\n properties:\n name: my-auth-config\n defaultAuthType: oidc\n backupAuthTypes:\n - ldap\n - userpass\n - token\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Configuration for Specific Namespace\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst adminConfig = new vault.config.UiDefaultAuth(\"admin_config\", {\n name: \"admin-auth-config\",\n namespacePath: \"admin\",\n defaultAuthType: \"ldap\",\n backupAuthTypes: [\"token\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nadmin_config = vault.config.UiDefaultAuth(\"admin_config\",\n name=\"admin-auth-config\",\n namespace_path=\"admin\",\n default_auth_type=\"ldap\",\n backup_auth_types=[\"token\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var adminConfig = new Vault.Config.UiDefaultAuth(\"admin_config\", new()\n {\n Name = \"admin-auth-config\",\n NamespacePath = \"admin\",\n DefaultAuthType = \"ldap\",\n BackupAuthTypes = new[]\n {\n \"token\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewUiDefaultAuth(ctx, \"admin_config\", \u0026config.UiDefaultAuthArgs{\n\t\t\tName: pulumi.String(\"admin-auth-config\"),\n\t\t\tNamespacePath: pulumi.String(\"admin\"),\n\t\t\tDefaultAuthType: pulumi.String(\"ldap\"),\n\t\t\tBackupAuthTypes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"token\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_uidefaultauth\" \"admin_config\" {\n name = \"admin-auth-config\"\n namespace_path = \"admin\"\n default_auth_type = \"ldap\"\n backup_auth_types = [\"token\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiDefaultAuth;\nimport com.pulumi.vault.config.UiDefaultAuthArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var adminConfig = new UiDefaultAuth(\"adminConfig\", UiDefaultAuthArgs.builder()\n .name(\"admin-auth-config\")\n .namespacePath(\"admin\")\n .defaultAuthType(\"ldap\")\n .backupAuthTypes(\"token\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n adminConfig:\n type: vault:config:UiDefaultAuth\n name: admin_config\n properties:\n name: admin-auth-config\n namespacePath: admin\n defaultAuthType: ldap\n backupAuthTypes:\n - token\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Configuration with Inheritance Disabled\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst parentConfig = new vault.config.UiDefaultAuth(\"parent_config\", {\n name: \"parent-auth-config\",\n namespacePath: \"parent\",\n defaultAuthType: \"oidc\",\n backupAuthTypes: [\n \"github\",\n \"token\",\n ],\n disableInheritance: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nparent_config = vault.config.UiDefaultAuth(\"parent_config\",\n name=\"parent-auth-config\",\n namespace_path=\"parent\",\n default_auth_type=\"oidc\",\n backup_auth_types=[\n \"github\",\n \"token\",\n ],\n disable_inheritance=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var parentConfig = new Vault.Config.UiDefaultAuth(\"parent_config\", new()\n {\n Name = \"parent-auth-config\",\n NamespacePath = \"parent\",\n DefaultAuthType = \"oidc\",\n BackupAuthTypes = new[]\n {\n \"github\",\n \"token\",\n },\n DisableInheritance = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewUiDefaultAuth(ctx, \"parent_config\", \u0026config.UiDefaultAuthArgs{\n\t\t\tName: pulumi.String(\"parent-auth-config\"),\n\t\t\tNamespacePath: pulumi.String(\"parent\"),\n\t\t\tDefaultAuthType: pulumi.String(\"oidc\"),\n\t\t\tBackupAuthTypes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"github\"),\n\t\t\t\tpulumi.String(\"token\"),\n\t\t\t},\n\t\t\tDisableInheritance: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_uidefaultauth\" \"parent_config\" {\n name = \"parent-auth-config\"\n namespace_path = \"parent\"\n default_auth_type = \"oidc\"\n backup_auth_types = [\"github\", \"token\"]\n disable_inheritance = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiDefaultAuth;\nimport com.pulumi.vault.config.UiDefaultAuthArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var parentConfig = new UiDefaultAuth(\"parentConfig\", UiDefaultAuthArgs.builder()\n .name(\"parent-auth-config\")\n .namespacePath(\"parent\")\n .defaultAuthType(\"oidc\")\n .backupAuthTypes( \n \"github\",\n \"token\")\n .disableInheritance(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n parentConfig:\n type: vault:config:UiDefaultAuth\n name: parent_config\n properties:\n name: parent-auth-config\n namespacePath: parent\n defaultAuthType: oidc\n backupAuthTypes:\n - github\n - token\n disableInheritance: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Complete Configuration Example\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst complete = new vault.config.UiDefaultAuth(\"complete\", {\n name: \"complete-auth-config\",\n namespacePath: \"engineering\",\n defaultAuthType: \"oidc\",\n backupAuthTypes: [\n \"ldap\",\n \"userpass\",\n \"token\",\n ],\n disableInheritance: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ncomplete = vault.config.UiDefaultAuth(\"complete\",\n name=\"complete-auth-config\",\n namespace_path=\"engineering\",\n default_auth_type=\"oidc\",\n backup_auth_types=[\n \"ldap\",\n \"userpass\",\n \"token\",\n ],\n disable_inheritance=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var complete = new Vault.Config.UiDefaultAuth(\"complete\", new()\n {\n Name = \"complete-auth-config\",\n NamespacePath = \"engineering\",\n DefaultAuthType = \"oidc\",\n BackupAuthTypes = new[]\n {\n \"ldap\",\n \"userpass\",\n \"token\",\n },\n DisableInheritance = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewUiDefaultAuth(ctx, \"complete\", \u0026config.UiDefaultAuthArgs{\n\t\t\tName: pulumi.String(\"complete-auth-config\"),\n\t\t\tNamespacePath: pulumi.String(\"engineering\"),\n\t\t\tDefaultAuthType: pulumi.String(\"oidc\"),\n\t\t\tBackupAuthTypes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"ldap\"),\n\t\t\t\tpulumi.String(\"userpass\"),\n\t\t\t\tpulumi.String(\"token\"),\n\t\t\t},\n\t\t\tDisableInheritance: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_uidefaultauth\" \"complete\" {\n name = \"complete-auth-config\"\n namespace_path = \"engineering\"\n default_auth_type = \"oidc\"\n backup_auth_types = [\"ldap\", \"userpass\", \"token\"]\n disable_inheritance = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiDefaultAuth;\nimport com.pulumi.vault.config.UiDefaultAuthArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var complete = new UiDefaultAuth(\"complete\", UiDefaultAuthArgs.builder()\n .name(\"complete-auth-config\")\n .namespacePath(\"engineering\")\n .defaultAuthType(\"oidc\")\n .backupAuthTypes( \n \"ldap\",\n \"userpass\",\n \"token\")\n .disableInheritance(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n complete:\n type: vault:config:UiDefaultAuth\n properties:\n name: complete-auth-config\n namespacePath: engineering\n defaultAuthType: oidc\n backupAuthTypes:\n - ldap\n - userpass\n - token\n disableInheritance: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Notes\n\n* **Enterprise Only**: This resource requires Vault Enterprise 1.20.0 or later.\n\n* **Authentication Methods**: The authentication methods specified in \u003cspan pulumi-lang-nodejs=\"`defaultAuthType`\" pulumi-lang-dotnet=\"`DefaultAuthType`\" pulumi-lang-go=\"`defaultAuthType`\" pulumi-lang-python=\"`default_auth_type`\" pulumi-lang-yaml=\"`defaultAuthType`\" pulumi-lang-java=\"`defaultAuthType`\" pulumi-lang-hcl=\"`default_auth_type`\"\u003e`defaultAuthType`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`backupAuthTypes`\" pulumi-lang-dotnet=\"`BackupAuthTypes`\" pulumi-lang-go=\"`backupAuthTypes`\" pulumi-lang-python=\"`backup_auth_types`\" pulumi-lang-yaml=\"`backupAuthTypes`\" pulumi-lang-java=\"`backupAuthTypes`\" pulumi-lang-hcl=\"`backup_auth_types`\"\u003e`backupAuthTypes`\u003c/span\u003e must be enabled in Vault before they can be used in the UI configuration. The resource validates that only supported auth types are used.\n\n* **Root Namespace**: When \u003cspan pulumi-lang-nodejs=\"`namespacePath`\" pulumi-lang-dotnet=\"`NamespacePath`\" pulumi-lang-go=\"`namespacePath`\" pulumi-lang-python=\"`namespace_path`\" pulumi-lang-yaml=\"`namespacePath`\" pulumi-lang-java=\"`namespacePath`\" pulumi-lang-hcl=\"`namespace_path`\"\u003e`namespacePath`\u003c/span\u003e is empty, omitted, or set to `\"root\"` or `\"root/\"`, the configuration applies to the root namespace. All these values are treated equivalently.\n\n* **Order Preservation**: The order of methods in \u003cspan pulumi-lang-nodejs=\"`backupAuthTypes`\" pulumi-lang-dotnet=\"`BackupAuthTypes`\" pulumi-lang-go=\"`backupAuthTypes`\" pulumi-lang-python=\"`backup_auth_types`\" pulumi-lang-yaml=\"`backupAuthTypes`\" pulumi-lang-java=\"`backupAuthTypes`\" pulumi-lang-hcl=\"`backup_auth_types`\"\u003e`backupAuthTypes`\u003c/span\u003e is preserved and determines the display order in the Vault UI's \"Sign in with other methods\" tab.\n\n* **Supported Auth Types**: The following authentication types are supported: \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`okta`\" pulumi-lang-dotnet=\"`Okta`\" pulumi-lang-go=\"`okta`\" pulumi-lang-python=\"`okta`\" pulumi-lang-yaml=\"`okta`\" pulumi-lang-java=\"`okta`\" pulumi-lang-hcl=\"`okta`\"\u003e`okta`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`radius`\" pulumi-lang-dotnet=\"`Radius`\" pulumi-lang-go=\"`radius`\" pulumi-lang-python=\"`radius`\" pulumi-lang-yaml=\"`radius`\" pulumi-lang-java=\"`radius`\" pulumi-lang-hcl=\"`radius`\"\u003e`radius`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`saml`\" pulumi-lang-dotnet=\"`Saml`\" pulumi-lang-go=\"`saml`\" pulumi-lang-python=\"`saml`\" pulumi-lang-yaml=\"`saml`\" pulumi-lang-java=\"`saml`\" pulumi-lang-hcl=\"`saml`\"\u003e`saml`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e. These correspond to Vault's authentication methods.\n\n## API Documentation\n\nFor more details on the underlying Vault API, see the [Vault UI Default Auth API documentation](https://developer.hashicorp.com/vault/api-docs/system/config-ui-login-default-auth).\n\n## Import\n\nUI default authentication configurations can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:config/uiDefaultAuth:UiDefaultAuth example my-auth-config\n```\n\n### Importing with Namespaces\n\nWhen importing a configuration that exists in a specific namespace, you must set the `TERRAFORM_VAULT_NAMESPACE_IMPORT` environment variable to ensure proper resource management:\n\n```sh\n$ export TERRAFORM_VAULT_NAMESPACE_IMPORT=admin\n$ pulumi import vault:config/uiDefaultAuth:UiDefaultAuth example my-auth-config\n```\n\nWithout setting the namespace during import, subsequent operations (update/delete) may target the wrong namespace and fail.\n\n", "properties": { "backupAuthTypes": { "type": "array", "items": { "type": "string" }, "description": "List of backup authentication methods displayed in the \"Sign in with other methods\" tab in the Vault UI. Each value must be a valid authentication type from the same list as \u003cspan pulumi-lang-nodejs=\"`defaultAuthType`\" pulumi-lang-dotnet=\"`DefaultAuthType`\" pulumi-lang-go=\"`defaultAuthType`\" pulumi-lang-python=\"`default_auth_type`\" pulumi-lang-yaml=\"`defaultAuthType`\" pulumi-lang-java=\"`defaultAuthType`\" pulumi-lang-hcl=\"`default_auth_type`\"\u003e`defaultAuthType`\u003c/span\u003e. The order of methods is preserved as specified.\n" }, "defaultAuthType": { "type": "string", "description": "The default authentication method displayed on the Vault UI login page. Must be one of: \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`okta`\" pulumi-lang-dotnet=\"`Okta`\" pulumi-lang-go=\"`okta`\" pulumi-lang-python=\"`okta`\" pulumi-lang-yaml=\"`okta`\" pulumi-lang-java=\"`okta`\" pulumi-lang-hcl=\"`okta`\"\u003e`okta`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`radius`\" pulumi-lang-dotnet=\"`Radius`\" pulumi-lang-go=\"`radius`\" pulumi-lang-python=\"`radius`\" pulumi-lang-yaml=\"`radius`\" pulumi-lang-java=\"`radius`\" pulumi-lang-hcl=\"`radius`\"\u003e`radius`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`saml`\" pulumi-lang-dotnet=\"`Saml`\" pulumi-lang-go=\"`saml`\" pulumi-lang-python=\"`saml`\" pulumi-lang-yaml=\"`saml`\" pulumi-lang-java=\"`saml`\" pulumi-lang-hcl=\"`saml`\"\u003e`saml`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e, or \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e.\n" }, "disableInheritance": { "type": "boolean", "description": "If \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, child namespaces will not inherit the \u003cspan pulumi-lang-nodejs=\"`defaultAuthType`\" pulumi-lang-dotnet=\"`DefaultAuthType`\" pulumi-lang-go=\"`defaultAuthType`\" pulumi-lang-python=\"`default_auth_type`\" pulumi-lang-yaml=\"`defaultAuthType`\" pulumi-lang-java=\"`defaultAuthType`\" pulumi-lang-hcl=\"`default_auth_type`\"\u003e`defaultAuthType`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`backupAuthTypes`\" pulumi-lang-dotnet=\"`BackupAuthTypes`\" pulumi-lang-go=\"`backupAuthTypes`\" pulumi-lang-python=\"`backup_auth_types`\" pulumi-lang-yaml=\"`backupAuthTypes`\" pulumi-lang-java=\"`backupAuthTypes`\" pulumi-lang-hcl=\"`backup_auth_types`\"\u003e`backupAuthTypes`\u003c/span\u003e from this configuration. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "name": { "type": "string", "description": "Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "namespacePath": { "type": "string", "description": "Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values `\"\"`, `\"root\"`, and `\"root/\"` are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.\n" } }, "required": [ "defaultAuthType", "name" ], "inputProperties": { "backupAuthTypes": { "type": "array", "items": { "type": "string" }, "description": "List of backup authentication methods displayed in the \"Sign in with other methods\" tab in the Vault UI. Each value must be a valid authentication type from the same list as \u003cspan pulumi-lang-nodejs=\"`defaultAuthType`\" pulumi-lang-dotnet=\"`DefaultAuthType`\" pulumi-lang-go=\"`defaultAuthType`\" pulumi-lang-python=\"`default_auth_type`\" pulumi-lang-yaml=\"`defaultAuthType`\" pulumi-lang-java=\"`defaultAuthType`\" pulumi-lang-hcl=\"`default_auth_type`\"\u003e`defaultAuthType`\u003c/span\u003e. The order of methods is preserved as specified.\n" }, "defaultAuthType": { "type": "string", "description": "The default authentication method displayed on the Vault UI login page. Must be one of: \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`okta`\" pulumi-lang-dotnet=\"`Okta`\" pulumi-lang-go=\"`okta`\" pulumi-lang-python=\"`okta`\" pulumi-lang-yaml=\"`okta`\" pulumi-lang-java=\"`okta`\" pulumi-lang-hcl=\"`okta`\"\u003e`okta`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`radius`\" pulumi-lang-dotnet=\"`Radius`\" pulumi-lang-go=\"`radius`\" pulumi-lang-python=\"`radius`\" pulumi-lang-yaml=\"`radius`\" pulumi-lang-java=\"`radius`\" pulumi-lang-hcl=\"`radius`\"\u003e`radius`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`saml`\" pulumi-lang-dotnet=\"`Saml`\" pulumi-lang-go=\"`saml`\" pulumi-lang-python=\"`saml`\" pulumi-lang-yaml=\"`saml`\" pulumi-lang-java=\"`saml`\" pulumi-lang-hcl=\"`saml`\"\u003e`saml`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e, or \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e.\n" }, "disableInheritance": { "type": "boolean", "description": "If \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, child namespaces will not inherit the \u003cspan pulumi-lang-nodejs=\"`defaultAuthType`\" pulumi-lang-dotnet=\"`DefaultAuthType`\" pulumi-lang-go=\"`defaultAuthType`\" pulumi-lang-python=\"`default_auth_type`\" pulumi-lang-yaml=\"`defaultAuthType`\" pulumi-lang-java=\"`defaultAuthType`\" pulumi-lang-hcl=\"`default_auth_type`\"\u003e`defaultAuthType`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`backupAuthTypes`\" pulumi-lang-dotnet=\"`BackupAuthTypes`\" pulumi-lang-go=\"`backupAuthTypes`\" pulumi-lang-python=\"`backup_auth_types`\" pulumi-lang-yaml=\"`backupAuthTypes`\" pulumi-lang-java=\"`backupAuthTypes`\" pulumi-lang-hcl=\"`backup_auth_types`\"\u003e`backupAuthTypes`\u003c/span\u003e from this configuration. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "name": { "type": "string", "description": "Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "namespacePath": { "type": "string", "description": "Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values `\"\"`, `\"root\"`, and `\"root/\"` are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.\n" } }, "requiredInputs": [ "defaultAuthType" ], "stateInputs": { "description": "Input properties used for looking up and filtering UiDefaultAuth resources.\n", "properties": { "backupAuthTypes": { "type": "array", "items": { "type": "string" }, "description": "List of backup authentication methods displayed in the \"Sign in with other methods\" tab in the Vault UI. Each value must be a valid authentication type from the same list as \u003cspan pulumi-lang-nodejs=\"`defaultAuthType`\" pulumi-lang-dotnet=\"`DefaultAuthType`\" pulumi-lang-go=\"`defaultAuthType`\" pulumi-lang-python=\"`default_auth_type`\" pulumi-lang-yaml=\"`defaultAuthType`\" pulumi-lang-java=\"`defaultAuthType`\" pulumi-lang-hcl=\"`default_auth_type`\"\u003e`defaultAuthType`\u003c/span\u003e. The order of methods is preserved as specified.\n" }, "defaultAuthType": { "type": "string", "description": "The default authentication method displayed on the Vault UI login page. Must be one of: \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`okta`\" pulumi-lang-dotnet=\"`Okta`\" pulumi-lang-go=\"`okta`\" pulumi-lang-python=\"`okta`\" pulumi-lang-yaml=\"`okta`\" pulumi-lang-java=\"`okta`\" pulumi-lang-hcl=\"`okta`\"\u003e`okta`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`radius`\" pulumi-lang-dotnet=\"`Radius`\" pulumi-lang-go=\"`radius`\" pulumi-lang-python=\"`radius`\" pulumi-lang-yaml=\"`radius`\" pulumi-lang-java=\"`radius`\" pulumi-lang-hcl=\"`radius`\"\u003e`radius`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`saml`\" pulumi-lang-dotnet=\"`Saml`\" pulumi-lang-go=\"`saml`\" pulumi-lang-python=\"`saml`\" pulumi-lang-yaml=\"`saml`\" pulumi-lang-java=\"`saml`\" pulumi-lang-hcl=\"`saml`\"\u003e`saml`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e, or \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e.\n" }, "disableInheritance": { "type": "boolean", "description": "If \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, child namespaces will not inherit the \u003cspan pulumi-lang-nodejs=\"`defaultAuthType`\" pulumi-lang-dotnet=\"`DefaultAuthType`\" pulumi-lang-go=\"`defaultAuthType`\" pulumi-lang-python=\"`default_auth_type`\" pulumi-lang-yaml=\"`defaultAuthType`\" pulumi-lang-java=\"`defaultAuthType`\" pulumi-lang-hcl=\"`default_auth_type`\"\u003e`defaultAuthType`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`backupAuthTypes`\" pulumi-lang-dotnet=\"`BackupAuthTypes`\" pulumi-lang-go=\"`backupAuthTypes`\" pulumi-lang-python=\"`backup_auth_types`\" pulumi-lang-yaml=\"`backupAuthTypes`\" pulumi-lang-java=\"`backupAuthTypes`\" pulumi-lang-hcl=\"`backup_auth_types`\"\u003e`backupAuthTypes`\u003c/span\u003e from this configuration. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "name": { "type": "string", "description": "Unique identifier for the configuration. Can contain letters, numbers, underscores, and dashes. Changing this forces resource recreation.\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "namespacePath": { "type": "string", "description": "Target namespace for the configuration. Omit or leave empty to apply the configuration to the root namespace. Values `\"\"`, `\"root\"`, and `\"root/\"` are all treated as the root namespace. Vault returns namespace paths with trailing slashes, which are normalized to match your configuration format.\n" } }, "type": "object" } }, "vault:config/uiHeader:UiHeader": { "description": "Manages custom HTTP headers for the Vault UI. This resource allows you to configure\ncustom HTTP response headers that will be sent by the Vault UI, enabling security\npolicies, CORS configuration, and custom organizational headers.\n\n\u003e **Important** This resource requires **Vault 1.16.0 or later**. The `sys/config/ui/headers` API endpoint was introduced in Vault 1.16.0.\n\n\u003e **Important** All operations on this resource require the \u003cspan pulumi-lang-nodejs=\"`sudo`\" pulumi-lang-dotnet=\"`Sudo`\" pulumi-lang-go=\"`sudo`\" pulumi-lang-python=\"`sudo`\" pulumi-lang-yaml=\"`sudo`\" pulumi-lang-java=\"`sudo`\" pulumi-lang-hcl=\"`sudo`\"\u003e`sudo`\u003c/span\u003e capability on the\n`sys/config/ui/headers/*` path.\n\n## Example Usage\n\n### Basic Header Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst custom = new vault.config.UiHeader(\"custom\", {\n name: \"X-Custom-Header\",\n values: [\"custom-value\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ncustom = vault.config.UiHeader(\"custom\",\n name=\"X-Custom-Header\",\n values=[\"custom-value\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var custom = new Vault.Config.UiHeader(\"custom\", new()\n {\n Name = \"X-Custom-Header\",\n Values = new[]\n {\n \"custom-value\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewUiHeader(ctx, \"custom\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"X-Custom-Header\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"custom-value\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_uiheader\" \"custom\" {\n name = \"X-Custom-Header\"\n values = [\"custom-value\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiHeader;\nimport com.pulumi.vault.config.UiHeaderArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var custom = new UiHeader(\"custom\", UiHeaderArgs.builder()\n .name(\"X-Custom-Header\")\n .values(\"custom-value\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n custom:\n type: vault:config:UiHeader\n properties:\n name: X-Custom-Header\n values:\n - custom-value\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Security Headers\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\n// Content Security Policy\nconst csp = new vault.config.UiHeader(\"csp\", {\n name: \"Content-Security-Policy\",\n values: [\"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'\"],\n});\n// X-Frame-Options\nconst frameOptions = new vault.config.UiHeader(\"frame_options\", {\n name: \"X-Frame-Options\",\n values: [\"DENY\"],\n});\n// Strict Transport Security\nconst hsts = new vault.config.UiHeader(\"hsts\", {\n name: \"Strict-Transport-Security\",\n values: [\"max-age=31536000; includeSubDomains; preload\"],\n});\n// X-Content-Type-Options\nconst contentTypeOptions = new vault.config.UiHeader(\"content_type_options\", {\n name: \"X-Content-Type-Options\",\n values: [\"nosniff\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\n# Content Security Policy\ncsp = vault.config.UiHeader(\"csp\",\n name=\"Content-Security-Policy\",\n values=[\"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'\"])\n# X-Frame-Options\nframe_options = vault.config.UiHeader(\"frame_options\",\n name=\"X-Frame-Options\",\n values=[\"DENY\"])\n# Strict Transport Security\nhsts = vault.config.UiHeader(\"hsts\",\n name=\"Strict-Transport-Security\",\n values=[\"max-age=31536000; includeSubDomains; preload\"])\n# X-Content-Type-Options\ncontent_type_options = vault.config.UiHeader(\"content_type_options\",\n name=\"X-Content-Type-Options\",\n values=[\"nosniff\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n // Content Security Policy\n var csp = new Vault.Config.UiHeader(\"csp\", new()\n {\n Name = \"Content-Security-Policy\",\n Values = new[]\n {\n \"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'\",\n },\n });\n\n // X-Frame-Options\n var frameOptions = new Vault.Config.UiHeader(\"frame_options\", new()\n {\n Name = \"X-Frame-Options\",\n Values = new[]\n {\n \"DENY\",\n },\n });\n\n // Strict Transport Security\n var hsts = new Vault.Config.UiHeader(\"hsts\", new()\n {\n Name = \"Strict-Transport-Security\",\n Values = new[]\n {\n \"max-age=31536000; includeSubDomains; preload\",\n },\n });\n\n // X-Content-Type-Options\n var contentTypeOptions = new Vault.Config.UiHeader(\"content_type_options\", new()\n {\n Name = \"X-Content-Type-Options\",\n Values = new[]\n {\n \"nosniff\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t// Content Security Policy\n\t\t_, err := config.NewUiHeader(ctx, \"csp\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"Content-Security-Policy\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// X-Frame-Options\n\t\t_, err = config.NewUiHeader(ctx, \"frame_options\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"X-Frame-Options\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"DENY\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// Strict Transport Security\n\t\t_, err = config.NewUiHeader(ctx, \"hsts\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"Strict-Transport-Security\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"max-age=31536000; includeSubDomains; preload\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// X-Content-Type-Options\n\t\t_, err = config.NewUiHeader(ctx, \"content_type_options\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"X-Content-Type-Options\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"nosniff\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\n# Content Security Policy\nresource \"vault_config_uiheader\" \"csp\" {\n name = \"Content-Security-Policy\"\n values = [\"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'\"]\n}\n# X-Frame-Options\nresource \"vault_config_uiheader\" \"frame_options\" {\n name = \"X-Frame-Options\"\n values = [\"DENY\"]\n}\n# Strict Transport Security\nresource \"vault_config_uiheader\" \"hsts\" {\n name = \"Strict-Transport-Security\"\n values = [\"max-age=31536000; includeSubDomains; preload\"]\n}\n# X-Content-Type-Options\nresource \"vault_config_uiheader\" \"content_type_options\" {\n name = \"X-Content-Type-Options\"\n values = [\"nosniff\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiHeader;\nimport com.pulumi.vault.config.UiHeaderArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n // Content Security Policy\n var csp = new UiHeader(\"csp\", UiHeaderArgs.builder()\n .name(\"Content-Security-Policy\")\n .values(\"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'\")\n .build());\n\n // X-Frame-Options\n var frameOptions = new UiHeader(\"frameOptions\", UiHeaderArgs.builder()\n .name(\"X-Frame-Options\")\n .values(\"DENY\")\n .build());\n\n // Strict Transport Security\n var hsts = new UiHeader(\"hsts\", UiHeaderArgs.builder()\n .name(\"Strict-Transport-Security\")\n .values(\"max-age=31536000; includeSubDomains; preload\")\n .build());\n\n // X-Content-Type-Options\n var contentTypeOptions = new UiHeader(\"contentTypeOptions\", UiHeaderArgs.builder()\n .name(\"X-Content-Type-Options\")\n .values(\"nosniff\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n # Content Security Policy\n csp:\n type: vault:config:UiHeader\n properties:\n name: Content-Security-Policy\n values:\n - default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'\n # X-Frame-Options\n frameOptions:\n type: vault:config:UiHeader\n name: frame_options\n properties:\n name: X-Frame-Options\n values:\n - DENY\n # Strict Transport Security\n hsts:\n type: vault:config:UiHeader\n properties:\n name: Strict-Transport-Security\n values:\n - max-age=31536000; includeSubDomains; preload\n # X-Content-Type-Options\n contentTypeOptions:\n type: vault:config:UiHeader\n name: content_type_options\n properties:\n name: X-Content-Type-Options\n values:\n - nosniff\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### CORS Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst corsOrigin = new vault.config.UiHeader(\"cors_origin\", {\n name: \"Access-Control-Allow-Origin\",\n values: [\n \"https://example.com\",\n \"https://app.example.com\",\n ],\n});\nconst corsMethods = new vault.config.UiHeader(\"cors_methods\", {\n name: \"Access-Control-Allow-Methods\",\n values: [\n \"GET\",\n \"POST\",\n \"OPTIONS\",\n ],\n});\nconst corsHeaders = new vault.config.UiHeader(\"cors_headers\", {\n name: \"Access-Control-Allow-Headers\",\n values: [\n \"Content-Type\",\n \"Authorization\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ncors_origin = vault.config.UiHeader(\"cors_origin\",\n name=\"Access-Control-Allow-Origin\",\n values=[\n \"https://example.com\",\n \"https://app.example.com\",\n ])\ncors_methods = vault.config.UiHeader(\"cors_methods\",\n name=\"Access-Control-Allow-Methods\",\n values=[\n \"GET\",\n \"POST\",\n \"OPTIONS\",\n ])\ncors_headers = vault.config.UiHeader(\"cors_headers\",\n name=\"Access-Control-Allow-Headers\",\n values=[\n \"Content-Type\",\n \"Authorization\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var corsOrigin = new Vault.Config.UiHeader(\"cors_origin\", new()\n {\n Name = \"Access-Control-Allow-Origin\",\n Values = new[]\n {\n \"https://example.com\",\n \"https://app.example.com\",\n },\n });\n\n var corsMethods = new Vault.Config.UiHeader(\"cors_methods\", new()\n {\n Name = \"Access-Control-Allow-Methods\",\n Values = new[]\n {\n \"GET\",\n \"POST\",\n \"OPTIONS\",\n },\n });\n\n var corsHeaders = new Vault.Config.UiHeader(\"cors_headers\", new()\n {\n Name = \"Access-Control-Allow-Headers\",\n Values = new[]\n {\n \"Content-Type\",\n \"Authorization\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewUiHeader(ctx, \"cors_origin\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"Access-Control-Allow-Origin\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://example.com\"),\n\t\t\t\tpulumi.String(\"https://app.example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = config.NewUiHeader(ctx, \"cors_methods\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"Access-Control-Allow-Methods\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"GET\"),\n\t\t\t\tpulumi.String(\"POST\"),\n\t\t\t\tpulumi.String(\"OPTIONS\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = config.NewUiHeader(ctx, \"cors_headers\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"Access-Control-Allow-Headers\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"Content-Type\"),\n\t\t\t\tpulumi.String(\"Authorization\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_uiheader\" \"cors_origin\" {\n name = \"Access-Control-Allow-Origin\"\n values = [\"https://example.com\", \"https://app.example.com\"]\n}\nresource \"vault_config_uiheader\" \"cors_methods\" {\n name = \"Access-Control-Allow-Methods\"\n values = [\"GET\", \"POST\", \"OPTIONS\"]\n}\nresource \"vault_config_uiheader\" \"cors_headers\" {\n name = \"Access-Control-Allow-Headers\"\n values = [\"Content-Type\", \"Authorization\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiHeader;\nimport com.pulumi.vault.config.UiHeaderArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var corsOrigin = new UiHeader(\"corsOrigin\", UiHeaderArgs.builder()\n .name(\"Access-Control-Allow-Origin\")\n .values( \n \"https://example.com\",\n \"https://app.example.com\")\n .build());\n\n var corsMethods = new UiHeader(\"corsMethods\", UiHeaderArgs.builder()\n .name(\"Access-Control-Allow-Methods\")\n .values( \n \"GET\",\n \"POST\",\n \"OPTIONS\")\n .build());\n\n var corsHeaders = new UiHeader(\"corsHeaders\", UiHeaderArgs.builder()\n .name(\"Access-Control-Allow-Headers\")\n .values( \n \"Content-Type\",\n \"Authorization\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n corsOrigin:\n type: vault:config:UiHeader\n name: cors_origin\n properties:\n name: Access-Control-Allow-Origin\n values:\n - https://example.com\n - https://app.example.com\n corsMethods:\n type: vault:config:UiHeader\n name: cors_methods\n properties:\n name: Access-Control-Allow-Methods\n values:\n - GET\n - POST\n - OPTIONS\n corsHeaders:\n type: vault:config:UiHeader\n name: cors_headers\n properties:\n name: Access-Control-Allow-Headers\n values:\n - Content-Type\n - Authorization\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Multiple Values\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst multiValue = new vault.config.UiHeader(\"multi_value\", {\n name: \"X-Multi-Value-Header\",\n values: [\n \"value1\",\n \"value2\",\n \"value3\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nmulti_value = vault.config.UiHeader(\"multi_value\",\n name=\"X-Multi-Value-Header\",\n values=[\n \"value1\",\n \"value2\",\n \"value3\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var multiValue = new Vault.Config.UiHeader(\"multi_value\", new()\n {\n Name = \"X-Multi-Value-Header\",\n Values = new[]\n {\n \"value1\",\n \"value2\",\n \"value3\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewUiHeader(ctx, \"multi_value\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"X-Multi-Value-Header\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"value1\"),\n\t\t\t\tpulumi.String(\"value2\"),\n\t\t\t\tpulumi.String(\"value3\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_uiheader\" \"multi_value\" {\n name = \"X-Multi-Value-Header\"\n values = [\"value1\", \"value2\", \"value3\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiHeader;\nimport com.pulumi.vault.config.UiHeaderArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var multiValue = new UiHeader(\"multiValue\", UiHeaderArgs.builder()\n .name(\"X-Multi-Value-Header\")\n .values( \n \"value1\",\n \"value2\",\n \"value3\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n multiValue:\n type: vault:config:UiHeader\n name: multi_value\n properties:\n name: X-Multi-Value-Header\n values:\n - value1\n - value2\n - value3\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Migration from\u003cspan pulumi-lang-nodejs=\" vault.generic.Endpoint\n\" pulumi-lang-dotnet=\" vault.generic.Endpoint\n\" pulumi-lang-go=\" generic.Endpoint\n\" pulumi-lang-python=\" generic.Endpoint\n\" pulumi-lang-yaml=\" vault.generic.Endpoint\n\" pulumi-lang-java=\" vault.generic.Endpoint\n\" pulumi-lang-hcl=\" vault_generic_endpoint\n\"\u003e vault.generic.Endpoint\n\u003c/span\u003e\nIf you're currently managing UI headers using \u003cspan pulumi-lang-nodejs=\"`vault.generic.Endpoint`\" pulumi-lang-dotnet=\"`vault.generic.Endpoint`\" pulumi-lang-go=\"`generic.Endpoint`\" pulumi-lang-python=\"`generic.Endpoint`\" pulumi-lang-yaml=\"`vault.generic.Endpoint`\" pulumi-lang-java=\"`vault.generic.Endpoint`\" pulumi-lang-hcl=\"`vault_generic_endpoint`\"\u003e`vault.generic.Endpoint`\u003c/span\u003e, you can migrate\nto this dedicated resource:\n\n### Before (using generic_endpoint)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst cspHeader = new vault.generic.Endpoint(\"csp_header\", {\n path: \"sys/config/ui/headers/Content-Security-Policy\",\n dataJson: JSON.stringify({\n values: [\"default-src 'self'\"],\n }),\n});\n```\n```python\nimport pulumi\nimport json\nimport pulumi_vault as vault\n\ncsp_header = vault.generic.Endpoint(\"csp_header\",\n path=\"sys/config/ui/headers/Content-Security-Policy\",\n data_json=json.dumps({\n \"values\": [\"default-src 'self'\"],\n }))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text.Json;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var cspHeader = new Vault.Generic.Endpoint(\"csp_header\", new()\n {\n Path = \"sys/config/ui/headers/Content-Security-Policy\",\n DataJson = JsonSerializer.Serialize(new Dictionary\u003cstring, object?\u003e\n {\n [\"values\"] = new[]\n {\n \"default-src 'self'\",\n },\n }),\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/generic\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttmpJSON0, err := json.Marshal(map[string][]string{\n\t\t\t\"values\": []string{\n\t\t\t\t\"default-src 'self'\",\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjson0 := string(tmpJSON0)\n\t\t_, err = generic.NewEndpoint(ctx, \"csp_header\", \u0026generic.EndpointArgs{\n\t\t\tPath: pulumi.String(\"sys/config/ui/headers/Content-Security-Policy\"),\n\t\t\tDataJson: pulumi.String(json0),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_generic_endpoint\" \"csp_header\" {\n path = \"sys/config/ui/headers/Content-Security-Policy\"\n data_json = jsonencode({\n \"values\" = [\"default-src 'self'\"]\n })\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.generic.Endpoint;\nimport com.pulumi.vault.generic.EndpointArgs;\nimport static com.pulumi.codegen.internal.Serialization.*;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var cspHeader = new Endpoint(\"cspHeader\", EndpointArgs.builder()\n .path(\"sys/config/ui/headers/Content-Security-Policy\")\n .dataJson(serializeJson(\n jsonObject(\n jsonProperty(\"values\", jsonArray(\"default-src 'self'\"))\n )))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n cspHeader:\n type: vault:generic:Endpoint\n name: csp_header\n properties:\n path: sys/config/ui/headers/Content-Security-Policy\n dataJson:\n fn::toJSON:\n values:\n - default-src 'self'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### After (using dedicated resource)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst csp = new vault.config.UiHeader(\"csp\", {\n name: \"Content-Security-Policy\",\n values: [\"default-src 'self'\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ncsp = vault.config.UiHeader(\"csp\",\n name=\"Content-Security-Policy\",\n values=[\"default-src 'self'\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var csp = new Vault.Config.UiHeader(\"csp\", new()\n {\n Name = \"Content-Security-Policy\",\n Values = new[]\n {\n \"default-src 'self'\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := config.NewUiHeader(ctx, \"csp\", \u0026config.UiHeaderArgs{\n\t\t\tName: pulumi.String(\"Content-Security-Policy\"),\n\t\t\tValues: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default-src 'self'\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_config_uiheader\" \"csp\" {\n name = \"Content-Security-Policy\"\n values = [\"default-src 'self'\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.config.UiHeader;\nimport com.pulumi.vault.config.UiHeaderArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var csp = new UiHeader(\"csp\", UiHeaderArgs.builder()\n .name(\"Content-Security-Policy\")\n .values(\"default-src 'self'\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n csp:\n type: vault:config:UiHeader\n properties:\n name: Content-Security-Policy\n values:\n - default-src 'self'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Migration Steps\n\n1. Add the new \u003cspan pulumi-lang-nodejs=\"`vault.config.UiHeader`\" pulumi-lang-dotnet=\"`vault.config.UiHeader`\" pulumi-lang-go=\"`config.UiHeader`\" pulumi-lang-python=\"`config.UiHeader`\" pulumi-lang-yaml=\"`vault.config.UiHeader`\" pulumi-lang-java=\"`vault.config.UiHeader`\" pulumi-lang-hcl=\"`vault_config_ui_header`\"\u003e`vault.config.UiHeader`\u003c/span\u003e resource to your configuration\n2. Import the existing header: `terraform import vault_config_ui_header.csp Content-Security-Policy`\n3. Remove the old \u003cspan pulumi-lang-nodejs=\"`vault.generic.Endpoint`\" pulumi-lang-dotnet=\"`vault.generic.Endpoint`\" pulumi-lang-go=\"`generic.Endpoint`\" pulumi-lang-python=\"`generic.Endpoint`\" pulumi-lang-yaml=\"`vault.generic.Endpoint`\" pulumi-lang-java=\"`vault.generic.Endpoint`\" pulumi-lang-hcl=\"`vault_generic_endpoint`\"\u003e`vault.generic.Endpoint`\u003c/span\u003e resource from your configuration\n4. Run `pulumi preview` to verify no changes are required\n\n## Important Notes\n\n### State Management\n\nThis resource follows Terraform best practices by reading the actual configuration from Vault\nafter create and update operations. This ensures that the Terraform state always reflects the\nactual state in Vault, including any server-side processing or normalization of values.\n\n## Import\n\nUI header configurations can be imported using the header \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:config/uiHeader:UiHeader csp Content-Security-Policy\n```\n\n", "properties": { "name": { "type": "string", "description": "The name of the custom header (e.g., \"Content-Security-Policy\", \"X-Frame-Options\").\nChanging this will recreate the resource.\n" }, "values": { "type": "array", "items": { "type": "string" }, "description": "A set of values for the header. At least one value is required.\nMultiple values can be provided for headers that support them. Because this argument uses set semantics, value order is not preserved and duplicate values are removed.\n\n\u003e **Important** This resource must be called from the **root namespace**. UI header configuration is a global setting that applies to the entire Vault cluster.\n" } }, "required": [ "name", "values" ], "inputProperties": { "name": { "type": "string", "description": "The name of the custom header (e.g., \"Content-Security-Policy\", \"X-Frame-Options\").\nChanging this will recreate the resource.\n" }, "values": { "type": "array", "items": { "type": "string" }, "description": "A set of values for the header. At least one value is required.\nMultiple values can be provided for headers that support them. Because this argument uses set semantics, value order is not preserved and duplicate values are removed.\n\n\u003e **Important** This resource must be called from the **root namespace**. UI header configuration is a global setting that applies to the entire Vault cluster.\n" } }, "requiredInputs": [ "values" ], "stateInputs": { "description": "Input properties used for looking up and filtering UiHeader resources.\n", "properties": { "name": { "type": "string", "description": "The name of the custom header (e.g., \"Content-Security-Policy\", \"X-Frame-Options\").\nChanging this will recreate the resource.\n" }, "values": { "type": "array", "items": { "type": "string" }, "description": "A set of values for the header. At least one value is required.\nMultiple values can be provided for headers that support them. Because this argument uses set semantics, value order is not preserved and duplicate values are removed.\n\n\u003e **Important** This resource must be called from the **root namespace**. UI header configuration is a global setting that applies to the entire Vault cluster.\n" } }, "type": "object" } }, "vault:consul/secretBackend:SecretBackend": { "description": "Creates a Consul Secret Backend for Vault. Consul secret backends can then issue Consul tokens, once a role has been\nadded to the backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n### Creating a standard backend resource:\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.consul.SecretBackend(\"test\", {\n path: \"consul\",\n description: \"Manages the Consul backend\",\n address: \"127.0.0.1:8500\",\n token: \"4240861b-ce3d-8530-115a-521ff070dd29\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.consul.SecretBackend(\"test\",\n path=\"consul\",\n description=\"Manages the Consul backend\",\n address=\"127.0.0.1:8500\",\n token=\"4240861b-ce3d-8530-115a-521ff070dd29\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Consul.SecretBackend(\"test\", new()\n {\n Path = \"consul\",\n Description = \"Manages the Consul backend\",\n Address = \"127.0.0.1:8500\",\n Token = \"4240861b-ce3d-8530-115a-521ff070dd29\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/consul\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := consul.NewSecretBackend(ctx, \"test\", \u0026consul.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"consul\"),\n\t\t\tDescription: pulumi.String(\"Manages the Consul backend\"),\n\t\t\tAddress: pulumi.String(\"127.0.0.1:8500\"),\n\t\t\tToken: pulumi.String(\"4240861b-ce3d-8530-115a-521ff070dd29\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_consul_secretbackend\" \"test\" {\n path = \"consul\"\n description = \"Manages the Consul backend\"\n address = \"127.0.0.1:8500\"\n token = \"4240861b-ce3d-8530-115a-521ff070dd29\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.consul.SecretBackend;\nimport com.pulumi.vault.consul.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new SecretBackend(\"test\", SecretBackendArgs.builder()\n .path(\"consul\")\n .description(\"Manages the Consul backend\")\n .address(\"127.0.0.1:8500\")\n .token(\"4240861b-ce3d-8530-115a-521ff070dd29\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:consul:SecretBackend\n properties:\n path: consul\n description: Manages the Consul backend\n address: 127.0.0.1:8500\n token: 4240861b-ce3d-8530-115a-521ff070dd29\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Creating a backend resource to bootstrap a new Consul instance:\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.consul.SecretBackend(\"test\", {\n path: \"consul\",\n description: \"Bootstrap the Consul backend\",\n address: \"127.0.0.1:8500\",\n bootstrap: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.consul.SecretBackend(\"test\",\n path=\"consul\",\n description=\"Bootstrap the Consul backend\",\n address=\"127.0.0.1:8500\",\n bootstrap=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Consul.SecretBackend(\"test\", new()\n {\n Path = \"consul\",\n Description = \"Bootstrap the Consul backend\",\n Address = \"127.0.0.1:8500\",\n Bootstrap = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/consul\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := consul.NewSecretBackend(ctx, \"test\", \u0026consul.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"consul\"),\n\t\t\tDescription: pulumi.String(\"Bootstrap the Consul backend\"),\n\t\t\tAddress: pulumi.String(\"127.0.0.1:8500\"),\n\t\t\tBootstrap: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_consul_secretbackend\" \"test\" {\n path = \"consul\"\n description = \"Bootstrap the Consul backend\"\n address = \"127.0.0.1:8500\"\n bootstrap = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.consul.SecretBackend;\nimport com.pulumi.vault.consul.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new SecretBackend(\"test\", SecretBackendArgs.builder()\n .path(\"consul\")\n .description(\"Bootstrap the Consul backend\")\n .address(\"127.0.0.1:8500\")\n .bootstrap(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:consul:SecretBackend\n properties:\n path: consul\n description: Bootstrap the Consul backend\n address: 127.0.0.1:8500\n bootstrap: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using write-only fields for enhanced security (Recommended):\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.consul.SecretBackend(\"test\", {\n path: \"consul\",\n description: \"Manages the Consul backend with write-only token\",\n address: \"127.0.0.1:8500\",\n tokenWo: consulToken,\n tokenWoVersion: 1,\n scheme: \"https\",\n caCert: std.file({\n input: \"ca.pem\",\n }).then(invoke =\u003e invoke.result),\n clientCert: std.file({\n input: \"client.pem\",\n }).then(invoke =\u003e invoke.result),\n clientKeyWo: consulClientKey,\n clientKeyWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ntest = vault.consul.SecretBackend(\"test\",\n path=\"consul\",\n description=\"Manages the Consul backend with write-only token\",\n address=\"127.0.0.1:8500\",\n token_wo=consul_token,\n token_wo_version=1,\n scheme=\"https\",\n ca_cert=std.file(input=\"ca.pem\").result,\n client_cert=std.file(input=\"client.pem\").result,\n client_key_wo=consul_client_key,\n client_key_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Consul.SecretBackend(\"test\", new()\n {\n Path = \"consul\",\n Description = \"Manages the Consul backend with write-only token\",\n Address = \"127.0.0.1:8500\",\n TokenWo = consulToken,\n TokenWoVersion = 1,\n Scheme = \"https\",\n CaCert = Std.File.Invoke(new()\n {\n Input = \"ca.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n ClientCert = Std.File.Invoke(new()\n {\n Input = \"client.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n ClientKeyWo = consulClientKey,\n ClientKeyWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/consul\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"ca.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile1, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"client.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = consul.NewSecretBackend(ctx, \"test\", \u0026consul.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"consul\"),\n\t\t\tDescription: pulumi.String(\"Manages the Consul backend with write-only token\"),\n\t\t\tAddress: pulumi.String(\"127.0.0.1:8500\"),\n\t\t\tTokenWo: pulumi.Any(consulToken),\n\t\t\tTokenWoVersion: pulumi.Int(1),\n\t\t\tScheme: pulumi.String(\"https\"),\n\t\t\tCaCert: pulumi.String(invokeFile.Result),\n\t\t\tClientCert: pulumi.String(invokeFile1.Result),\n\t\t\tClientKeyWo: pulumi.Any(consulClientKey),\n\t\t\tClientKeyWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_consul_secretbackend\" \"test\" {\n path = \"consul\"\n description = \"Manages the Consul backend with write-only token\"\n address = \"127.0.0.1:8500\"\n token_wo = consulToken\n token_wo_version = 1 # Increment to rotate\n scheme = \"https\"\n ca_cert = file(\"ca.pem\")\n client_cert = file(\"client.pem\")\n client_key_wo = consulClientKey\n client_key_wo_version = 1 # Increment to rotate\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.consul.SecretBackend;\nimport com.pulumi.vault.consul.SecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new SecretBackend(\"test\", SecretBackendArgs.builder()\n .path(\"consul\")\n .description(\"Manages the Consul backend with write-only token\")\n .address(\"127.0.0.1:8500\")\n .tokenWo(consulToken)\n .tokenWoVersion(1)\n .scheme(\"https\")\n .caCert(StdFunctions.file(FileArgs.builder()\n .input(\"ca.pem\")\n .build()).result())\n .clientCert(StdFunctions.file(FileArgs.builder()\n .input(\"client.pem\")\n .build()).result())\n .clientKeyWo(consulClientKey)\n .clientKeyWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:consul:SecretBackend\n properties:\n path: consul\n description: Manages the Consul backend with write-only token\n address: 127.0.0.1:8500\n tokenWo: ${consulToken}\n tokenWoVersion: 1 # Increment to rotate\n scheme: https\n caCert:\n fn::invoke:\n function: std:file\n arguments:\n input: ca.pem\n return: result\n clientCert:\n fn::invoke:\n function: std:file\n arguments:\n input: client.pem\n return: result\n clientKeyWo: ${consulClientKey}\n clientKeyWoVersion: 1 # Increment to rotate\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e - (Optional) The Consul management token this backend should use to issue new tokens, provided as a \nwrite-only field. This value will **never** be stored in Terraform state. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e. Must be \nused with \u003cspan pulumi-lang-nodejs=\"`tokenWoVersion`\" pulumi-lang-dotnet=\"`TokenWoVersion`\" pulumi-lang-go=\"`tokenWoVersion`\" pulumi-lang-python=\"`token_wo_version`\" pulumi-lang-yaml=\"`tokenWoVersion`\" pulumi-lang-java=\"`tokenWoVersion`\" pulumi-lang-hcl=\"`token_wo_version`\"\u003e`tokenWoVersion`\u003c/span\u003e.\n\n* \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e - (Optional) Client key used for Consul's TLS communication, must be x509 PEM encoded, provided as a\nwrite-only field. This value will **never** be stored in Terraform state. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`clientKey`\" pulumi-lang-dotnet=\"`ClientKey`\" pulumi-lang-go=\"`clientKey`\" pulumi-lang-python=\"`client_key`\" pulumi-lang-yaml=\"`clientKey`\" pulumi-lang-java=\"`clientKey`\" pulumi-lang-hcl=\"`client_key`\"\u003e`clientKey`\u003c/span\u003e. Must be\nused with \u003cspan pulumi-lang-nodejs=\"`clientKeyWoVersion`\" pulumi-lang-dotnet=\"`ClientKeyWoVersion`\" pulumi-lang-go=\"`clientKeyWoVersion`\" pulumi-lang-python=\"`client_key_wo_version`\" pulumi-lang-yaml=\"`clientKeyWoVersion`\" pulumi-lang-java=\"`clientKeyWoVersion`\" pulumi-lang-hcl=\"`client_key_wo_version`\"\u003e`clientKeyWoVersion`\u003c/span\u003e.\n\n## Import\n\nConsul secret backends can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:consul/secretBackend:SecretBackend example consul\n```\n\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "address": { "type": "string", "description": "Specifies the address of the Consul instance, provided as \"host:port\" like \"127.0.0.1:8500\".\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "bootstrap": { "type": "boolean", "description": "Denotes that the resource is used to bootstrap the Consul ACL system.\n\n\u003e **Important** When \u003cspan pulumi-lang-nodejs=\"`bootstrap`\" pulumi-lang-dotnet=\"`Bootstrap`\" pulumi-lang-go=\"`bootstrap`\" pulumi-lang-python=\"`bootstrap`\" pulumi-lang-yaml=\"`bootstrap`\" pulumi-lang-java=\"`bootstrap`\" pulumi-lang-hcl=\"`bootstrap`\"\u003e`bootstrap`\u003c/span\u003e is true, Vault will attempt to bootstrap the Consul server. The token returned from\nthis operation will only ever be known to Vault. If the resource is ever destroyed, the bootstrap token will be lost\nand a [Consul reset may be required.](https://learn.hashicorp.com/tutorials/consul/access-control-troubleshoot#reset-the-acl-system)\n" }, "caCert": { "type": "string", "description": "CA certificate to use when verifying Consul server certificate, must be x509 PEM encoded.\n" }, "clientCert": { "type": "string", "description": "Client certificate used for Consul's TLS communication, must be x509 PEM encoded and if\nthis is set you need to also set client_key.\n", "secret": true }, "clientKey": { "type": "string", "description": "Client key used for Consul's TLS communication, must be x509 PEM encoded and if this is set\nyou need to also set client_cert. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e. **Note:** This field will be stored in\nTerraform state. Consider using \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "clientKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nClient key used for Consul's TLS communication, must be x509 PEM encoded. This field is write-only and will never be stored in state. Mutually exclusive with 'client_key'. Requires 'client_key_wo_version' to trigger updates.", "secret": true }, "clientKeyWoVersion": { "type": "integer", "description": "Version counter for the write-only client key. Increment this value to trigger \nan update of the client key in Vault. Required when using \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "A human-friendly description for this backend.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Specifies if the secret backend is local only" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique location this backend should be mounted at. Must not begin or end with a `/`. Defaults\nto \u003cspan pulumi-lang-nodejs=\"`consul`\" pulumi-lang-dotnet=\"`Consul`\" pulumi-lang-go=\"`consul`\" pulumi-lang-python=\"`consul`\" pulumi-lang-yaml=\"`consul`\" pulumi-lang-java=\"`consul`\" pulumi-lang-hcl=\"`consul`\"\u003e`consul`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "scheme": { "type": "string", "description": "Specifies the URL scheme to use. Defaults to \u003cspan pulumi-lang-nodejs=\"`http`\" pulumi-lang-dotnet=\"`Http`\" pulumi-lang-go=\"`http`\" pulumi-lang-python=\"`http`\" pulumi-lang-yaml=\"`http`\" pulumi-lang-java=\"`http`\" pulumi-lang-hcl=\"`http`\"\u003e`http`\u003c/span\u003e.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "token": { "type": "string", "description": "The Consul management token this backend should use to issue new tokens. This field is required\nwhen \u003cspan pulumi-lang-nodejs=\"`bootstrap`\" pulumi-lang-dotnet=\"`Bootstrap`\" pulumi-lang-go=\"`bootstrap`\" pulumi-lang-python=\"`bootstrap`\" pulumi-lang-yaml=\"`bootstrap`\" pulumi-lang-java=\"`bootstrap`\" pulumi-lang-hcl=\"`bootstrap`\"\u003e`bootstrap`\u003c/span\u003e is false. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e. **Note:** This field will be stored in Terraform state.\nConsider using \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e instead for enhanced security.\n\n\u003e **Important** Because Vault does not support reading the configured token back from the API, Terraform cannot detect\nand correct drift on \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e. Changing the value, however, _will_ overwrite the previously stored values.\n", "secret": true }, "tokenWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nSpecifies the Consul token to use when managing or issuing new tokens. This field is write-only and will never be stored in state. Mutually exclusive with 'token'. Requires 'token_wo_version' to trigger updates.", "secret": true }, "tokenWoVersion": { "type": "integer", "description": "Version counter for the write-only token. Increment this value to trigger an update \nof the token in Vault. Required when using \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e.\n" } }, "required": [ "accessor", "address", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "forceNoCache", "sealWrap" ], "inputProperties": { "address": { "type": "string", "description": "Specifies the address of the Consul instance, provided as \"host:port\" like \"127.0.0.1:8500\".\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "bootstrap": { "type": "boolean", "description": "Denotes that the resource is used to bootstrap the Consul ACL system.\n\n\u003e **Important** When \u003cspan pulumi-lang-nodejs=\"`bootstrap`\" pulumi-lang-dotnet=\"`Bootstrap`\" pulumi-lang-go=\"`bootstrap`\" pulumi-lang-python=\"`bootstrap`\" pulumi-lang-yaml=\"`bootstrap`\" pulumi-lang-java=\"`bootstrap`\" pulumi-lang-hcl=\"`bootstrap`\"\u003e`bootstrap`\u003c/span\u003e is true, Vault will attempt to bootstrap the Consul server. The token returned from\nthis operation will only ever be known to Vault. If the resource is ever destroyed, the bootstrap token will be lost\nand a [Consul reset may be required.](https://learn.hashicorp.com/tutorials/consul/access-control-troubleshoot#reset-the-acl-system)\n" }, "caCert": { "type": "string", "description": "CA certificate to use when verifying Consul server certificate, must be x509 PEM encoded.\n" }, "clientCert": { "type": "string", "description": "Client certificate used for Consul's TLS communication, must be x509 PEM encoded and if\nthis is set you need to also set client_key.\n", "secret": true }, "clientKey": { "type": "string", "description": "Client key used for Consul's TLS communication, must be x509 PEM encoded and if this is set\nyou need to also set client_cert. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e. **Note:** This field will be stored in\nTerraform state. Consider using \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "clientKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nClient key used for Consul's TLS communication, must be x509 PEM encoded. This field is write-only and will never be stored in state. Mutually exclusive with 'client_key'. Requires 'client_key_wo_version' to trigger updates.", "secret": true }, "clientKeyWoVersion": { "type": "integer", "description": "Version counter for the write-only client key. Increment this value to trigger \nan update of the client key in Vault. Required when using \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "A human-friendly description for this backend.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Specifies if the secret backend is local only", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique location this backend should be mounted at. Must not begin or end with a `/`. Defaults\nto \u003cspan pulumi-lang-nodejs=\"`consul`\" pulumi-lang-dotnet=\"`Consul`\" pulumi-lang-go=\"`consul`\" pulumi-lang-python=\"`consul`\" pulumi-lang-yaml=\"`consul`\" pulumi-lang-java=\"`consul`\" pulumi-lang-hcl=\"`consul`\"\u003e`consul`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "scheme": { "type": "string", "description": "Specifies the URL scheme to use. Defaults to \u003cspan pulumi-lang-nodejs=\"`http`\" pulumi-lang-dotnet=\"`Http`\" pulumi-lang-go=\"`http`\" pulumi-lang-python=\"`http`\" pulumi-lang-yaml=\"`http`\" pulumi-lang-java=\"`http`\" pulumi-lang-hcl=\"`http`\"\u003e`http`\u003c/span\u003e.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "token": { "type": "string", "description": "The Consul management token this backend should use to issue new tokens. This field is required\nwhen \u003cspan pulumi-lang-nodejs=\"`bootstrap`\" pulumi-lang-dotnet=\"`Bootstrap`\" pulumi-lang-go=\"`bootstrap`\" pulumi-lang-python=\"`bootstrap`\" pulumi-lang-yaml=\"`bootstrap`\" pulumi-lang-java=\"`bootstrap`\" pulumi-lang-hcl=\"`bootstrap`\"\u003e`bootstrap`\u003c/span\u003e is false. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e. **Note:** This field will be stored in Terraform state.\nConsider using \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e instead for enhanced security.\n\n\u003e **Important** Because Vault does not support reading the configured token back from the API, Terraform cannot detect\nand correct drift on \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e. Changing the value, however, _will_ overwrite the previously stored values.\n", "secret": true }, "tokenWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nSpecifies the Consul token to use when managing or issuing new tokens. This field is write-only and will never be stored in state. Mutually exclusive with 'token'. Requires 'token_wo_version' to trigger updates.", "secret": true }, "tokenWoVersion": { "type": "integer", "description": "Version counter for the write-only token. Increment this value to trigger an update \nof the token in Vault. Required when using \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e.\n" } }, "requiredInputs": [ "address" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "address": { "type": "string", "description": "Specifies the address of the Consul instance, provided as \"host:port\" like \"127.0.0.1:8500\".\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "bootstrap": { "type": "boolean", "description": "Denotes that the resource is used to bootstrap the Consul ACL system.\n\n\u003e **Important** When \u003cspan pulumi-lang-nodejs=\"`bootstrap`\" pulumi-lang-dotnet=\"`Bootstrap`\" pulumi-lang-go=\"`bootstrap`\" pulumi-lang-python=\"`bootstrap`\" pulumi-lang-yaml=\"`bootstrap`\" pulumi-lang-java=\"`bootstrap`\" pulumi-lang-hcl=\"`bootstrap`\"\u003e`bootstrap`\u003c/span\u003e is true, Vault will attempt to bootstrap the Consul server. The token returned from\nthis operation will only ever be known to Vault. If the resource is ever destroyed, the bootstrap token will be lost\nand a [Consul reset may be required.](https://learn.hashicorp.com/tutorials/consul/access-control-troubleshoot#reset-the-acl-system)\n" }, "caCert": { "type": "string", "description": "CA certificate to use when verifying Consul server certificate, must be x509 PEM encoded.\n" }, "clientCert": { "type": "string", "description": "Client certificate used for Consul's TLS communication, must be x509 PEM encoded and if\nthis is set you need to also set client_key.\n", "secret": true }, "clientKey": { "type": "string", "description": "Client key used for Consul's TLS communication, must be x509 PEM encoded and if this is set\nyou need to also set client_cert. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e. **Note:** This field will be stored in\nTerraform state. Consider using \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "clientKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nClient key used for Consul's TLS communication, must be x509 PEM encoded. This field is write-only and will never be stored in state. Mutually exclusive with 'client_key'. Requires 'client_key_wo_version' to trigger updates.", "secret": true }, "clientKeyWoVersion": { "type": "integer", "description": "Version counter for the write-only client key. Increment this value to trigger \nan update of the client key in Vault. Required when using \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "A human-friendly description for this backend.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Specifies if the secret backend is local only", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique location this backend should be mounted at. Must not begin or end with a `/`. Defaults\nto \u003cspan pulumi-lang-nodejs=\"`consul`\" pulumi-lang-dotnet=\"`Consul`\" pulumi-lang-go=\"`consul`\" pulumi-lang-python=\"`consul`\" pulumi-lang-yaml=\"`consul`\" pulumi-lang-java=\"`consul`\" pulumi-lang-hcl=\"`consul`\"\u003e`consul`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "scheme": { "type": "string", "description": "Specifies the URL scheme to use. Defaults to \u003cspan pulumi-lang-nodejs=\"`http`\" pulumi-lang-dotnet=\"`Http`\" pulumi-lang-go=\"`http`\" pulumi-lang-python=\"`http`\" pulumi-lang-yaml=\"`http`\" pulumi-lang-java=\"`http`\" pulumi-lang-hcl=\"`http`\"\u003e`http`\u003c/span\u003e.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "token": { "type": "string", "description": "The Consul management token this backend should use to issue new tokens. This field is required\nwhen \u003cspan pulumi-lang-nodejs=\"`bootstrap`\" pulumi-lang-dotnet=\"`Bootstrap`\" pulumi-lang-go=\"`bootstrap`\" pulumi-lang-python=\"`bootstrap`\" pulumi-lang-yaml=\"`bootstrap`\" pulumi-lang-java=\"`bootstrap`\" pulumi-lang-hcl=\"`bootstrap`\"\u003e`bootstrap`\u003c/span\u003e is false. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e. **Note:** This field will be stored in Terraform state.\nConsider using \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e instead for enhanced security.\n\n\u003e **Important** Because Vault does not support reading the configured token back from the API, Terraform cannot detect\nand correct drift on \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e. Changing the value, however, _will_ overwrite the previously stored values.\n", "secret": true }, "tokenWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nSpecifies the Consul token to use when managing or issuing new tokens. This field is write-only and will never be stored in state. Mutually exclusive with 'token'. Requires 'token_wo_version' to trigger updates.", "secret": true }, "tokenWoVersion": { "type": "integer", "description": "Version counter for the write-only token. Increment this value to trigger an update \nof the token in Vault. Required when using \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e.\n" } }, "type": "object" } }, "vault:consul/secretBackendRole:SecretBackendRole": { "description": "Manages a Consul secrets role for a Consul secrets engine in Vault. Consul secret backends can then issue Consul tokens.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.consul.SecretBackend(\"test\", {\n path: \"consul\",\n description: \"Manages the Consul backend\",\n address: \"127.0.0.1:8500\",\n token: \"4240861b-ce3d-8530-115a-521ff070dd29\",\n});\nconst example = new vault.consul.SecretBackendRole(\"example\", {\n name: \"test-role\",\n backend: test.path,\n consulPolicies: [\"example-policy\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.consul.SecretBackend(\"test\",\n path=\"consul\",\n description=\"Manages the Consul backend\",\n address=\"127.0.0.1:8500\",\n token=\"4240861b-ce3d-8530-115a-521ff070dd29\")\nexample = vault.consul.SecretBackendRole(\"example\",\n name=\"test-role\",\n backend=test.path,\n consul_policies=[\"example-policy\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Consul.SecretBackend(\"test\", new()\n {\n Path = \"consul\",\n Description = \"Manages the Consul backend\",\n Address = \"127.0.0.1:8500\",\n Token = \"4240861b-ce3d-8530-115a-521ff070dd29\",\n });\n\n var example = new Vault.Consul.SecretBackendRole(\"example\", new()\n {\n Name = \"test-role\",\n Backend = test.Path,\n ConsulPolicies = new[]\n {\n \"example-policy\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/consul\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttest, err := consul.NewSecretBackend(ctx, \"test\", \u0026consul.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"consul\"),\n\t\t\tDescription: pulumi.String(\"Manages the Consul backend\"),\n\t\t\tAddress: pulumi.String(\"127.0.0.1:8500\"),\n\t\t\tToken: pulumi.String(\"4240861b-ce3d-8530-115a-521ff070dd29\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = consul.NewSecretBackendRole(ctx, \"example\", \u0026consul.SecretBackendRoleArgs{\n\t\t\tName: pulumi.String(\"test-role\"),\n\t\t\tBackend: test.Path,\n\t\t\tConsulPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"example-policy\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_consul_secretbackend\" \"test\" {\n path = \"consul\"\n description = \"Manages the Consul backend\"\n address = \"127.0.0.1:8500\"\n token = \"4240861b-ce3d-8530-115a-521ff070dd29\"\n}\nresource \"vault_consul_secretbackendrole\" \"example\" {\n name = \"test-role\"\n backend = vault_consul_secretbackend.test.path\n consul_policies = [\"example-policy\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.consul.SecretBackend;\nimport com.pulumi.vault.consul.SecretBackendArgs;\nimport com.pulumi.vault.consul.SecretBackendRole;\nimport com.pulumi.vault.consul.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new SecretBackend(\"test\", SecretBackendArgs.builder()\n .path(\"consul\")\n .description(\"Manages the Consul backend\")\n .address(\"127.0.0.1:8500\")\n .token(\"4240861b-ce3d-8530-115a-521ff070dd29\")\n .build());\n\n var example = new SecretBackendRole(\"example\", SecretBackendRoleArgs.builder()\n .name(\"test-role\")\n .backend(test.path())\n .consulPolicies(\"example-policy\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:consul:SecretBackend\n properties:\n path: consul\n description: Manages the Consul backend\n address: 127.0.0.1:8500\n token: 4240861b-ce3d-8530-115a-521ff070dd29\n example:\n type: vault:consul:SecretBackendRole\n properties:\n name: test-role\n backend: ${test.path}\n consulPolicies:\n - example-policy\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Note About Required Arguments\n\n*At least one* of the four arguments \u003cspan pulumi-lang-nodejs=\"`consulPolicies`\" pulumi-lang-dotnet=\"`ConsulPolicies`\" pulumi-lang-go=\"`consulPolicies`\" pulumi-lang-python=\"`consul_policies`\" pulumi-lang-yaml=\"`consulPolicies`\" pulumi-lang-java=\"`consulPolicies`\" pulumi-lang-hcl=\"`consul_policies`\"\u003e`consulPolicies`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`consulRoles`\" pulumi-lang-dotnet=\"`ConsulRoles`\" pulumi-lang-go=\"`consulRoles`\" pulumi-lang-python=\"`consul_roles`\" pulumi-lang-yaml=\"`consulRoles`\" pulumi-lang-java=\"`consulRoles`\" pulumi-lang-hcl=\"`consul_roles`\"\u003e`consulRoles`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceIdentities`\" pulumi-lang-dotnet=\"`ServiceIdentities`\" pulumi-lang-go=\"`serviceIdentities`\" pulumi-lang-python=\"`service_identities`\" pulumi-lang-yaml=\"`serviceIdentities`\" pulumi-lang-java=\"`serviceIdentities`\" pulumi-lang-hcl=\"`service_identities`\"\u003e`serviceIdentities`\u003c/span\u003e, or\n\u003cspan pulumi-lang-nodejs=\"`nodeIdentities`\" pulumi-lang-dotnet=\"`NodeIdentities`\" pulumi-lang-go=\"`nodeIdentities`\" pulumi-lang-python=\"`node_identities`\" pulumi-lang-yaml=\"`nodeIdentities`\" pulumi-lang-java=\"`nodeIdentities`\" pulumi-lang-hcl=\"`node_identities`\"\u003e`nodeIdentities`\u003c/span\u003e is required for a token. If desired, any combination of the four arguments up-to and\nincluding all four, is valid.\n\n## Import\n\nConsul secret backend roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, `/roles/`, and the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e e.g.\n\n```sh\n$ pulumi import vault:consul/secretBackendRole:SecretBackendRole example consul/roles/my-role\n```\n\n", "properties": { "backend": { "type": "string", "description": "The unique name of an existing Consul secrets backend mount. Must not begin or end with a `/`. One of \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e is required.\n" }, "consulNamespace": { "type": "string", "description": "The Consul namespace that the token will be created in.\nApplicable for Vault 1.10+ and Consul 1.7+\".\n" }, "consulPolicies": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e The list of Consul ACL policies to associate with these roles.\n" }, "consulRoles": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e Set of Consul roles to attach to the token.\nApplicable for Vault 1.10+ with Consul 1.5+.\n" }, "local": { "type": "boolean", "description": "Indicates that the token should not be replicated globally and instead be local to the current datacenter.\n" }, "maxTtl": { "type": "integer", "description": "Maximum TTL for leases associated with this role, in seconds.\n" }, "name": { "type": "string", "description": "The name of the Consul secrets engine role to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "nodeIdentities": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e Set of Consul node\nidentities to attach to the token. Applicable for Vault 1.11+ with Consul 1.8+.\n" }, "partition": { "type": "string", "description": "The admin partition that the token will be created in.\nApplicable for Vault 1.10+ and Consul 1.11+\".\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "The list of Consul ACL policies to associate with these roles.\n**NOTE:** The new parameter \u003cspan pulumi-lang-nodejs=\"`consulPolicies`\" pulumi-lang-dotnet=\"`ConsulPolicies`\" pulumi-lang-go=\"`consulPolicies`\" pulumi-lang-python=\"`consul_policies`\" pulumi-lang-yaml=\"`consulPolicies`\" pulumi-lang-java=\"`consulPolicies`\" pulumi-lang-hcl=\"`consul_policies`\"\u003e`consulPolicies`\u003c/span\u003e should be used in favor of this. This parameter,\n\u003cspan pulumi-lang-nodejs=\"`policies`\" pulumi-lang-dotnet=\"`Policies`\" pulumi-lang-go=\"`policies`\" pulumi-lang-python=\"`policies`\" pulumi-lang-yaml=\"`policies`\" pulumi-lang-java=\"`policies`\" pulumi-lang-hcl=\"`policies`\"\u003e`policies`\u003c/span\u003e, remains supported for legacy users, but Vault has deprecated this field.\n" }, "serviceIdentities": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e Set of Consul\nservice identities to attach to the token. Applicable for Vault 1.11+ with Consul 1.5+.\n" }, "ttl": { "type": "integer", "description": "Specifies the TTL for this role.\n" } }, "required": [ "consulNamespace", "name", "partition" ], "inputProperties": { "backend": { "type": "string", "description": "The unique name of an existing Consul secrets backend mount. Must not begin or end with a `/`. One of \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e is required.\n", "willReplaceOnChanges": true }, "consulNamespace": { "type": "string", "description": "The Consul namespace that the token will be created in.\nApplicable for Vault 1.10+ and Consul 1.7+\".\n" }, "consulPolicies": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e The list of Consul ACL policies to associate with these roles.\n" }, "consulRoles": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e Set of Consul roles to attach to the token.\nApplicable for Vault 1.10+ with Consul 1.5+.\n" }, "local": { "type": "boolean", "description": "Indicates that the token should not be replicated globally and instead be local to the current datacenter.\n" }, "maxTtl": { "type": "integer", "description": "Maximum TTL for leases associated with this role, in seconds.\n" }, "name": { "type": "string", "description": "The name of the Consul secrets engine role to create.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "nodeIdentities": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e Set of Consul node\nidentities to attach to the token. Applicable for Vault 1.11+ with Consul 1.8+.\n" }, "partition": { "type": "string", "description": "The admin partition that the token will be created in.\nApplicable for Vault 1.10+ and Consul 1.11+\".\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "The list of Consul ACL policies to associate with these roles.\n**NOTE:** The new parameter \u003cspan pulumi-lang-nodejs=\"`consulPolicies`\" pulumi-lang-dotnet=\"`ConsulPolicies`\" pulumi-lang-go=\"`consulPolicies`\" pulumi-lang-python=\"`consul_policies`\" pulumi-lang-yaml=\"`consulPolicies`\" pulumi-lang-java=\"`consulPolicies`\" pulumi-lang-hcl=\"`consul_policies`\"\u003e`consulPolicies`\u003c/span\u003e should be used in favor of this. This parameter,\n\u003cspan pulumi-lang-nodejs=\"`policies`\" pulumi-lang-dotnet=\"`Policies`\" pulumi-lang-go=\"`policies`\" pulumi-lang-python=\"`policies`\" pulumi-lang-yaml=\"`policies`\" pulumi-lang-java=\"`policies`\" pulumi-lang-hcl=\"`policies`\"\u003e`policies`\u003c/span\u003e, remains supported for legacy users, but Vault has deprecated this field.\n" }, "serviceIdentities": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e Set of Consul\nservice identities to attach to the token. Applicable for Vault 1.11+ with Consul 1.5+.\n" }, "ttl": { "type": "integer", "description": "Specifies the TTL for this role.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRole resources.\n", "properties": { "backend": { "type": "string", "description": "The unique name of an existing Consul secrets backend mount. Must not begin or end with a `/`. One of \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e is required.\n", "willReplaceOnChanges": true }, "consulNamespace": { "type": "string", "description": "The Consul namespace that the token will be created in.\nApplicable for Vault 1.10+ and Consul 1.7+\".\n" }, "consulPolicies": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e The list of Consul ACL policies to associate with these roles.\n" }, "consulRoles": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e Set of Consul roles to attach to the token.\nApplicable for Vault 1.10+ with Consul 1.5+.\n" }, "local": { "type": "boolean", "description": "Indicates that the token should not be replicated globally and instead be local to the current datacenter.\n" }, "maxTtl": { "type": "integer", "description": "Maximum TTL for leases associated with this role, in seconds.\n" }, "name": { "type": "string", "description": "The name of the Consul secrets engine role to create.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "nodeIdentities": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e Set of Consul node\nidentities to attach to the token. Applicable for Vault 1.11+ with Consul 1.8+.\n" }, "partition": { "type": "string", "description": "The admin partition that the token will be created in.\nApplicable for Vault 1.10+ and Consul 1.11+\".\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "The list of Consul ACL policies to associate with these roles.\n**NOTE:** The new parameter \u003cspan pulumi-lang-nodejs=\"`consulPolicies`\" pulumi-lang-dotnet=\"`ConsulPolicies`\" pulumi-lang-go=\"`consulPolicies`\" pulumi-lang-python=\"`consul_policies`\" pulumi-lang-yaml=\"`consulPolicies`\" pulumi-lang-java=\"`consulPolicies`\" pulumi-lang-hcl=\"`consul_policies`\"\u003e`consulPolicies`\u003c/span\u003e should be used in favor of this. This parameter,\n\u003cspan pulumi-lang-nodejs=\"`policies`\" pulumi-lang-dotnet=\"`Policies`\" pulumi-lang-go=\"`policies`\" pulumi-lang-python=\"`policies`\" pulumi-lang-yaml=\"`policies`\" pulumi-lang-java=\"`policies`\" pulumi-lang-hcl=\"`policies`\"\u003e`policies`\u003c/span\u003e, remains supported for legacy users, but Vault has deprecated this field.\n" }, "serviceIdentities": { "type": "array", "items": { "type": "string" }, "description": "\u003csup\u003e\u003ca href=\"#note-about-required-arguments\"\u003eSEE NOTE\u003c/a\u003e\u003c/sup\u003e Set of Consul\nservice identities to attach to the token. Applicable for Vault 1.11+ with Consul 1.5+.\n" }, "ttl": { "type": "integer", "description": "Specifies the TTL for this role.\n" } }, "type": "object" } }, "vault:database/secretBackendConnection:SecretBackendConnection": { "description": "Creates a Database Secret Backend connection in Vault. Database secret backend\nconnections can be used to generate dynamic credentials for the database.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n### PostgreSQL Connection\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst db = new vault.Mount(\"db\", {\n path: \"postgres\",\n type: \"database\",\n});\nconst postgres = new vault.database.SecretBackendConnection(\"postgres\", {\n backend: db.path,\n name: \"postgres\",\n allowedRoles: [\n \"dev\",\n \"prod\",\n ],\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n postgresql: {\n connectionUrl: \"postgres://username:password@host:port/database\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndb = vault.Mount(\"db\",\n path=\"postgres\",\n type=\"database\")\npostgres = vault.database.SecretBackendConnection(\"postgres\",\n backend=db.path,\n name=\"postgres\",\n allowed_roles=[\n \"dev\",\n \"prod\",\n ],\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600,\n postgresql={\n \"connection_url\": \"postgres://username:password@host:port/database\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var db = new Vault.Mount(\"db\", new()\n {\n Path = \"postgres\",\n Type = \"database\",\n });\n\n var postgres = new Vault.Database.SecretBackendConnection(\"postgres\", new()\n {\n Backend = db.Path,\n Name = \"postgres\",\n AllowedRoles = new[]\n {\n \"dev\",\n \"prod\",\n },\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n Postgresql = new Vault.Database.Inputs.SecretBackendConnectionPostgresqlArgs\n {\n ConnectionUrl = \"postgres://username:password@host:port/database\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/database\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tdb, err := vault.NewMount(ctx, \"db\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"postgres\"),\n\t\t\tType: pulumi.String(\"database\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = database.NewSecretBackendConnection(ctx, \"postgres\", \u0026database.SecretBackendConnectionArgs{\n\t\t\tBackend: db.Path,\n\t\t\tName: pulumi.String(\"postgres\"),\n\t\t\tAllowedRoles: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t\tPostgresql: \u0026database.SecretBackendConnectionPostgresqlArgs{\n\t\t\t\tConnectionUrl: pulumi.String(\"postgres://username:password@host:port/database\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"db\" {\n path = \"postgres\"\n type = \"database\"\n}\nresource \"vault_database_secretbackendconnection\" \"postgres\" {\n backend = vault_mount.db.path\n name = \"postgres\"\n allowed_roles = [\"dev\", \"prod\"]\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n postgresql = {\n connection_url = \"postgres://username:password@host:port/database\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.database.SecretBackendConnection;\nimport com.pulumi.vault.database.SecretBackendConnectionArgs;\nimport com.pulumi.vault.database.inputs.SecretBackendConnectionPostgresqlArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var db = new Mount(\"db\", MountArgs.builder()\n .path(\"postgres\")\n .type(\"database\")\n .build());\n\n var postgres = new SecretBackendConnection(\"postgres\", SecretBackendConnectionArgs.builder()\n .backend(db.path())\n .name(\"postgres\")\n .allowedRoles( \n \"dev\",\n \"prod\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .postgresql(SecretBackendConnectionPostgresqlArgs.builder()\n .connectionUrl(\"postgres://username:password@host:port/database\")\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n db:\n type: vault:Mount\n properties:\n path: postgres\n type: database\n postgres:\n type: vault:database:SecretBackendConnection\n properties:\n backend: ${db.path}\n name: postgres\n allowedRoles:\n - dev\n - prod\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n postgresql:\n connectionUrl: postgres://username:password@host:port/database\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nDatabase secret backend connections can be imported using the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, `/config/`, and the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e e.g.\n\n```sh\n$ pulumi import vault:database/secretBackendConnection:SecretBackendConnection example postgres/config/postgres\n```\n\n", "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "backend": { "type": "string", "description": "The unique name of the Vault mount to configure.\n" }, "cassandra": { "$ref": "#/types/vault:database/SecretBackendConnectionCassandra:SecretBackendConnectionCassandra", "description": "A nested block containing configuration options for Cassandra connections.\n" }, "couchbase": { "$ref": "#/types/vault:database/SecretBackendConnectionCouchbase:SecretBackendConnectionCouchbase", "description": "A nested block containing configuration options for Couchbase connections.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "elasticsearch": { "$ref": "#/types/vault:database/SecretBackendConnectionElasticsearch:SecretBackendConnectionElasticsearch", "description": "A nested block containing configuration options for Elasticsearch connections.\n" }, "hana": { "$ref": "#/types/vault:database/SecretBackendConnectionHana:SecretBackendConnectionHana", "description": "A nested block containing configuration options for SAP HanaDB connections.\n" }, "influxdb": { "$ref": "#/types/vault:database/SecretBackendConnectionInfluxdb:SecretBackendConnectionInfluxdb", "description": "A nested block containing configuration options for InfluxDB connections.\n" }, "mongodb": { "$ref": "#/types/vault:database/SecretBackendConnectionMongodb:SecretBackendConnectionMongodb", "description": "A nested block containing configuration options for MongoDB connections.\n" }, "mongodbatlas": { "$ref": "#/types/vault:database/SecretBackendConnectionMongodbatlas:SecretBackendConnectionMongodbatlas", "description": "A nested block containing configuration options for MongoDB Atlas connections.\n" }, "mssql": { "$ref": "#/types/vault:database/SecretBackendConnectionMssql:SecretBackendConnectionMssql", "description": "A nested block containing configuration options for MSSQL connections.\n" }, "mysql": { "$ref": "#/types/vault:database/SecretBackendConnectionMysql:SecretBackendConnectionMysql", "description": "A nested block containing configuration options for MySQL connections.\n" }, "mysqlAurora": { "$ref": "#/types/vault:database/SecretBackendConnectionMysqlAurora:SecretBackendConnectionMysqlAurora", "description": "A nested block containing configuration options for Aurora MySQL connections.\n" }, "mysqlLegacy": { "$ref": "#/types/vault:database/SecretBackendConnectionMysqlLegacy:SecretBackendConnectionMysqlLegacy", "description": "A nested block containing configuration options for legacy MySQL connections.\n" }, "mysqlRds": { "$ref": "#/types/vault:database/SecretBackendConnectionMysqlRds:SecretBackendConnectionMysqlRds", "description": "A nested block containing configuration options for RDS MySQL connections.\n" }, "name": { "type": "string", "description": "A unique name to give the database connection.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n" }, "oracle": { "$ref": "#/types/vault:database/SecretBackendConnectionOracle:SecretBackendConnectionOracle", "description": "A nested block containing configuration options for Oracle connections.\n" }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "postgresql": { "$ref": "#/types/vault:database/SecretBackendConnectionPostgresql:SecretBackendConnectionPostgresql", "description": "A nested block containing configuration options for PostgreSQL connections.\n" }, "redis": { "$ref": "#/types/vault:database/SecretBackendConnectionRedis:SecretBackendConnectionRedis", "description": "A nested block containing configuration options for Redis connections.\n" }, "redisElasticache": { "$ref": "#/types/vault:database/SecretBackendConnectionRedisElasticache:SecretBackendConnectionRedisElasticache", "description": "A nested block containing configuration options for Redis ElastiCache connections.\n\nExactly one of the nested blocks of configuration options must be supplied.\n" }, "redshift": { "$ref": "#/types/vault:database/SecretBackendConnectionRedshift:SecretBackendConnectionRedshift", "description": "Connection parameters for the redshift-database-plugin plugin." }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "snowflake": { "$ref": "#/types/vault:database/SecretBackendConnectionSnowflake:SecretBackendConnectionSnowflake", "description": "A nested block containing configuration options for Snowflake connections.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "required": [ "backend", "name", "pluginName", "skipStaticRoleImportRotation" ], "inputProperties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "backend": { "type": "string", "description": "The unique name of the Vault mount to configure.\n", "willReplaceOnChanges": true }, "cassandra": { "$ref": "#/types/vault:database/SecretBackendConnectionCassandra:SecretBackendConnectionCassandra", "description": "A nested block containing configuration options for Cassandra connections.\n" }, "couchbase": { "$ref": "#/types/vault:database/SecretBackendConnectionCouchbase:SecretBackendConnectionCouchbase", "description": "A nested block containing configuration options for Couchbase connections.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "elasticsearch": { "$ref": "#/types/vault:database/SecretBackendConnectionElasticsearch:SecretBackendConnectionElasticsearch", "description": "A nested block containing configuration options for Elasticsearch connections.\n" }, "hana": { "$ref": "#/types/vault:database/SecretBackendConnectionHana:SecretBackendConnectionHana", "description": "A nested block containing configuration options for SAP HanaDB connections.\n" }, "influxdb": { "$ref": "#/types/vault:database/SecretBackendConnectionInfluxdb:SecretBackendConnectionInfluxdb", "description": "A nested block containing configuration options for InfluxDB connections.\n" }, "mongodb": { "$ref": "#/types/vault:database/SecretBackendConnectionMongodb:SecretBackendConnectionMongodb", "description": "A nested block containing configuration options for MongoDB connections.\n" }, "mongodbatlas": { "$ref": "#/types/vault:database/SecretBackendConnectionMongodbatlas:SecretBackendConnectionMongodbatlas", "description": "A nested block containing configuration options for MongoDB Atlas connections.\n" }, "mssql": { "$ref": "#/types/vault:database/SecretBackendConnectionMssql:SecretBackendConnectionMssql", "description": "A nested block containing configuration options for MSSQL connections.\n" }, "mysql": { "$ref": "#/types/vault:database/SecretBackendConnectionMysql:SecretBackendConnectionMysql", "description": "A nested block containing configuration options for MySQL connections.\n" }, "mysqlAurora": { "$ref": "#/types/vault:database/SecretBackendConnectionMysqlAurora:SecretBackendConnectionMysqlAurora", "description": "A nested block containing configuration options for Aurora MySQL connections.\n" }, "mysqlLegacy": { "$ref": "#/types/vault:database/SecretBackendConnectionMysqlLegacy:SecretBackendConnectionMysqlLegacy", "description": "A nested block containing configuration options for legacy MySQL connections.\n" }, "mysqlRds": { "$ref": "#/types/vault:database/SecretBackendConnectionMysqlRds:SecretBackendConnectionMysqlRds", "description": "A nested block containing configuration options for RDS MySQL connections.\n" }, "name": { "type": "string", "description": "A unique name to give the database connection.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "oracle": { "$ref": "#/types/vault:database/SecretBackendConnectionOracle:SecretBackendConnectionOracle", "description": "A nested block containing configuration options for Oracle connections.\n" }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "postgresql": { "$ref": "#/types/vault:database/SecretBackendConnectionPostgresql:SecretBackendConnectionPostgresql", "description": "A nested block containing configuration options for PostgreSQL connections.\n" }, "redis": { "$ref": "#/types/vault:database/SecretBackendConnectionRedis:SecretBackendConnectionRedis", "description": "A nested block containing configuration options for Redis connections.\n" }, "redisElasticache": { "$ref": "#/types/vault:database/SecretBackendConnectionRedisElasticache:SecretBackendConnectionRedisElasticache", "description": "A nested block containing configuration options for Redis ElastiCache connections.\n\nExactly one of the nested blocks of configuration options must be supplied.\n" }, "redshift": { "$ref": "#/types/vault:database/SecretBackendConnectionRedshift:SecretBackendConnectionRedshift", "description": "Connection parameters for the redshift-database-plugin plugin." }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "snowflake": { "$ref": "#/types/vault:database/SecretBackendConnectionSnowflake:SecretBackendConnectionSnowflake", "description": "A nested block containing configuration options for Snowflake connections.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendConnection resources.\n", "properties": { "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "A list of roles that are allowed to use this\nconnection.\n" }, "backend": { "type": "string", "description": "The unique name of the Vault mount to configure.\n", "willReplaceOnChanges": true }, "cassandra": { "$ref": "#/types/vault:database/SecretBackendConnectionCassandra:SecretBackendConnectionCassandra", "description": "A nested block containing configuration options for Cassandra connections.\n" }, "couchbase": { "$ref": "#/types/vault:database/SecretBackendConnectionCouchbase:SecretBackendConnectionCouchbase", "description": "A nested block containing configuration options for Couchbase connections.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of sensitive data to pass to the endpoint. Useful for templated connection strings.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "elasticsearch": { "$ref": "#/types/vault:database/SecretBackendConnectionElasticsearch:SecretBackendConnectionElasticsearch", "description": "A nested block containing configuration options for Elasticsearch connections.\n" }, "hana": { "$ref": "#/types/vault:database/SecretBackendConnectionHana:SecretBackendConnectionHana", "description": "A nested block containing configuration options for SAP HanaDB connections.\n" }, "influxdb": { "$ref": "#/types/vault:database/SecretBackendConnectionInfluxdb:SecretBackendConnectionInfluxdb", "description": "A nested block containing configuration options for InfluxDB connections.\n" }, "mongodb": { "$ref": "#/types/vault:database/SecretBackendConnectionMongodb:SecretBackendConnectionMongodb", "description": "A nested block containing configuration options for MongoDB connections.\n" }, "mongodbatlas": { "$ref": "#/types/vault:database/SecretBackendConnectionMongodbatlas:SecretBackendConnectionMongodbatlas", "description": "A nested block containing configuration options for MongoDB Atlas connections.\n" }, "mssql": { "$ref": "#/types/vault:database/SecretBackendConnectionMssql:SecretBackendConnectionMssql", "description": "A nested block containing configuration options for MSSQL connections.\n" }, "mysql": { "$ref": "#/types/vault:database/SecretBackendConnectionMysql:SecretBackendConnectionMysql", "description": "A nested block containing configuration options for MySQL connections.\n" }, "mysqlAurora": { "$ref": "#/types/vault:database/SecretBackendConnectionMysqlAurora:SecretBackendConnectionMysqlAurora", "description": "A nested block containing configuration options for Aurora MySQL connections.\n" }, "mysqlLegacy": { "$ref": "#/types/vault:database/SecretBackendConnectionMysqlLegacy:SecretBackendConnectionMysqlLegacy", "description": "A nested block containing configuration options for legacy MySQL connections.\n" }, "mysqlRds": { "$ref": "#/types/vault:database/SecretBackendConnectionMysqlRds:SecretBackendConnectionMysqlRds", "description": "A nested block containing configuration options for RDS MySQL connections.\n" }, "name": { "type": "string", "description": "A unique name to give the database connection.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "oracle": { "$ref": "#/types/vault:database/SecretBackendConnectionOracle:SecretBackendConnectionOracle", "description": "A nested block containing configuration options for Oracle connections.\n" }, "passwordPolicy": { "type": "string", "description": "The name of the password policy to use when generating passwords for this database. If not specified, this will use a default policy defined as: 20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.\n" }, "pluginName": { "type": "string", "description": "Specifies the name of the plugin to use.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "postgresql": { "$ref": "#/types/vault:database/SecretBackendConnectionPostgresql:SecretBackendConnectionPostgresql", "description": "A nested block containing configuration options for PostgreSQL connections.\n" }, "redis": { "$ref": "#/types/vault:database/SecretBackendConnectionRedis:SecretBackendConnectionRedis", "description": "A nested block containing configuration options for Redis connections.\n" }, "redisElasticache": { "$ref": "#/types/vault:database/SecretBackendConnectionRedisElasticache:SecretBackendConnectionRedisElasticache", "description": "A nested block containing configuration options for Redis ElastiCache connections.\n\nExactly one of the nested blocks of configuration options must be supplied.\n" }, "redshift": { "$ref": "#/types/vault:database/SecretBackendConnectionRedshift:SecretBackendConnectionRedshift", "description": "Connection parameters for the redshift-database-plugin plugin." }, "rootRotationStatements": { "type": "array", "items": { "type": "string" }, "description": "A list of database statements to be executed to rotate the root user's credentials.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "Specifies if a given static account's password should be rotated on creation of the static roles associated with this database config. This can be overridden at the role-level by the static role's\u003cspan pulumi-lang-nodejs=\" skipImportRotation \" pulumi-lang-dotnet=\" SkipImportRotation \" pulumi-lang-go=\" skipImportRotation \" pulumi-lang-python=\" skip_import_rotation \" pulumi-lang-yaml=\" skipImportRotation \" pulumi-lang-java=\" skipImportRotation \" pulumi-lang-hcl=\" skip_import_rotation \"\u003e skipImportRotation \u003c/span\u003efield. The default is false. Requires Vault Enterprise 1.19+.\n" }, "snowflake": { "$ref": "#/types/vault:database/SecretBackendConnectionSnowflake:SecretBackendConnectionSnowflake", "description": "A nested block containing configuration options for Snowflake connections.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether the connection should be verified on\ninitial configuration or not.\n" } }, "type": "object" } }, "vault:database/secretBackendRole:SecretBackendRole": { "description": "Creates a Database Secret Backend role in Vault. Database secret backend\nroles can be used to generate dynamic credentials for the database.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst db = new vault.Mount(\"db\", {\n path: \"postgres\",\n type: \"database\",\n});\nconst postgres = new vault.database.SecretBackendConnection(\"postgres\", {\n backend: db.path,\n name: \"postgres\",\n allowedRoles: [\n \"dev\",\n \"prod\",\n ],\n postgresql: {\n connectionUrl: \"postgres://username:password@host:port/database\",\n },\n});\nconst role = new vault.database.SecretBackendRole(\"role\", {\n backend: db.path,\n name: \"dev\",\n dbName: postgres.name,\n creationStatements: [\"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndb = vault.Mount(\"db\",\n path=\"postgres\",\n type=\"database\")\npostgres = vault.database.SecretBackendConnection(\"postgres\",\n backend=db.path,\n name=\"postgres\",\n allowed_roles=[\n \"dev\",\n \"prod\",\n ],\n postgresql={\n \"connection_url\": \"postgres://username:password@host:port/database\",\n })\nrole = vault.database.SecretBackendRole(\"role\",\n backend=db.path,\n name=\"dev\",\n db_name=postgres.name,\n creation_statements=[\"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var db = new Vault.Mount(\"db\", new()\n {\n Path = \"postgres\",\n Type = \"database\",\n });\n\n var postgres = new Vault.Database.SecretBackendConnection(\"postgres\", new()\n {\n Backend = db.Path,\n Name = \"postgres\",\n AllowedRoles = new[]\n {\n \"dev\",\n \"prod\",\n },\n Postgresql = new Vault.Database.Inputs.SecretBackendConnectionPostgresqlArgs\n {\n ConnectionUrl = \"postgres://username:password@host:port/database\",\n },\n });\n\n var role = new Vault.Database.SecretBackendRole(\"role\", new()\n {\n Backend = db.Path,\n Name = \"dev\",\n DbName = postgres.Name,\n CreationStatements = new[]\n {\n \"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/database\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tdb, err := vault.NewMount(ctx, \"db\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"postgres\"),\n\t\t\tType: pulumi.String(\"database\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tpostgres, err := database.NewSecretBackendConnection(ctx, \"postgres\", \u0026database.SecretBackendConnectionArgs{\n\t\t\tBackend: db.Path,\n\t\t\tName: pulumi.String(\"postgres\"),\n\t\t\tAllowedRoles: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t\tPostgresql: \u0026database.SecretBackendConnectionPostgresqlArgs{\n\t\t\t\tConnectionUrl: pulumi.String(\"postgres://username:password@host:port/database\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = database.NewSecretBackendRole(ctx, \"role\", \u0026database.SecretBackendRoleArgs{\n\t\t\tBackend: db.Path,\n\t\t\tName: pulumi.String(\"dev\"),\n\t\t\tDbName: postgres.Name,\n\t\t\tCreationStatements: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"db\" {\n path = \"postgres\"\n type = \"database\"\n}\nresource \"vault_database_secretbackendconnection\" \"postgres\" {\n backend = vault_mount.db.path\n name = \"postgres\"\n allowed_roles = [\"dev\", \"prod\"]\n postgresql = {\n connection_url = \"postgres://username:password@host:port/database\"\n }\n}\nresource \"vault_database_secretbackendrole\" \"role\" {\n backend = vault_mount.db.path\n name = \"dev\"\n db_name = vault_database_secretbackendconnection.postgres.name\n creation_statements = [\"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.database.SecretBackendConnection;\nimport com.pulumi.vault.database.SecretBackendConnectionArgs;\nimport com.pulumi.vault.database.inputs.SecretBackendConnectionPostgresqlArgs;\nimport com.pulumi.vault.database.SecretBackendRole;\nimport com.pulumi.vault.database.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var db = new Mount(\"db\", MountArgs.builder()\n .path(\"postgres\")\n .type(\"database\")\n .build());\n\n var postgres = new SecretBackendConnection(\"postgres\", SecretBackendConnectionArgs.builder()\n .backend(db.path())\n .name(\"postgres\")\n .allowedRoles( \n \"dev\",\n \"prod\")\n .postgresql(SecretBackendConnectionPostgresqlArgs.builder()\n .connectionUrl(\"postgres://username:password@host:port/database\")\n .build())\n .build());\n\n var role = new SecretBackendRole(\"role\", SecretBackendRoleArgs.builder()\n .backend(db.path())\n .name(\"dev\")\n .dbName(postgres.name())\n .creationStatements(\"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n db:\n type: vault:Mount\n properties:\n path: postgres\n type: database\n postgres:\n type: vault:database:SecretBackendConnection\n properties:\n backend: ${db.path}\n name: postgres\n allowedRoles:\n - dev\n - prod\n postgresql:\n connectionUrl: postgres://username:password@host:port/database\n role:\n type: vault:database:SecretBackendRole\n properties:\n backend: ${db.path}\n name: dev\n dbName: ${postgres.name}\n creationStatements:\n - CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nDatabase secret backend roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, `/roles/`, and the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e e.g.\n\n```sh\n$ pulumi import vault:database/secretBackendRole:SecretBackendRole example postgres/roles/my-role\n```\n\n", "properties": { "backend": { "type": "string", "description": "The unique name of the Vault mount to configure.\n" }, "creationStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\ncreating a user.\n" }, "credentialConfig": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies the configuration\nfor the given \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e.\n\nThe following options are available for each \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e value:\n" }, "credentialType": { "type": "string", "description": "Specifies the type of credential that\nwill be generated for the role. Options include: \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`rsaPrivateKey`\" pulumi-lang-dotnet=\"`RsaPrivateKey`\" pulumi-lang-go=\"`rsaPrivateKey`\" pulumi-lang-python=\"`rsa_private_key`\" pulumi-lang-yaml=\"`rsaPrivateKey`\" pulumi-lang-java=\"`rsaPrivateKey`\" pulumi-lang-hcl=\"`rsa_private_key`\"\u003e`rsaPrivateKey`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`clientCertificate`\" pulumi-lang-dotnet=\"`ClientCertificate`\" pulumi-lang-go=\"`clientCertificate`\" pulumi-lang-python=\"`client_certificate`\" pulumi-lang-yaml=\"`clientCertificate`\" pulumi-lang-java=\"`clientCertificate`\" pulumi-lang-hcl=\"`client_certificate`\"\u003e`clientCertificate`\u003c/span\u003e.\nSee the plugin's API page for credential types supported by individual databases.\n" }, "dbName": { "type": "string", "description": "The unique name of the database connection to use for\nthe role.\n" }, "defaultTtl": { "type": "integer", "description": "The default number of seconds for leases for this\nrole.\n" }, "maxTtl": { "type": "integer", "description": "The maximum number of seconds for leases for this\nrole.\n" }, "name": { "type": "string", "description": "A unique name to give the role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n" }, "renewStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\nrenewing a user.\n" }, "revocationStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\nrevoking a user.\n" }, "rollbackStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\nrolling back creation due to an error.\n" } }, "required": [ "backend", "creationStatements", "credentialType", "dbName", "name" ], "inputProperties": { "backend": { "type": "string", "description": "The unique name of the Vault mount to configure.\n", "willReplaceOnChanges": true }, "creationStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\ncreating a user.\n" }, "credentialConfig": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies the configuration\nfor the given \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e.\n\nThe following options are available for each \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e value:\n" }, "credentialType": { "type": "string", "description": "Specifies the type of credential that\nwill be generated for the role. Options include: \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`rsaPrivateKey`\" pulumi-lang-dotnet=\"`RsaPrivateKey`\" pulumi-lang-go=\"`rsaPrivateKey`\" pulumi-lang-python=\"`rsa_private_key`\" pulumi-lang-yaml=\"`rsaPrivateKey`\" pulumi-lang-java=\"`rsaPrivateKey`\" pulumi-lang-hcl=\"`rsa_private_key`\"\u003e`rsaPrivateKey`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`clientCertificate`\" pulumi-lang-dotnet=\"`ClientCertificate`\" pulumi-lang-go=\"`clientCertificate`\" pulumi-lang-python=\"`client_certificate`\" pulumi-lang-yaml=\"`clientCertificate`\" pulumi-lang-java=\"`clientCertificate`\" pulumi-lang-hcl=\"`client_certificate`\"\u003e`clientCertificate`\u003c/span\u003e.\nSee the plugin's API page for credential types supported by individual databases.\n" }, "dbName": { "type": "string", "description": "The unique name of the database connection to use for\nthe role.\n", "willReplaceOnChanges": true }, "defaultTtl": { "type": "integer", "description": "The default number of seconds for leases for this\nrole.\n" }, "maxTtl": { "type": "integer", "description": "The maximum number of seconds for leases for this\nrole.\n" }, "name": { "type": "string", "description": "A unique name to give the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "renewStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\nrenewing a user.\n" }, "revocationStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\nrevoking a user.\n" }, "rollbackStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\nrolling back creation due to an error.\n" } }, "requiredInputs": [ "backend", "creationStatements", "dbName" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRole resources.\n", "properties": { "backend": { "type": "string", "description": "The unique name of the Vault mount to configure.\n", "willReplaceOnChanges": true }, "creationStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\ncreating a user.\n" }, "credentialConfig": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies the configuration\nfor the given \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e.\n\nThe following options are available for each \u003cspan pulumi-lang-nodejs=\"`credentialType`\" pulumi-lang-dotnet=\"`CredentialType`\" pulumi-lang-go=\"`credentialType`\" pulumi-lang-python=\"`credential_type`\" pulumi-lang-yaml=\"`credentialType`\" pulumi-lang-java=\"`credentialType`\" pulumi-lang-hcl=\"`credential_type`\"\u003e`credentialType`\u003c/span\u003e value:\n" }, "credentialType": { "type": "string", "description": "Specifies the type of credential that\nwill be generated for the role. Options include: \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`rsaPrivateKey`\" pulumi-lang-dotnet=\"`RsaPrivateKey`\" pulumi-lang-go=\"`rsaPrivateKey`\" pulumi-lang-python=\"`rsa_private_key`\" pulumi-lang-yaml=\"`rsaPrivateKey`\" pulumi-lang-java=\"`rsaPrivateKey`\" pulumi-lang-hcl=\"`rsa_private_key`\"\u003e`rsaPrivateKey`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`clientCertificate`\" pulumi-lang-dotnet=\"`ClientCertificate`\" pulumi-lang-go=\"`clientCertificate`\" pulumi-lang-python=\"`client_certificate`\" pulumi-lang-yaml=\"`clientCertificate`\" pulumi-lang-java=\"`clientCertificate`\" pulumi-lang-hcl=\"`client_certificate`\"\u003e`clientCertificate`\u003c/span\u003e.\nSee the plugin's API page for credential types supported by individual databases.\n" }, "dbName": { "type": "string", "description": "The unique name of the database connection to use for\nthe role.\n", "willReplaceOnChanges": true }, "defaultTtl": { "type": "integer", "description": "The default number of seconds for leases for this\nrole.\n" }, "maxTtl": { "type": "integer", "description": "The maximum number of seconds for leases for this\nrole.\n" }, "name": { "type": "string", "description": "A unique name to give the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "renewStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\nrenewing a user.\n" }, "revocationStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\nrevoking a user.\n" }, "rollbackStatements": { "type": "array", "items": { "type": "string" }, "description": "The database statements to execute when\nrolling back creation due to an error.\n" } }, "type": "object" } }, "vault:database/secretBackendStaticRole:SecretBackendStaticRole": { "description": "Creates a Database Secret Backend static role in Vault. Database secret backend\nstatic roles can be used to manage 1-to-1 mapping of a Vault Role to a user in a\ndatabase for the database.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst db = new vault.Mount(\"db\", {\n path: \"postgres\",\n type: \"database\",\n});\nconst postgres = new vault.database.SecretBackendConnection(\"postgres\", {\n backend: db.path,\n name: \"postgres\",\n allowedRoles: [\"*\"],\n postgresql: {\n connectionUrl: \"postgres://username:password@host:port/database\",\n },\n});\n// configure a static role with period-based rotations\nconst periodRole = new vault.database.SecretBackendStaticRole(\"period_role\", {\n backend: db.path,\n name: \"my-period-role\",\n dbName: postgres.name,\n username: \"example\",\n rotationPeriod: 3600,\n rotationStatements: [\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"],\n});\n// configure a static role with schedule-based rotations\nconst scheduleRole = new vault.database.SecretBackendStaticRole(\"schedule_role\", {\n backend: db.path,\n name: \"my-schedule-role\",\n dbName: postgres.name,\n username: \"example\",\n rotationSchedule: \"0 0 * * SAT\",\n rotationWindow: 172800,\n rotationStatements: [\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"],\n});\n// configure a static role with a password (Vault 1.19+)\nconst passwordRole = new vault.database.SecretBackendStaticRole(\"password_role\", {\n backend: db.path,\n name: \"my-password-role\",\n dbName: postgres.name,\n username: \"example\",\n passwordWo: \"my-password\",\n passwordWoVersion: 1,\n rotationPeriod: 3600,\n rotationStatements: [\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndb = vault.Mount(\"db\",\n path=\"postgres\",\n type=\"database\")\npostgres = vault.database.SecretBackendConnection(\"postgres\",\n backend=db.path,\n name=\"postgres\",\n allowed_roles=[\"*\"],\n postgresql={\n \"connection_url\": \"postgres://username:password@host:port/database\",\n })\n# configure a static role with period-based rotations\nperiod_role = vault.database.SecretBackendStaticRole(\"period_role\",\n backend=db.path,\n name=\"my-period-role\",\n db_name=postgres.name,\n username=\"example\",\n rotation_period=3600,\n rotation_statements=[\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"])\n# configure a static role with schedule-based rotations\nschedule_role = vault.database.SecretBackendStaticRole(\"schedule_role\",\n backend=db.path,\n name=\"my-schedule-role\",\n db_name=postgres.name,\n username=\"example\",\n rotation_schedule=\"0 0 * * SAT\",\n rotation_window=172800,\n rotation_statements=[\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"])\n# configure a static role with a password (Vault 1.19+)\npassword_role = vault.database.SecretBackendStaticRole(\"password_role\",\n backend=db.path,\n name=\"my-password-role\",\n db_name=postgres.name,\n username=\"example\",\n password_wo=\"my-password\",\n password_wo_version=1,\n rotation_period=3600,\n rotation_statements=[\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var db = new Vault.Mount(\"db\", new()\n {\n Path = \"postgres\",\n Type = \"database\",\n });\n\n var postgres = new Vault.Database.SecretBackendConnection(\"postgres\", new()\n {\n Backend = db.Path,\n Name = \"postgres\",\n AllowedRoles = new[]\n {\n \"*\",\n },\n Postgresql = new Vault.Database.Inputs.SecretBackendConnectionPostgresqlArgs\n {\n ConnectionUrl = \"postgres://username:password@host:port/database\",\n },\n });\n\n // configure a static role with period-based rotations\n var periodRole = new Vault.Database.SecretBackendStaticRole(\"period_role\", new()\n {\n Backend = db.Path,\n Name = \"my-period-role\",\n DbName = postgres.Name,\n Username = \"example\",\n RotationPeriod = 3600,\n RotationStatements = new[]\n {\n \"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\",\n },\n });\n\n // configure a static role with schedule-based rotations\n var scheduleRole = new Vault.Database.SecretBackendStaticRole(\"schedule_role\", new()\n {\n Backend = db.Path,\n Name = \"my-schedule-role\",\n DbName = postgres.Name,\n Username = \"example\",\n RotationSchedule = \"0 0 * * SAT\",\n RotationWindow = 172800,\n RotationStatements = new[]\n {\n \"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\",\n },\n });\n\n // configure a static role with a password (Vault 1.19+)\n var passwordRole = new Vault.Database.SecretBackendStaticRole(\"password_role\", new()\n {\n Backend = db.Path,\n Name = \"my-password-role\",\n DbName = postgres.Name,\n Username = \"example\",\n PasswordWo = \"my-password\",\n PasswordWoVersion = 1,\n RotationPeriod = 3600,\n RotationStatements = new[]\n {\n \"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/database\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tdb, err := vault.NewMount(ctx, \"db\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"postgres\"),\n\t\t\tType: pulumi.String(\"database\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tpostgres, err := database.NewSecretBackendConnection(ctx, \"postgres\", \u0026database.SecretBackendConnectionArgs{\n\t\t\tBackend: db.Path,\n\t\t\tName: pulumi.String(\"postgres\"),\n\t\t\tAllowedRoles: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*\"),\n\t\t\t},\n\t\t\tPostgresql: \u0026database.SecretBackendConnectionPostgresqlArgs{\n\t\t\t\tConnectionUrl: pulumi.String(\"postgres://username:password@host:port/database\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// configure a static role with period-based rotations\n\t\t_, err = database.NewSecretBackendStaticRole(ctx, \"period_role\", \u0026database.SecretBackendStaticRoleArgs{\n\t\t\tBackend: db.Path,\n\t\t\tName: pulumi.String(\"my-period-role\"),\n\t\t\tDbName: postgres.Name,\n\t\t\tUsername: pulumi.String(\"example\"),\n\t\t\tRotationPeriod: pulumi.Int(3600),\n\t\t\tRotationStatements: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// configure a static role with schedule-based rotations\n\t\t_, err = database.NewSecretBackendStaticRole(ctx, \"schedule_role\", \u0026database.SecretBackendStaticRoleArgs{\n\t\t\tBackend: db.Path,\n\t\t\tName: pulumi.String(\"my-schedule-role\"),\n\t\t\tDbName: postgres.Name,\n\t\t\tUsername: pulumi.String(\"example\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 0 * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(172800),\n\t\t\tRotationStatements: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// configure a static role with a password (Vault 1.19+)\n\t\t_, err = database.NewSecretBackendStaticRole(ctx, \"password_role\", \u0026database.SecretBackendStaticRoleArgs{\n\t\t\tBackend: db.Path,\n\t\t\tName: pulumi.String(\"my-password-role\"),\n\t\t\tDbName: postgres.Name,\n\t\t\tUsername: pulumi.String(\"example\"),\n\t\t\tPasswordWo: pulumi.String(\"my-password\"),\n\t\t\tPasswordWoVersion: pulumi.Int(1),\n\t\t\tRotationPeriod: pulumi.Int(3600),\n\t\t\tRotationStatements: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"db\" {\n path = \"postgres\"\n type = \"database\"\n}\nresource \"vault_database_secretbackendconnection\" \"postgres\" {\n backend = vault_mount.db.path\n name = \"postgres\"\n allowed_roles = [\"*\"]\n postgresql = {\n connection_url = \"postgres://username:password@host:port/database\"\n }\n}\n# configure a static role with period-based rotations\nresource \"vault_database_secretbackendstaticrole\" \"period_role\" {\n backend = vault_mount.db.path\n name = \"my-period-role\"\n db_name = vault_database_secretbackendconnection.postgres.name\n username = \"example\"\n rotation_period = \"3600\"\n rotation_statements = [\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"]\n}\n# configure a static role with schedule-based rotations\nresource \"vault_database_secretbackendstaticrole\" \"schedule_role\" {\n backend = vault_mount.db.path\n name = \"my-schedule-role\"\n db_name = vault_database_secretbackendconnection.postgres.name\n username = \"example\"\n rotation_schedule = \"0 0 * * SAT\"\n rotation_window = \"172800\"\n rotation_statements = [\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"]\n}\n# configure a static role with a password (Vault 1.19+)\nresource \"vault_database_secretbackendstaticrole\" \"password_role\" {\n backend = vault_mount.db.path\n name = \"my-password-role\"\n db_name = vault_database_secretbackendconnection.postgres.name\n username = \"example\"\n password_wo = \"my-password\"\n password_wo_version = 1\n rotation_period = \"3600\"\n rotation_statements = [\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.database.SecretBackendConnection;\nimport com.pulumi.vault.database.SecretBackendConnectionArgs;\nimport com.pulumi.vault.database.inputs.SecretBackendConnectionPostgresqlArgs;\nimport com.pulumi.vault.database.SecretBackendStaticRole;\nimport com.pulumi.vault.database.SecretBackendStaticRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var db = new Mount(\"db\", MountArgs.builder()\n .path(\"postgres\")\n .type(\"database\")\n .build());\n\n var postgres = new SecretBackendConnection(\"postgres\", SecretBackendConnectionArgs.builder()\n .backend(db.path())\n .name(\"postgres\")\n .allowedRoles(\"*\")\n .postgresql(SecretBackendConnectionPostgresqlArgs.builder()\n .connectionUrl(\"postgres://username:password@host:port/database\")\n .build())\n .build());\n\n // configure a static role with period-based rotations\n var periodRole = new SecretBackendStaticRole(\"periodRole\", SecretBackendStaticRoleArgs.builder()\n .backend(db.path())\n .name(\"my-period-role\")\n .dbName(postgres.name())\n .username(\"example\")\n .rotationPeriod(3600)\n .rotationStatements(\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\")\n .build());\n\n // configure a static role with schedule-based rotations\n var scheduleRole = new SecretBackendStaticRole(\"scheduleRole\", SecretBackendStaticRoleArgs.builder()\n .backend(db.path())\n .name(\"my-schedule-role\")\n .dbName(postgres.name())\n .username(\"example\")\n .rotationSchedule(\"0 0 * * SAT\")\n .rotationWindow(172800)\n .rotationStatements(\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\")\n .build());\n\n // configure a static role with a password (Vault 1.19+)\n var passwordRole = new SecretBackendStaticRole(\"passwordRole\", SecretBackendStaticRoleArgs.builder()\n .backend(db.path())\n .name(\"my-password-role\")\n .dbName(postgres.name())\n .username(\"example\")\n .passwordWo(\"my-password\")\n .passwordWoVersion(1)\n .rotationPeriod(3600)\n .rotationStatements(\"ALTER USER \\\"{{name}}\\\" WITH PASSWORD '{{password}}';\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n db:\n type: vault:Mount\n properties:\n path: postgres\n type: database\n postgres:\n type: vault:database:SecretBackendConnection\n properties:\n backend: ${db.path}\n name: postgres\n allowedRoles:\n - '*'\n postgresql:\n connectionUrl: postgres://username:password@host:port/database\n # configure a static role with period-based rotations\n periodRole:\n type: vault:database:SecretBackendStaticRole\n name: period_role\n properties:\n backend: ${db.path}\n name: my-period-role\n dbName: ${postgres.name}\n username: example\n rotationPeriod: '3600'\n rotationStatements:\n - ALTER USER \"{{name}}\" WITH PASSWORD '{{password}}';\n # configure a static role with schedule-based rotations\n scheduleRole:\n type: vault:database:SecretBackendStaticRole\n name: schedule_role\n properties:\n backend: ${db.path}\n name: my-schedule-role\n dbName: ${postgres.name}\n username: example\n rotationSchedule: 0 0 * * SAT\n rotationWindow: '172800'\n rotationStatements:\n - ALTER USER \"{{name}}\" WITH PASSWORD '{{password}}';\n # configure a static role with a password (Vault 1.19+)\n passwordRole:\n type: vault:database:SecretBackendStaticRole\n name: password_role\n properties:\n backend: ${db.path}\n name: my-password-role\n dbName: ${postgres.name}\n username: example\n passwordWo: my-password\n passwordWoVersion: 1\n rotationPeriod: '3600'\n rotationStatements:\n - ALTER USER \"{{name}}\" WITH PASSWORD '{{password}}';\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nDatabase secret backend static roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, `/static-roles/`, and the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e e.g.\n\n```sh\n$ pulumi import vault:database/secretBackendStaticRole:SecretBackendStaticRole example postgres/static-roles/my-role\n```\n\n", "properties": { "backend": { "type": "string", "description": "The unique name of the Vault mount to configure.\n" }, "credentialConfig": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The configuration for the credential type.Full documentation for the allowed values can be found under \"https://developer.hashicorp.com/vault/api-docs/secret/databases#credential_config\"." }, "credentialType": { "type": "string", "description": "The credential type for the user, can be one of \"password\", \u003cspan pulumi-lang-nodejs=\"\"rsaPrivateKey\"\" pulumi-lang-dotnet=\"\"RsaPrivateKey\"\" pulumi-lang-go=\"\"rsaPrivateKey\"\" pulumi-lang-python=\"\"rsa_private_key\"\" pulumi-lang-yaml=\"\"rsaPrivateKey\"\" pulumi-lang-java=\"\"rsaPrivateKey\"\" pulumi-lang-hcl=\"\"rsa_private_key\"\"\u003e\"rsaPrivateKey\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"clientCertificate\"\" pulumi-lang-dotnet=\"\"ClientCertificate\"\" pulumi-lang-go=\"\"clientCertificate\"\" pulumi-lang-python=\"\"client_certificate\"\" pulumi-lang-yaml=\"\"clientCertificate\"\" pulumi-lang-java=\"\"clientCertificate\"\" pulumi-lang-hcl=\"\"client_certificate\"\"\u003e\"clientCertificate\"\u003c/span\u003e.The configuration can be done in \u003cspan pulumi-lang-nodejs=\"`credentialConfig`\" pulumi-lang-dotnet=\"`CredentialConfig`\" pulumi-lang-go=\"`credentialConfig`\" pulumi-lang-python=\"`credential_config`\" pulumi-lang-yaml=\"`credentialConfig`\" pulumi-lang-java=\"`credentialConfig`\" pulumi-lang-hcl=\"`credential_config`\"\u003e`credentialConfig`\u003c/span\u003e." }, "dbName": { "type": "string", "description": "The unique name of the database connection to use for the static role.\n" }, "name": { "type": "string", "description": "A unique name to give the static role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe password corresponding to the username in the database.\nThis is a write-only field. Requires Vault 1.19+. Deprecates \u003cspan pulumi-lang-nodejs=\"`selfManagedPassword`\" pulumi-lang-dotnet=\"`SelfManagedPassword`\" pulumi-lang-go=\"`selfManagedPassword`\" pulumi-lang-python=\"`self_managed_password`\" pulumi-lang-yaml=\"`selfManagedPassword`\" pulumi-lang-java=\"`selfManagedPassword`\" pulumi-lang-hcl=\"`self_managed_password`\"\u003e`selfManagedPassword`\u003c/span\u003e which was introduced in Vault 1.18.\nCannot be used with \u003cspan pulumi-lang-nodejs=\"`selfManagedPassword`\" pulumi-lang-dotnet=\"`SelfManagedPassword`\" pulumi-lang-go=\"`selfManagedPassword`\" pulumi-lang-python=\"`self_managed_password`\" pulumi-lang-yaml=\"`selfManagedPassword`\" pulumi-lang-java=\"`selfManagedPassword`\" pulumi-lang-hcl=\"`self_managed_password`\"\u003e`selfManagedPassword`\u003c/span\u003e.\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field. \nUsed for tracking changes to the write-only password field. For more info see\nupdating write-only attributes.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time Vault should wait before rotating the password, in seconds.\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "rotationSchedule": { "type": "string", "description": "A cron-style string that will define the schedule on which rotations should occur.\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e.\n\n**Warning**: The \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e fields are\nmutually exclusive. One of them must be set but not both.\n" }, "rotationStatements": { "type": "array", "items": { "type": "string" }, "description": "Database statements to execute to rotate the password for the configured database user.\n" }, "rotationWindow": { "type": "integer", "description": "The amount of time, in seconds, in which rotations are allowed to occur starting\nfrom a given \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "selfManagedPassword": { "type": "string", "description": "The password corresponding to the username in the database.\nRequired when using the Rootless Password Rotation workflow for static roles. Only enabled for\nselect DB engines (Postgres). Requires Vault 1.18+ Enterprise.\n**Deprecated**: Use \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e instead. This field will be removed in a future version.\n", "secret": true }, "skipImportRotation": { "type": "boolean", "description": "If set to true, Vault will skip the\ninitial secret rotation on import. Requires Vault 1.18+ Enterprise.\n" }, "username": { "type": "string", "description": "The database username that this static role corresponds to.\n" } }, "required": [ "backend", "credentialType", "dbName", "name", "skipImportRotation", "username" ], "inputProperties": { "backend": { "type": "string", "description": "The unique name of the Vault mount to configure.\n", "willReplaceOnChanges": true }, "credentialConfig": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The configuration for the credential type.Full documentation for the allowed values can be found under \"https://developer.hashicorp.com/vault/api-docs/secret/databases#credential_config\"." }, "credentialType": { "type": "string", "description": "The credential type for the user, can be one of \"password\", \u003cspan pulumi-lang-nodejs=\"\"rsaPrivateKey\"\" pulumi-lang-dotnet=\"\"RsaPrivateKey\"\" pulumi-lang-go=\"\"rsaPrivateKey\"\" pulumi-lang-python=\"\"rsa_private_key\"\" pulumi-lang-yaml=\"\"rsaPrivateKey\"\" pulumi-lang-java=\"\"rsaPrivateKey\"\" pulumi-lang-hcl=\"\"rsa_private_key\"\"\u003e\"rsaPrivateKey\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"clientCertificate\"\" pulumi-lang-dotnet=\"\"ClientCertificate\"\" pulumi-lang-go=\"\"clientCertificate\"\" pulumi-lang-python=\"\"client_certificate\"\" pulumi-lang-yaml=\"\"clientCertificate\"\" pulumi-lang-java=\"\"clientCertificate\"\" pulumi-lang-hcl=\"\"client_certificate\"\"\u003e\"clientCertificate\"\u003c/span\u003e.The configuration can be done in \u003cspan pulumi-lang-nodejs=\"`credentialConfig`\" pulumi-lang-dotnet=\"`CredentialConfig`\" pulumi-lang-go=\"`credentialConfig`\" pulumi-lang-python=\"`credential_config`\" pulumi-lang-yaml=\"`credentialConfig`\" pulumi-lang-java=\"`credentialConfig`\" pulumi-lang-hcl=\"`credential_config`\"\u003e`credentialConfig`\u003c/span\u003e." }, "dbName": { "type": "string", "description": "The unique name of the database connection to use for the static role.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "A unique name to give the static role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe password corresponding to the username in the database.\nThis is a write-only field. Requires Vault 1.19+. Deprecates \u003cspan pulumi-lang-nodejs=\"`selfManagedPassword`\" pulumi-lang-dotnet=\"`SelfManagedPassword`\" pulumi-lang-go=\"`selfManagedPassword`\" pulumi-lang-python=\"`self_managed_password`\" pulumi-lang-yaml=\"`selfManagedPassword`\" pulumi-lang-java=\"`selfManagedPassword`\" pulumi-lang-hcl=\"`self_managed_password`\"\u003e`selfManagedPassword`\u003c/span\u003e which was introduced in Vault 1.18.\nCannot be used with \u003cspan pulumi-lang-nodejs=\"`selfManagedPassword`\" pulumi-lang-dotnet=\"`SelfManagedPassword`\" pulumi-lang-go=\"`selfManagedPassword`\" pulumi-lang-python=\"`self_managed_password`\" pulumi-lang-yaml=\"`selfManagedPassword`\" pulumi-lang-java=\"`selfManagedPassword`\" pulumi-lang-hcl=\"`self_managed_password`\"\u003e`selfManagedPassword`\u003c/span\u003e.\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field. \nUsed for tracking changes to the write-only password field. For more info see\nupdating write-only attributes.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time Vault should wait before rotating the password, in seconds.\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "rotationSchedule": { "type": "string", "description": "A cron-style string that will define the schedule on which rotations should occur.\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e.\n\n**Warning**: The \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e fields are\nmutually exclusive. One of them must be set but not both.\n" }, "rotationStatements": { "type": "array", "items": { "type": "string" }, "description": "Database statements to execute to rotate the password for the configured database user.\n" }, "rotationWindow": { "type": "integer", "description": "The amount of time, in seconds, in which rotations are allowed to occur starting\nfrom a given \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "selfManagedPassword": { "type": "string", "description": "The password corresponding to the username in the database.\nRequired when using the Rootless Password Rotation workflow for static roles. Only enabled for\nselect DB engines (Postgres). Requires Vault 1.18+ Enterprise.\n**Deprecated**: Use \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e instead. This field will be removed in a future version.\n", "secret": true }, "skipImportRotation": { "type": "boolean", "description": "If set to true, Vault will skip the\ninitial secret rotation on import. Requires Vault 1.18+ Enterprise.\n" }, "username": { "type": "string", "description": "The database username that this static role corresponds to.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "dbName", "username" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendStaticRole resources.\n", "properties": { "backend": { "type": "string", "description": "The unique name of the Vault mount to configure.\n", "willReplaceOnChanges": true }, "credentialConfig": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The configuration for the credential type.Full documentation for the allowed values can be found under \"https://developer.hashicorp.com/vault/api-docs/secret/databases#credential_config\"." }, "credentialType": { "type": "string", "description": "The credential type for the user, can be one of \"password\", \u003cspan pulumi-lang-nodejs=\"\"rsaPrivateKey\"\" pulumi-lang-dotnet=\"\"RsaPrivateKey\"\" pulumi-lang-go=\"\"rsaPrivateKey\"\" pulumi-lang-python=\"\"rsa_private_key\"\" pulumi-lang-yaml=\"\"rsaPrivateKey\"\" pulumi-lang-java=\"\"rsaPrivateKey\"\" pulumi-lang-hcl=\"\"rsa_private_key\"\"\u003e\"rsaPrivateKey\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"clientCertificate\"\" pulumi-lang-dotnet=\"\"ClientCertificate\"\" pulumi-lang-go=\"\"clientCertificate\"\" pulumi-lang-python=\"\"client_certificate\"\" pulumi-lang-yaml=\"\"clientCertificate\"\" pulumi-lang-java=\"\"clientCertificate\"\" pulumi-lang-hcl=\"\"client_certificate\"\"\u003e\"clientCertificate\"\u003c/span\u003e.The configuration can be done in \u003cspan pulumi-lang-nodejs=\"`credentialConfig`\" pulumi-lang-dotnet=\"`CredentialConfig`\" pulumi-lang-go=\"`credentialConfig`\" pulumi-lang-python=\"`credential_config`\" pulumi-lang-yaml=\"`credentialConfig`\" pulumi-lang-java=\"`credentialConfig`\" pulumi-lang-hcl=\"`credential_config`\"\u003e`credentialConfig`\u003c/span\u003e." }, "dbName": { "type": "string", "description": "The unique name of the database connection to use for the static role.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "A unique name to give the static role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe password corresponding to the username in the database.\nThis is a write-only field. Requires Vault 1.19+. Deprecates \u003cspan pulumi-lang-nodejs=\"`selfManagedPassword`\" pulumi-lang-dotnet=\"`SelfManagedPassword`\" pulumi-lang-go=\"`selfManagedPassword`\" pulumi-lang-python=\"`self_managed_password`\" pulumi-lang-yaml=\"`selfManagedPassword`\" pulumi-lang-java=\"`selfManagedPassword`\" pulumi-lang-hcl=\"`self_managed_password`\"\u003e`selfManagedPassword`\u003c/span\u003e which was introduced in Vault 1.18.\nCannot be used with \u003cspan pulumi-lang-nodejs=\"`selfManagedPassword`\" pulumi-lang-dotnet=\"`SelfManagedPassword`\" pulumi-lang-go=\"`selfManagedPassword`\" pulumi-lang-python=\"`self_managed_password`\" pulumi-lang-yaml=\"`selfManagedPassword`\" pulumi-lang-java=\"`selfManagedPassword`\" pulumi-lang-hcl=\"`self_managed_password`\"\u003e`selfManagedPassword`\u003c/span\u003e.\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field. \nUsed for tracking changes to the write-only password field. For more info see\nupdating write-only attributes.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time Vault should wait before rotating the password, in seconds.\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "rotationSchedule": { "type": "string", "description": "A cron-style string that will define the schedule on which rotations should occur.\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e.\n\n**Warning**: The \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e fields are\nmutually exclusive. One of them must be set but not both.\n" }, "rotationStatements": { "type": "array", "items": { "type": "string" }, "description": "Database statements to execute to rotate the password for the configured database user.\n" }, "rotationWindow": { "type": "integer", "description": "The amount of time, in seconds, in which rotations are allowed to occur starting\nfrom a given \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "selfManagedPassword": { "type": "string", "description": "The password corresponding to the username in the database.\nRequired when using the Rootless Password Rotation workflow for static roles. Only enabled for\nselect DB engines (Postgres). Requires Vault 1.18+ Enterprise.\n**Deprecated**: Use \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e instead. This field will be removed in a future version.\n", "secret": true }, "skipImportRotation": { "type": "boolean", "description": "If set to true, Vault will skip the\ninitial secret rotation on import. Requires Vault 1.18+ Enterprise.\n" }, "username": { "type": "string", "description": "The database username that this static role corresponds to.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:database/secretsMount:SecretsMount": { "description": "Configure any number of database secrets engines under a single dedicated mount resource.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Caveats:\n\nThis resource will be replaced for any of the following conditions:\n\n- A database engine block is removed\n- The \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e for any configured database engine is changed\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst db = new vault.database.SecretsMount(\"db\", {\n path: \"db\",\n mssqls: [{\n name: \"db1\",\n username: \"sa\",\n password: \"super_secret_1\",\n connectionUrl: \"sqlserver://{{username}}:{{password}}@127.0.0.1:1433\",\n allowedRoles: [\"dev1\"],\n pluginVersion: \"v0.20.0\",\n skipStaticRoleImportRotation: true,\n passwordPolicy: \"default\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n }],\n postgresqls: [{\n name: \"db2\",\n username: \"postgres\",\n password: \"super_secret_2\",\n connectionUrl: \"postgresql://{{username}}:{{password}}@127.0.0.1:5432/postgres\",\n verifyConnection: true,\n allowedRoles: [\"dev2\"],\n pluginVersion: \"v0.19.0\",\n skipStaticRoleImportRotation: true,\n passwordPolicy: \"default\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n }],\n});\nconst dev1 = new vault.database.SecretBackendRole(\"dev1\", {\n name: \"dev1\",\n backend: db.path,\n dbName: db.mssqls.apply(mssqls =\u003e mssqls?.[0]?.name),\n creationStatements: [\n \"CREATE LOGIN [{{name}}] WITH PASSWORD = '{{password}}';\",\n \"CREATE USER [{{name}}] FOR LOGIN [{{name}}];\",\n \"GRANT SELECT ON SCHEMA::dbo TO [{{name}}];\",\n ],\n});\nconst dev2 = new vault.database.SecretBackendRole(\"dev2\", {\n name: \"dev2\",\n backend: db.path,\n dbName: db.postgresqls.apply(postgresqls =\u003e postgresqls?.[0]?.name),\n creationStatements: [\n \"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\",\n \"GRANT SELECT ON ALL TABLES IN SCHEMA public TO \\\"{{name}}\\\";\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndb = vault.database.SecretsMount(\"db\",\n path=\"db\",\n mssqls=[{\n \"name\": \"db1\",\n \"username\": \"sa\",\n \"password\": \"super_secret_1\",\n \"connection_url\": \"sqlserver://{{username}}:{{password}}@127.0.0.1:1433\",\n \"allowed_roles\": [\"dev1\"],\n \"plugin_version\": \"v0.20.0\",\n \"skip_static_role_import_rotation\": True,\n \"password_policy\": \"default\",\n \"rotation_schedule\": \"0 * * * SAT\",\n \"rotation_window\": 3600,\n }],\n postgresqls=[{\n \"name\": \"db2\",\n \"username\": \"postgres\",\n \"password\": \"super_secret_2\",\n \"connection_url\": \"postgresql://{{username}}:{{password}}@127.0.0.1:5432/postgres\",\n \"verify_connection\": True,\n \"allowed_roles\": [\"dev2\"],\n \"plugin_version\": \"v0.19.0\",\n \"skip_static_role_import_rotation\": True,\n \"password_policy\": \"default\",\n \"rotation_schedule\": \"0 * * * SAT\",\n \"rotation_window\": 3600,\n }])\ndev1 = vault.database.SecretBackendRole(\"dev1\",\n name=\"dev1\",\n backend=db.path,\n db_name=db.mssqls[0].name,\n creation_statements=[\n \"CREATE LOGIN [{{name}}] WITH PASSWORD = '{{password}}';\",\n \"CREATE USER [{{name}}] FOR LOGIN [{{name}}];\",\n \"GRANT SELECT ON SCHEMA::dbo TO [{{name}}];\",\n ])\ndev2 = vault.database.SecretBackendRole(\"dev2\",\n name=\"dev2\",\n backend=db.path,\n db_name=db.postgresqls[0].name,\n creation_statements=[\n \"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\",\n \"GRANT SELECT ON ALL TABLES IN SCHEMA public TO \\\"{{name}}\\\";\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var db = new Vault.Database.SecretsMount(\"db\", new()\n {\n Path = \"db\",\n Mssqls = new[]\n {\n new Vault.Database.Inputs.SecretsMountMssqlArgs\n {\n Name = \"db1\",\n Username = \"sa\",\n Password = \"super_secret_1\",\n ConnectionUrl = \"sqlserver://{{username}}:{{password}}@127.0.0.1:1433\",\n AllowedRoles = new[]\n {\n \"dev1\",\n },\n PluginVersion = \"v0.20.0\",\n SkipStaticRoleImportRotation = true,\n PasswordPolicy = \"default\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n },\n },\n Postgresqls = new[]\n {\n new Vault.Database.Inputs.SecretsMountPostgresqlArgs\n {\n Name = \"db2\",\n Username = \"postgres\",\n Password = \"super_secret_2\",\n ConnectionUrl = \"postgresql://{{username}}:{{password}}@127.0.0.1:5432/postgres\",\n VerifyConnection = true,\n AllowedRoles = new[]\n {\n \"dev2\",\n },\n PluginVersion = \"v0.19.0\",\n SkipStaticRoleImportRotation = true,\n PasswordPolicy = \"default\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n },\n },\n });\n\n var dev1 = new Vault.Database.SecretBackendRole(\"dev1\", new()\n {\n Name = \"dev1\",\n Backend = db.Path,\n DbName = db.Mssqls.Apply(mssqls =\u003e mssqls[0]?.Name),\n CreationStatements = new[]\n {\n \"CREATE LOGIN [{{name}}] WITH PASSWORD = '{{password}}';\",\n \"CREATE USER [{{name}}] FOR LOGIN [{{name}}];\",\n \"GRANT SELECT ON SCHEMA::dbo TO [{{name}}];\",\n },\n });\n\n var dev2 = new Vault.Database.SecretBackendRole(\"dev2\", new()\n {\n Name = \"dev2\",\n Backend = db.Path,\n DbName = db.Postgresqls.Apply(postgresqls =\u003e postgresqls[0]?.Name),\n CreationStatements = new[]\n {\n \"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\",\n \"GRANT SELECT ON ALL TABLES IN SCHEMA public TO \\\"{{name}}\\\";\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/database\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tdb, err := database.NewSecretsMount(ctx, \"db\", \u0026database.SecretsMountArgs{\n\t\t\tPath: pulumi.String(\"db\"),\n\t\t\tMssqls: database.SecretsMountMssqlArray{\n\t\t\t\t\u0026database.SecretsMountMssqlArgs{\n\t\t\t\t\tName: pulumi.String(\"db1\"),\n\t\t\t\t\tUsername: pulumi.String(\"sa\"),\n\t\t\t\t\tPassword: pulumi.String(\"super_secret_1\"),\n\t\t\t\t\tConnectionUrl: pulumi.String(\"sqlserver://{{username}}:{{password}}@127.0.0.1:1433\"),\n\t\t\t\t\tAllowedRoles: pulumi.StringArray{\n\t\t\t\t\t\tpulumi.String(\"dev1\"),\n\t\t\t\t\t},\n\t\t\t\t\tPluginVersion: pulumi.String(\"v0.20.0\"),\n\t\t\t\t\tSkipStaticRoleImportRotation: pulumi.Bool(true),\n\t\t\t\t\tPasswordPolicy: pulumi.String(\"default\"),\n\t\t\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t\t\t},\n\t\t\t},\n\t\t\tPostgresqls: database.SecretsMountPostgresqlArray{\n\t\t\t\t\u0026database.SecretsMountPostgresqlArgs{\n\t\t\t\t\tName: pulumi.String(\"db2\"),\n\t\t\t\t\tUsername: pulumi.String(\"postgres\"),\n\t\t\t\t\tPassword: pulumi.String(\"super_secret_2\"),\n\t\t\t\t\tConnectionUrl: pulumi.String(\"postgresql://{{username}}:{{password}}@127.0.0.1:5432/postgres\"),\n\t\t\t\t\tVerifyConnection: pulumi.Bool(true),\n\t\t\t\t\tAllowedRoles: pulumi.StringArray{\n\t\t\t\t\t\tpulumi.String(\"dev2\"),\n\t\t\t\t\t},\n\t\t\t\t\tPluginVersion: pulumi.String(\"v0.19.0\"),\n\t\t\t\t\tSkipStaticRoleImportRotation: pulumi.Bool(true),\n\t\t\t\t\tPasswordPolicy: pulumi.String(\"default\"),\n\t\t\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = database.NewSecretBackendRole(ctx, \"dev1\", \u0026database.SecretBackendRoleArgs{\n\t\t\tName: pulumi.String(\"dev1\"),\n\t\t\tBackend: db.Path,\n\t\t\tDbName: db.Mssqls.ApplyT(func(mssqls []database.SecretsMountMssql) (*string, error) {\n\t\t\t\treturn mssqls[0].Name, nil\n\t\t\t}).(pulumi.StringPtrOutput),\n\t\t\tCreationStatements: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"CREATE LOGIN [{{name}}] WITH PASSWORD = '{{password}}';\"),\n\t\t\t\tpulumi.String(\"CREATE USER [{{name}}] FOR LOGIN [{{name}}];\"),\n\t\t\t\tpulumi.String(\"GRANT SELECT ON SCHEMA::dbo TO [{{name}}];\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = database.NewSecretBackendRole(ctx, \"dev2\", \u0026database.SecretBackendRoleArgs{\n\t\t\tName: pulumi.String(\"dev2\"),\n\t\t\tBackend: db.Path,\n\t\t\tDbName: db.Postgresqls.ApplyT(func(postgresqls []database.SecretsMountPostgresql) (*string, error) {\n\t\t\t\treturn postgresqls[0].Name, nil\n\t\t\t}).(pulumi.StringPtrOutput),\n\t\t\tCreationStatements: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\"),\n\t\t\t\tpulumi.String(\"GRANT SELECT ON ALL TABLES IN SCHEMA public TO \\\"{{name}}\\\";\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_database_secretsmount\" \"db\" {\n path = \"db\"\n mssqls {\n name = \"db1\"\n username = \"sa\"\n password = \"super_secret_1\"\n connection_url = \"sqlserver://{{username}}:{{password}}@127.0.0.1:1433\"\n allowed_roles = [\"dev1\"]\n plugin_version = \"v0.20.0\"\n skip_static_role_import_rotation = true\n password_policy = \"default\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n }\n postgresqls {\n name = \"db2\"\n username = \"postgres\"\n password = \"super_secret_2\"\n connection_url = \"postgresql://{{username}}:{{password}}@127.0.0.1:5432/postgres\"\n verify_connection = true\n allowed_roles = [\"dev2\"]\n plugin_version = \"v0.19.0\"\n skip_static_role_import_rotation = true\n password_policy = \"default\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n }\n}\nresource \"vault_database_secretbackendrole\" \"dev1\" {\n name = \"dev1\"\n backend = vault_database_secretsmount.db.path\n db_name = vault_database_secretsmount.db.mssqls[0].name\n creation_statements = [\"CREATE LOGIN [{{name}}] WITH PASSWORD = '{{password}}';\", \"CREATE USER [{{name}}] FOR LOGIN [{{name}}];\", \"GRANT SELECT ON SCHEMA::dbo TO [{{name}}];\"]\n}\nresource \"vault_database_secretbackendrole\" \"dev2\" {\n name = \"dev2\"\n backend = vault_database_secretsmount.db.path\n db_name = vault_database_secretsmount.db.postgresqls[0].name\n creation_statements = [\"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\", \"GRANT SELECT ON ALL TABLES IN SCHEMA public TO \\\"{{name}}\\\";\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.database.SecretsMount;\nimport com.pulumi.vault.database.SecretsMountArgs;\nimport com.pulumi.vault.database.inputs.SecretsMountMssqlArgs;\nimport com.pulumi.vault.database.inputs.SecretsMountPostgresqlArgs;\nimport com.pulumi.vault.database.SecretBackendRole;\nimport com.pulumi.vault.database.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var db = new SecretsMount(\"db\", SecretsMountArgs.builder()\n .path(\"db\")\n .mssqls(SecretsMountMssqlArgs.builder()\n .name(\"db1\")\n .username(\"sa\")\n .password(\"super_secret_1\")\n .connectionUrl(\"sqlserver://{{username}}:{{password}}@127.0.0.1:1433\")\n .allowedRoles(\"dev1\")\n .pluginVersion(\"v0.20.0\")\n .skipStaticRoleImportRotation(true)\n .passwordPolicy(\"default\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build())\n .postgresqls(SecretsMountPostgresqlArgs.builder()\n .name(\"db2\")\n .username(\"postgres\")\n .password(\"super_secret_2\")\n .connectionUrl(\"postgresql://{{username}}:{{password}}@127.0.0.1:5432/postgres\")\n .verifyConnection(true)\n .allowedRoles(\"dev2\")\n .pluginVersion(\"v0.19.0\")\n .skipStaticRoleImportRotation(true)\n .passwordPolicy(\"default\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build())\n .build());\n\n var dev1 = new SecretBackendRole(\"dev1\", SecretBackendRoleArgs.builder()\n .name(\"dev1\")\n .backend(db.path())\n .dbName(db.mssqls().applyValue(_mssqls -\u003e _mssqls[0].name()))\n .creationStatements( \n \"CREATE LOGIN [{{name}}] WITH PASSWORD = '{{password}}';\",\n \"CREATE USER [{{name}}] FOR LOGIN [{{name}}];\",\n \"GRANT SELECT ON SCHEMA::dbo TO [{{name}}];\")\n .build());\n\n var dev2 = new SecretBackendRole(\"dev2\", SecretBackendRoleArgs.builder()\n .name(\"dev2\")\n .backend(db.path())\n .dbName(db.postgresqls().applyValue(_postgresqls -\u003e _postgresqls[0].name()))\n .creationStatements( \n \"CREATE ROLE \\\"{{name}}\\\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\",\n \"GRANT SELECT ON ALL TABLES IN SCHEMA public TO \\\"{{name}}\\\";\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n db:\n type: vault:database:SecretsMount\n properties:\n path: db\n mssqls:\n - name: db1\n username: sa\n password: super_secret_1\n connectionUrl: sqlserver://{{username}}:{{password}}@127.0.0.1:1433\n allowedRoles:\n - dev1\n pluginVersion: v0.20.0\n skipStaticRoleImportRotation: true\n passwordPolicy: default\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n postgresqls:\n - name: db2\n username: postgres\n password: super_secret_2\n connectionUrl: postgresql://{{username}}:{{password}}@127.0.0.1:5432/postgres\n verifyConnection: true\n allowedRoles:\n - dev2\n pluginVersion: v0.19.0\n skipStaticRoleImportRotation: true\n passwordPolicy: default\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n dev1:\n type: vault:database:SecretBackendRole\n properties:\n name: dev1\n backend: ${db.path}\n dbName: ${db.mssqls[0].name}\n creationStatements:\n - CREATE LOGIN [{{name}}] WITH PASSWORD = '{{password}}';\n - CREATE USER [{{name}}] FOR LOGIN [{{name}}];\n - GRANT SELECT ON SCHEMA::dbo TO [{{name}}];\n dev2:\n type: vault:database:SecretBackendRole\n properties:\n name: dev2\n backend: ${db.path}\n dbName: ${db.postgresqls[0].name}\n creationStatements:\n - CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';\n - GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported for all DBs that support username/password:\n\n* \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e - (Optional) The password for the user. Can be updated.\n **Note**: This property is write-only and will not be read from the API.\n\n## Import\n\nDatabase secret backend connections can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e e.g.\n\n```sh\n$ pulumi import vault:database/secretsMount:SecretsMount db db\n```\n\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "Set of managed key registry entry names that the mount in question is allowed to access\n\nThe following arguments are common to all database engines:\n" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.\n" }, "cassandras": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountCassandra:SecretsMountCassandra" }, "description": "A nested block containing configuration options for Cassandra connections. \n*See Configuration Options for more info*\n" }, "couchbases": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountCouchbase:SecretsMountCouchbase" }, "description": "A nested block containing configuration options for Couchbase connections. \n*See Configuration Options for more info*\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds\n" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount\n" }, "elasticsearches": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountElasticsearch:SecretsMountElasticsearch" }, "description": "A nested block containing configuration options for Elasticsearch connections. \n*See Configuration Options for more info*\n" }, "engineCount": { "type": "integer", "description": "The total number of database secrets engines configured.\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source\n" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "hanas": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountHana:SecretsMountHana" }, "description": "A nested block containing configuration options for SAP HanaDB connections. \n*See Configuration Options for more info*\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "influxdbs": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountInfluxdb:SecretsMountInfluxdb" }, "description": "A nested block containing configuration options for InfluxDB connections. \n*See Configuration Options for more info*\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enforce local mount in HA environment\n" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds\n" }, "mongodbatlas": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMongodbatla:SecretsMountMongodbatla" }, "description": "A nested block containing configuration options for MongoDB Atlas connections. \n*See Configuration Options for more info*\n" }, "mongodbs": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMongodb:SecretsMountMongodb" }, "description": "A nested block containing configuration options for MongoDB connections. \n*See Configuration Options for more info*\n" }, "mssqls": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMssql:SecretsMountMssql" }, "description": "A nested block containing configuration options for MSSQL connections. \n*See Configuration Options for more info*\n" }, "mysqlAuroras": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysqlAurora:SecretsMountMysqlAurora" }, "description": "A nested block containing configuration options for Aurora MySQL connections. \n*See Configuration Options for more info*\n" }, "mysqlLegacies": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysqlLegacy:SecretsMountMysqlLegacy" }, "description": "A nested block containing configuration options for legacy MySQL connections. \n*See Configuration Options for more info*\n" }, "mysqlRds": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysqlRd:SecretsMountMysqlRd" }, "description": "A nested block containing configuration options for RDS MySQL connections. \n*See Configuration Options for more info*\n" }, "mysqls": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysql:SecretsMountMysql" }, "description": "A nested block containing configuration options for MySQL connections. \n*See Configuration Options for more info*\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend\n" }, "oracles": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountOracle:SecretsMountOracle" }, "description": "A nested block containing configuration options for Oracle connections. \n*See Configuration Options for more info*\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "Where the secret backend will be mounted\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "postgresqls": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountPostgresql:SecretsMountPostgresql" }, "description": "A nested block containing configuration options for PostgreSQL connections. \n*See Configuration Options for more info*\n" }, "redis": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountRedi:SecretsMountRedi" }, "description": "A nested block containing configuration options for Redis connections. \n*See Configuration Options for more info*\n" }, "redisElasticaches": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountRedisElasticache:SecretsMountRedisElasticache" }, "description": "A nested block containing configuration options for Redis ElastiCache connections. \n*See Configuration Options for more info*\n" }, "redshifts": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountRedshift:SecretsMountRedshift" }, "description": "A nested block containing configuration options for AWS Redshift connections. \n*See Configuration Options for more info*\n" }, "sealWrap": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability\n" }, "snowflakes": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountSnowflake:SecretsMountSnowflake" }, "description": "A nested block containing configuration options for Snowflake connections. \n*See Configuration Options for more info*\n" } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "defaultLeaseTtlSeconds", "engineCount", "forceNoCache", "maxLeaseTtlSeconds", "path", "sealWrap" ], "inputProperties": { "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "Set of managed key registry entry names that the mount in question is allowed to access\n\nThe following arguments are common to all database engines:\n" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.\n" }, "cassandras": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountCassandra:SecretsMountCassandra" }, "description": "A nested block containing configuration options for Cassandra connections. \n*See Configuration Options for more info*\n" }, "couchbases": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountCouchbase:SecretsMountCouchbase" }, "description": "A nested block containing configuration options for Couchbase connections. \n*See Configuration Options for more info*\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds\n" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount\n" }, "elasticsearches": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountElasticsearch:SecretsMountElasticsearch" }, "description": "A nested block containing configuration options for Elasticsearch connections. \n*See Configuration Options for more info*\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source\n", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "hanas": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountHana:SecretsMountHana" }, "description": "A nested block containing configuration options for SAP HanaDB connections. \n*See Configuration Options for more info*\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "influxdbs": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountInfluxdb:SecretsMountInfluxdb" }, "description": "A nested block containing configuration options for InfluxDB connections. \n*See Configuration Options for more info*\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enforce local mount in HA environment\n", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds\n" }, "mongodbatlas": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMongodbatla:SecretsMountMongodbatla" }, "description": "A nested block containing configuration options for MongoDB Atlas connections. \n*See Configuration Options for more info*\n" }, "mongodbs": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMongodb:SecretsMountMongodb" }, "description": "A nested block containing configuration options for MongoDB connections. \n*See Configuration Options for more info*\n" }, "mssqls": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMssql:SecretsMountMssql" }, "description": "A nested block containing configuration options for MSSQL connections. \n*See Configuration Options for more info*\n" }, "mysqlAuroras": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysqlAurora:SecretsMountMysqlAurora" }, "description": "A nested block containing configuration options for Aurora MySQL connections. \n*See Configuration Options for more info*\n" }, "mysqlLegacies": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysqlLegacy:SecretsMountMysqlLegacy" }, "description": "A nested block containing configuration options for legacy MySQL connections. \n*See Configuration Options for more info*\n" }, "mysqlRds": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysqlRd:SecretsMountMysqlRd" }, "description": "A nested block containing configuration options for RDS MySQL connections. \n*See Configuration Options for more info*\n" }, "mysqls": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysql:SecretsMountMysql" }, "description": "A nested block containing configuration options for MySQL connections. \n*See Configuration Options for more info*\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend\n" }, "oracles": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountOracle:SecretsMountOracle" }, "description": "A nested block containing configuration options for Oracle connections. \n*See Configuration Options for more info*\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "Where the secret backend will be mounted\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "postgresqls": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountPostgresql:SecretsMountPostgresql" }, "description": "A nested block containing configuration options for PostgreSQL connections. \n*See Configuration Options for more info*\n" }, "redis": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountRedi:SecretsMountRedi" }, "description": "A nested block containing configuration options for Redis connections. \n*See Configuration Options for more info*\n" }, "redisElasticaches": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountRedisElasticache:SecretsMountRedisElasticache" }, "description": "A nested block containing configuration options for Redis ElastiCache connections. \n*See Configuration Options for more info*\n" }, "redshifts": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountRedshift:SecretsMountRedshift" }, "description": "A nested block containing configuration options for AWS Redshift connections. \n*See Configuration Options for more info*\n" }, "sealWrap": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability\n", "willReplaceOnChanges": true }, "snowflakes": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountSnowflake:SecretsMountSnowflake" }, "description": "A nested block containing configuration options for Snowflake connections. \n*See Configuration Options for more info*\n" } }, "requiredInputs": [ "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretsMount resources.\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "Set of managed key registry entry names that the mount in question is allowed to access\n\nThe following arguments are common to all database engines:\n" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.\n" }, "cassandras": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountCassandra:SecretsMountCassandra" }, "description": "A nested block containing configuration options for Cassandra connections. \n*See Configuration Options for more info*\n" }, "couchbases": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountCouchbase:SecretsMountCouchbase" }, "description": "A nested block containing configuration options for Couchbase connections. \n*See Configuration Options for more info*\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds\n" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount\n" }, "elasticsearches": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountElasticsearch:SecretsMountElasticsearch" }, "description": "A nested block containing configuration options for Elasticsearch connections. \n*See Configuration Options for more info*\n" }, "engineCount": { "type": "integer", "description": "The total number of database secrets engines configured.\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source\n", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "hanas": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountHana:SecretsMountHana" }, "description": "A nested block containing configuration options for SAP HanaDB connections. \n*See Configuration Options for more info*\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "influxdbs": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountInfluxdb:SecretsMountInfluxdb" }, "description": "A nested block containing configuration options for InfluxDB connections. \n*See Configuration Options for more info*\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enforce local mount in HA environment\n", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds\n" }, "mongodbatlas": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMongodbatla:SecretsMountMongodbatla" }, "description": "A nested block containing configuration options for MongoDB Atlas connections. \n*See Configuration Options for more info*\n" }, "mongodbs": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMongodb:SecretsMountMongodb" }, "description": "A nested block containing configuration options for MongoDB connections. \n*See Configuration Options for more info*\n" }, "mssqls": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMssql:SecretsMountMssql" }, "description": "A nested block containing configuration options for MSSQL connections. \n*See Configuration Options for more info*\n" }, "mysqlAuroras": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysqlAurora:SecretsMountMysqlAurora" }, "description": "A nested block containing configuration options for Aurora MySQL connections. \n*See Configuration Options for more info*\n" }, "mysqlLegacies": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysqlLegacy:SecretsMountMysqlLegacy" }, "description": "A nested block containing configuration options for legacy MySQL connections. \n*See Configuration Options for more info*\n" }, "mysqlRds": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysqlRd:SecretsMountMysqlRd" }, "description": "A nested block containing configuration options for RDS MySQL connections. \n*See Configuration Options for more info*\n" }, "mysqls": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountMysql:SecretsMountMysql" }, "description": "A nested block containing configuration options for MySQL connections. \n*See Configuration Options for more info*\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend\n" }, "oracles": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountOracle:SecretsMountOracle" }, "description": "A nested block containing configuration options for Oracle connections. \n*See Configuration Options for more info*\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "Where the secret backend will be mounted\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use for this connection.\n" }, "postgresqls": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountPostgresql:SecretsMountPostgresql" }, "description": "A nested block containing configuration options for PostgreSQL connections. \n*See Configuration Options for more info*\n" }, "redis": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountRedi:SecretsMountRedi" }, "description": "A nested block containing configuration options for Redis connections. \n*See Configuration Options for more info*\n" }, "redisElasticaches": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountRedisElasticache:SecretsMountRedisElasticache" }, "description": "A nested block containing configuration options for Redis ElastiCache connections. \n*See Configuration Options for more info*\n" }, "redshifts": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountRedshift:SecretsMountRedshift" }, "description": "A nested block containing configuration options for AWS Redshift connections. \n*See Configuration Options for more info*\n" }, "sealWrap": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability\n", "willReplaceOnChanges": true }, "snowflakes": { "type": "array", "items": { "$ref": "#/types/vault:database/SecretsMountSnowflake:SecretsMountSnowflake" }, "description": "A nested block containing configuration options for Snowflake connections. \n*See Configuration Options for more info*\n" } }, "type": "object" } }, "vault:gcp/authBackend:AuthBackend": { "description": "Provides a resource to configure the [GCP auth backend within Vault](https://www.vaultproject.io/docs/auth/gcp.html).\n\n## Example Usage\n\nYou can setup the GCP auth backend with Workload Identity Federation (WIF) for a secret-less configuration:\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcp = new vault.gcp.AuthBackend(\"gcp\", {\n identityTokenKey: \"example-key\",\n identityTokenTtl: 1800,\n identityTokenAudience: \"\u003cTOKEN_AUDIENCE\u003e\",\n serviceAccountEmail: \"\u003cSERVICE_ACCOUNT_EMAIL\u003e\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ngcp = vault.gcp.AuthBackend(\"gcp\",\n identity_token_key=\"example-key\",\n identity_token_ttl=1800,\n identity_token_audience=\"\u003cTOKEN_AUDIENCE\u003e\",\n service_account_email=\"\u003cSERVICE_ACCOUNT_EMAIL\u003e\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcp = new Vault.Gcp.AuthBackend(\"gcp\", new()\n {\n IdentityTokenKey = \"example-key\",\n IdentityTokenTtl = 1800,\n IdentityTokenAudience = \"\u003cTOKEN_AUDIENCE\u003e\",\n ServiceAccountEmail = \"\u003cSERVICE_ACCOUNT_EMAIL\u003e\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := gcp.NewAuthBackend(ctx, \"gcp\", \u0026gcp.AuthBackendArgs{\n\t\t\tIdentityTokenKey: pulumi.String(\"example-key\"),\n\t\t\tIdentityTokenTtl: pulumi.Int(1800),\n\t\t\tIdentityTokenAudience: pulumi.String(\"\u003cTOKEN_AUDIENCE\u003e\"),\n\t\t\tServiceAccountEmail: pulumi.String(\"\u003cSERVICE_ACCOUNT_EMAIL\u003e\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_authbackend\" \"gcp\" {\n identity_token_key = \"example-key\"\n identity_token_ttl = 1800\n identity_token_audience = \"\u003cTOKEN_AUDIENCE\u003e\"\n service_account_email = \"\u003cSERVICE_ACCOUNT_EMAIL\u003e\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.AuthBackend;\nimport com.pulumi.vault.gcp.AuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcp = new AuthBackend(\"gcp\", AuthBackendArgs.builder()\n .identityTokenKey(\"example-key\")\n .identityTokenTtl(1800)\n .identityTokenAudience(\"\u003cTOKEN_AUDIENCE\u003e\")\n .serviceAccountEmail(\"\u003cSERVICE_ACCOUNT_EMAIL\u003e\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcp:\n type: vault:gcp:AuthBackend\n properties:\n identityTokenKey: example-key\n identityTokenTtl: 1800\n identityTokenAudience: \u003cTOKEN_AUDIENCE\u003e\n serviceAccountEmail: \u003cSERVICE_ACCOUNT_EMAIL\u003e\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcp = new vault.gcp.AuthBackend(\"gcp\", {\n credentials: std.file({\n input: \"vault-gcp-credentials.json\",\n }).then(invoke =\u003e invoke.result),\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n customEndpoint: {\n api: \"www.googleapis.com\",\n iam: \"iam.googleapis.com\",\n crm: \"cloudresourcemanager.googleapis.com\",\n compute: \"compute.googleapis.com\",\n }[0],\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp = vault.gcp.AuthBackend(\"gcp\",\n credentials=std.file(input=\"vault-gcp-credentials.json\").result,\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600,\n custom_endpoint={\n \"api\": \"www.googleapis.com\",\n \"iam\": \"iam.googleapis.com\",\n \"crm\": \"cloudresourcemanager.googleapis.com\",\n \"compute\": \"compute.googleapis.com\",\n }[0])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcp = new Vault.Gcp.AuthBackend(\"gcp\", new()\n {\n Credentials = Std.File.Invoke(new()\n {\n Input = \"vault-gcp-credentials.json\",\n }).Apply(invoke =\u003e invoke.Result),\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n CustomEndpoint = \n {\n { \"api\", \"www.googleapis.com\" },\n { \"iam\", \"iam.googleapis.com\" },\n { \"crm\", \"cloudresourcemanager.googleapis.com\" },\n { \"compute\", \"compute.googleapis.com\" },\n }[0],\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"vault-gcp-credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewAuthBackend(ctx, \"gcp\", \u0026gcp.AuthBackendArgs{\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t\tCustomEndpoint: map[string]string{\n\t\t\t\t\"api\": \"www.googleapis.com\",\n\t\t\t\t\"iam\": \"iam.googleapis.com\",\n\t\t\t\t\"crm\": \"cloudresourcemanager.googleapis.com\",\n\t\t\t\t\"compute\": \"compute.googleapis.com\",\n\t\t\t}[0],\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_authbackend\" \"gcp\" {\n credentials = file(\"vault-gcp-credentials.json\")\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n custom_endpoint = {\n \"api\" = \"www.googleapis.com\"\n \"iam\" = \"iam.googleapis.com\"\n \"crm\" = \"cloudresourcemanager.googleapis.com\"\n \"compute\" = \"compute.googleapis.com\"\n }[0]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.AuthBackend;\nimport com.pulumi.vault.gcp.AuthBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcp = new AuthBackend(\"gcp\", AuthBackendArgs.builder()\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(\"vault-gcp-credentials.json\")\n .build()).result())\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .customEndpoint(com.pulumi.vault.gcp.inputs.AuthBackendCustomEndpointArgs.builder()\n .api(\"www.googleapis.com\")\n .iam(\"iam.googleapis.com\")\n .crm(\"cloudresourcemanager.googleapis.com\")\n .compute(\"compute.googleapis.com\")\n .build()[0])\n .build());\n\n }\n}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e - (Optional) A JSON string containing the contents of a GCP credentials file. Can be updated. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e.\n If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running.\n **Note**: This property is write-only and will not be read from the API.\n\n## Import\n\nGCP authentication backends can be imported using the backend name, e.g.\n\n```sh\n$ pulumi import vault:gcp/authBackend:AuthBackend gcp gcp\n```\n\n", "properties": { "accessor": { "type": "string", "description": "The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).\n" }, "clientEmail": { "type": "string", "description": "The clients email associated with the credentials\n" }, "clientId": { "type": "string", "description": "The Client ID of the credentials\n" }, "credentials": { "type": "string", "description": "A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e.\n", "secret": true }, "credentialsWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nJSON-encoded credentials to use to connect to GCP. This field is write-only and the value cannot be read back.", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "A version counter for write-only credentials. Incrementing this value will cause the provider to send the credentials to Vault. Required with \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e.\nFor more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" }, "customEndpoint": { "$ref": "#/types/vault:gcp/AuthBackendCustomEndpoint:AuthBackendCustomEndpoint", "description": "Specifies overrides to\n[service endpoints](https://cloud.google.com/apis/design/glossary#api_service_endpoint)\nused when making API requests. This allows specific requests made during authentication\nto target alternative service endpoints for use in [Private Google Access](https://cloud.google.com/vpc/docs/configure-private-google-access)\nenvironments. Requires Vault 1.11+.\n\nOverrides are set at the subdomain level using the following keys:\n" }, "description": { "type": "string", "description": "A description of the auth method.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "gceAlias": { "type": "string", "description": "Defines what alias needs to be used during login and refelects the same in token metadata and audit logs.\n" }, "gceMetadatas": { "type": "array", "items": { "type": "string" }, "description": "Controls which instance metadata fields from the GCE login are captured into Vault's token metadata or audit logs.\n" }, "iamAlias": { "type": "string", "description": "Defines what alias needs to be used during login and refelects the same in token metadata and audit logs.\n" }, "iamMetadatas": { "type": "array", "items": { "type": "string" }, "description": "Controls the metadata to include on the token returned by the login endpoint.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value for plugin identity\ntokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin identity\ntokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens. Defaults to\n1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).\nRequires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "The path to mount the auth method — this defaults to 'gcp'.\n" }, "privateKeyId": { "type": "string", "description": "The ID of the private key from the credentials\n" }, "projectId": { "type": "string", "description": "The GCP Project ID\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "serviceAccountEmail": { "type": "string", "description": "Service Account to impersonate for plugin workload identity federation.\nRequired with \u003cspan pulumi-lang-nodejs=\"`identityTokenAudience`\" pulumi-lang-dotnet=\"`IdentityTokenAudience`\" pulumi-lang-go=\"`identityTokenAudience`\" pulumi-lang-python=\"`identity_token_audience`\" pulumi-lang-yaml=\"`identityTokenAudience`\" pulumi-lang-java=\"`identityTokenAudience`\" pulumi-lang-hcl=\"`identity_token_audience`\"\u003e`identityTokenAudience`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "tune": { "$ref": "#/types/vault:gcp/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" } }, "required": [ "accessor", "clientEmail", "clientId", "gceAlias", "gceMetadatas", "iamAlias", "iamMetadatas", "privateKeyId", "projectId", "tune" ], "inputProperties": { "clientEmail": { "type": "string", "description": "The clients email associated with the credentials\n" }, "clientId": { "type": "string", "description": "The Client ID of the credentials\n" }, "credentials": { "type": "string", "description": "A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e.\n", "secret": true }, "credentialsWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nJSON-encoded credentials to use to connect to GCP. This field is write-only and the value cannot be read back.", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "A version counter for write-only credentials. Incrementing this value will cause the provider to send the credentials to Vault. Required with \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e.\nFor more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" }, "customEndpoint": { "$ref": "#/types/vault:gcp/AuthBackendCustomEndpoint:AuthBackendCustomEndpoint", "description": "Specifies overrides to\n[service endpoints](https://cloud.google.com/apis/design/glossary#api_service_endpoint)\nused when making API requests. This allows specific requests made during authentication\nto target alternative service endpoints for use in [Private Google Access](https://cloud.google.com/vpc/docs/configure-private-google-access)\nenvironments. Requires Vault 1.11+.\n\nOverrides are set at the subdomain level using the following keys:\n" }, "description": { "type": "string", "description": "A description of the auth method.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "gceAlias": { "type": "string", "description": "Defines what alias needs to be used during login and refelects the same in token metadata and audit logs.\n" }, "gceMetadatas": { "type": "array", "items": { "type": "string" }, "description": "Controls which instance metadata fields from the GCE login are captured into Vault's token metadata or audit logs.\n" }, "iamAlias": { "type": "string", "description": "Defines what alias needs to be used during login and refelects the same in token metadata and audit logs.\n" }, "iamMetadatas": { "type": "array", "items": { "type": "string" }, "description": "Controls the metadata to include on the token returned by the login endpoint.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value for plugin identity\ntokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin identity\ntokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens. Defaults to\n1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).\nRequires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path to mount the auth method — this defaults to 'gcp'.\n" }, "privateKeyId": { "type": "string", "description": "The ID of the private key from the credentials\n" }, "projectId": { "type": "string", "description": "The GCP Project ID\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "serviceAccountEmail": { "type": "string", "description": "Service Account to impersonate for plugin workload identity federation.\nRequired with \u003cspan pulumi-lang-nodejs=\"`identityTokenAudience`\" pulumi-lang-dotnet=\"`IdentityTokenAudience`\" pulumi-lang-go=\"`identityTokenAudience`\" pulumi-lang-python=\"`identity_token_audience`\" pulumi-lang-yaml=\"`identityTokenAudience`\" pulumi-lang-java=\"`identityTokenAudience`\" pulumi-lang-hcl=\"`identity_token_audience`\"\u003e`identityTokenAudience`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "tune": { "$ref": "#/types/vault:gcp/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).\n" }, "clientEmail": { "type": "string", "description": "The clients email associated with the credentials\n" }, "clientId": { "type": "string", "description": "The Client ID of the credentials\n" }, "credentials": { "type": "string", "description": "A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e.\n", "secret": true }, "credentialsWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nJSON-encoded credentials to use to connect to GCP. This field is write-only and the value cannot be read back.", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "A version counter for write-only credentials. Incrementing this value will cause the provider to send the credentials to Vault. Required with \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e.\nFor more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" }, "customEndpoint": { "$ref": "#/types/vault:gcp/AuthBackendCustomEndpoint:AuthBackendCustomEndpoint", "description": "Specifies overrides to\n[service endpoints](https://cloud.google.com/apis/design/glossary#api_service_endpoint)\nused when making API requests. This allows specific requests made during authentication\nto target alternative service endpoints for use in [Private Google Access](https://cloud.google.com/vpc/docs/configure-private-google-access)\nenvironments. Requires Vault 1.11+.\n\nOverrides are set at the subdomain level using the following keys:\n" }, "description": { "type": "string", "description": "A description of the auth method.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "gceAlias": { "type": "string", "description": "Defines what alias needs to be used during login and refelects the same in token metadata and audit logs.\n" }, "gceMetadatas": { "type": "array", "items": { "type": "string" }, "description": "Controls which instance metadata fields from the GCE login are captured into Vault's token metadata or audit logs.\n" }, "iamAlias": { "type": "string", "description": "Defines what alias needs to be used during login and refelects the same in token metadata and audit logs.\n" }, "iamMetadatas": { "type": "array", "items": { "type": "string" }, "description": "Controls the metadata to include on the token returned by the login endpoint.\n" }, "identityTokenAudience": { "type": "string", "description": "The audience claim value for plugin identity\ntokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin identity\ntokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens. Defaults to\n1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).\nRequires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path to mount the auth method — this defaults to 'gcp'.\n" }, "privateKeyId": { "type": "string", "description": "The ID of the private key from the credentials\n" }, "projectId": { "type": "string", "description": "The GCP Project ID\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "serviceAccountEmail": { "type": "string", "description": "Service Account to impersonate for plugin workload identity federation.\nRequired with \u003cspan pulumi-lang-nodejs=\"`identityTokenAudience`\" pulumi-lang-dotnet=\"`IdentityTokenAudience`\" pulumi-lang-go=\"`identityTokenAudience`\" pulumi-lang-python=\"`identity_token_audience`\" pulumi-lang-yaml=\"`identityTokenAudience`\" pulumi-lang-java=\"`identityTokenAudience`\" pulumi-lang-hcl=\"`identity_token_audience`\"\u003e`identityTokenAudience`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "tune": { "$ref": "#/types/vault:gcp/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" } }, "type": "object" } }, "vault:gcp/authBackendRole:AuthBackendRole": { "description": "Provides a resource to create a role in an [GCP auth backend within Vault](https://www.vaultproject.io/docs/auth/gcp.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcp = new vault.AuthBackend(\"gcp\", {\n path: \"gcp\",\n type: \"gcp\",\n});\nconst test = new vault.gcp.AuthBackendRole(\"test\", {\n backend: gcp.path,\n role: \"test\",\n type: \"iam\",\n boundServiceAccounts: [\"test\"],\n boundProjects: [\"test\"],\n tokenTtl: 300,\n tokenMaxTtl: 600,\n tokenPolicies: [\n \"policy_a\",\n \"policy_b\",\n ],\n addGroupAliases: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ngcp = vault.AuthBackend(\"gcp\",\n path=\"gcp\",\n type=\"gcp\")\ntest = vault.gcp.AuthBackendRole(\"test\",\n backend=gcp.path,\n role=\"test\",\n type=\"iam\",\n bound_service_accounts=[\"test\"],\n bound_projects=[\"test\"],\n token_ttl=300,\n token_max_ttl=600,\n token_policies=[\n \"policy_a\",\n \"policy_b\",\n ],\n add_group_aliases=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcp = new Vault.AuthBackend(\"gcp\", new()\n {\n Path = \"gcp\",\n Type = \"gcp\",\n });\n\n var test = new Vault.Gcp.AuthBackendRole(\"test\", new()\n {\n Backend = gcp.Path,\n Role = \"test\",\n Type = \"iam\",\n BoundServiceAccounts = new[]\n {\n \"test\",\n },\n BoundProjects = new[]\n {\n \"test\",\n },\n TokenTtl = 300,\n TokenMaxTtl = 600,\n TokenPolicies = new[]\n {\n \"policy_a\",\n \"policy_b\",\n },\n AddGroupAliases = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tgcp2, err := vault.NewAuthBackend(ctx, \"gcp\", \u0026vault.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"gcp\"),\n\t\t\tType: pulumi.String(\"gcp\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewAuthBackendRole(ctx, \"test\", \u0026gcp.AuthBackendRoleArgs{\n\t\t\tBackend: gcp2.Path,\n\t\t\tRole: pulumi.String(\"test\"),\n\t\t\tType: pulumi.String(\"iam\"),\n\t\t\tBoundServiceAccounts: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tBoundProjects: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tTokenTtl: pulumi.Int(300),\n\t\t\tTokenMaxTtl: pulumi.Int(600),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"policy_a\"),\n\t\t\t\tpulumi.String(\"policy_b\"),\n\t\t\t},\n\t\t\tAddGroupAliases: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"gcp\" {\n path = \"gcp\"\n type = \"gcp\"\n}\nresource \"vault_gcp_authbackendrole\" \"test\" {\n backend = vault_authbackend.gcp.path\n role = \"test\"\n type = \"iam\"\n bound_service_accounts = [\"test\"]\n bound_projects = [\"test\"]\n token_ttl = 300\n token_max_ttl = 600\n token_policies = [\"policy_a\", \"policy_b\"]\n add_group_aliases = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.gcp.AuthBackendRole;\nimport com.pulumi.vault.gcp.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcp = new AuthBackend(\"gcp\", AuthBackendArgs.builder()\n .path(\"gcp\")\n .type(\"gcp\")\n .build());\n\n var test = new AuthBackendRole(\"test\", AuthBackendRoleArgs.builder()\n .backend(gcp.path())\n .role(\"test\")\n .type(\"iam\")\n .boundServiceAccounts(\"test\")\n .boundProjects(\"test\")\n .tokenTtl(300)\n .tokenMaxTtl(600)\n .tokenPolicies( \n \"policy_a\",\n \"policy_b\")\n .addGroupAliases(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcp:\n type: vault:AuthBackend\n properties:\n path: gcp\n type: gcp\n test:\n type: vault:gcp:AuthBackendRole\n properties:\n backend: ${gcp.path}\n role: test\n type: iam\n boundServiceAccounts:\n - test\n boundProjects:\n - test\n tokenTtl: 300\n tokenMaxTtl: 600\n tokenPolicies:\n - policy_a\n - policy_b\n addGroupAliases: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nGCP authentication roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:gcp/authBackendRole:AuthBackendRole my_role auth/gcp/role/my_role\n```\n\n", "properties": { "addGroupAliases": { "type": "boolean" }, "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowGceInference": { "type": "boolean" }, "backend": { "type": "string", "description": "Path to the mounted GCP auth backend\n" }, "boundInstanceGroups": { "type": "array", "items": { "type": "string" } }, "boundLabels": { "type": "array", "items": { "type": "string" } }, "boundProjects": { "type": "array", "items": { "type": "string" }, "description": "An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.\n" }, "boundRegions": { "type": "array", "items": { "type": "string" } }, "boundServiceAccounts": { "type": "array", "items": { "type": "string" }, "description": "GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e)\n" }, "boundZones": { "type": "array", "items": { "type": "string" } }, "maxJwtExp": { "type": "string" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "role": { "type": "string", "description": "Name of the GCP role\n" }, "roleId": { "type": "string", "description": "The\u003cspan pulumi-lang-nodejs=\" roleId \" pulumi-lang-dotnet=\" RoleId \" pulumi-lang-go=\" roleId \" pulumi-lang-python=\" role_id \" pulumi-lang-yaml=\" roleId \" pulumi-lang-java=\" roleId \" pulumi-lang-hcl=\" role_id \"\u003e roleId \u003c/span\u003eis the stable, unique identifier for the role generated by vault.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "type": { "type": "string", "description": "Type of GCP authentication role (either \u003cspan pulumi-lang-nodejs=\"`gce`\" pulumi-lang-dotnet=\"`Gce`\" pulumi-lang-go=\"`gce`\" pulumi-lang-python=\"`gce`\" pulumi-lang-yaml=\"`gce`\" pulumi-lang-java=\"`gce`\" pulumi-lang-hcl=\"`gce`\"\u003e`gce`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e)\n" } }, "required": [ "addGroupAliases", "allowGceInference", "boundInstanceGroups", "boundLabels", "boundRegions", "boundServiceAccounts", "boundZones", "maxJwtExp", "role", "roleId", "type" ], "inputProperties": { "addGroupAliases": { "type": "boolean" }, "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowGceInference": { "type": "boolean" }, "backend": { "type": "string", "description": "Path to the mounted GCP auth backend\n", "willReplaceOnChanges": true }, "boundInstanceGroups": { "type": "array", "items": { "type": "string" } }, "boundLabels": { "type": "array", "items": { "type": "string" } }, "boundProjects": { "type": "array", "items": { "type": "string" }, "description": "An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.\n", "willReplaceOnChanges": true }, "boundRegions": { "type": "array", "items": { "type": "string" } }, "boundServiceAccounts": { "type": "array", "items": { "type": "string" }, "description": "GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e)\n" }, "boundZones": { "type": "array", "items": { "type": "string" } }, "maxJwtExp": { "type": "string" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "Name of the GCP role\n", "willReplaceOnChanges": true }, "roleId": { "type": "string", "description": "The\u003cspan pulumi-lang-nodejs=\" roleId \" pulumi-lang-dotnet=\" RoleId \" pulumi-lang-go=\" roleId \" pulumi-lang-python=\" role_id \" pulumi-lang-yaml=\" roleId \" pulumi-lang-java=\" roleId \" pulumi-lang-hcl=\" role_id \"\u003e roleId \u003c/span\u003eis the stable, unique identifier for the role generated by vault.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "type": { "type": "string", "description": "Type of GCP authentication role (either \u003cspan pulumi-lang-nodejs=\"`gce`\" pulumi-lang-dotnet=\"`Gce`\" pulumi-lang-go=\"`gce`\" pulumi-lang-python=\"`gce`\" pulumi-lang-yaml=\"`gce`\" pulumi-lang-java=\"`gce`\" pulumi-lang-hcl=\"`gce`\"\u003e`gce`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e)\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "role", "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRole resources.\n", "properties": { "addGroupAliases": { "type": "boolean" }, "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowGceInference": { "type": "boolean" }, "backend": { "type": "string", "description": "Path to the mounted GCP auth backend\n", "willReplaceOnChanges": true }, "boundInstanceGroups": { "type": "array", "items": { "type": "string" } }, "boundLabels": { "type": "array", "items": { "type": "string" } }, "boundProjects": { "type": "array", "items": { "type": "string" }, "description": "An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.\n", "willReplaceOnChanges": true }, "boundRegions": { "type": "array", "items": { "type": "string" } }, "boundServiceAccounts": { "type": "array", "items": { "type": "string" }, "description": "GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e)\n" }, "boundZones": { "type": "array", "items": { "type": "string" } }, "maxJwtExp": { "type": "string" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "Name of the GCP role\n", "willReplaceOnChanges": true }, "roleId": { "type": "string", "description": "The\u003cspan pulumi-lang-nodejs=\" roleId \" pulumi-lang-dotnet=\" RoleId \" pulumi-lang-go=\" roleId \" pulumi-lang-python=\" role_id \" pulumi-lang-yaml=\" roleId \" pulumi-lang-java=\" roleId \" pulumi-lang-hcl=\" role_id \"\u003e roleId \u003c/span\u003eis the stable, unique identifier for the role generated by vault.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "type": { "type": "string", "description": "Type of GCP authentication role (either \u003cspan pulumi-lang-nodejs=\"`gce`\" pulumi-lang-dotnet=\"`Gce`\" pulumi-lang-go=\"`gce`\" pulumi-lang-python=\"`gce`\" pulumi-lang-yaml=\"`gce`\" pulumi-lang-java=\"`gce`\" pulumi-lang-hcl=\"`gce`\"\u003e`gce`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`iam`\" pulumi-lang-dotnet=\"`Iam`\" pulumi-lang-go=\"`iam`\" pulumi-lang-python=\"`iam`\" pulumi-lang-yaml=\"`iam`\" pulumi-lang-java=\"`iam`\" pulumi-lang-hcl=\"`iam`\"\u003e`iam`\u003c/span\u003e)\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:gcp/kmsSecretBackend:KmsSecretBackend": { "description": "Creates and manages a GCP KMS secrets engine mount in Vault. This resource is **self-managing** —\nit creates the mount point and configures the GCP KMS backend in a single resource. No separate\n\u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource is required.\n\n\u003e **Important** This resource requires **Terraform 1.11+** for write-only attribute support.\nThe \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e field is write-only and will never be stored in Terraform state.\nSee the main provider documentation for more details.\n\n## Example Usage\n\n### Basic Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpkms = new vault.gcp.KmsSecretBackend(\"gcpkms\", {\n path: \"gcpkms\",\n credentialsWo: std.file({\n input: \"gcp-credentials.json\",\n }).then(invoke =\u003e invoke.result),\n credentialsWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcpkms = vault.gcp.KmsSecretBackend(\"gcpkms\",\n path=\"gcpkms\",\n credentials_wo=std.file(input=\"gcp-credentials.json\").result,\n credentials_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpkms = new Vault.Gcp.KmsSecretBackend(\"gcpkms\", new()\n {\n Path = \"gcpkms\",\n CredentialsWo = Std.File.Invoke(new()\n {\n Input = \"gcp-credentials.json\",\n }).Apply(invoke =\u003e invoke.Result),\n CredentialsWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"gcp-credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewKmsSecretBackend(ctx, \"gcpkms\", \u0026gcp.KmsSecretBackendArgs{\n\t\t\tPath: pulumi.String(\"gcpkms\"),\n\t\t\tCredentialsWo: pulumi.String(invokeFile.Result),\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackend\" \"gcpkms\" {\n path = \"gcpkms\"\n credentials_wo = file(\"gcp-credentials.json\")\n credentials_wo_version = 1\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackend;\nimport com.pulumi.vault.gcp.KmsSecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpkms = new KmsSecretBackend(\"gcpkms\", KmsSecretBackendArgs.builder()\n .path(\"gcpkms\")\n .credentialsWo(StdFunctions.file(FileArgs.builder()\n .input(\"gcp-credentials.json\")\n .build()).result())\n .credentialsWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpkms:\n type: vault:gcp:KmsSecretBackend\n properties:\n path: gcpkms\n credentialsWo:\n fn::invoke:\n function: std:file\n arguments:\n input: gcp-credentials.json\n return: result\n credentialsWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Custom Scopes\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpkms = new vault.gcp.KmsSecretBackend(\"gcpkms\", {\n path: \"gcpkms\",\n credentialsWo: std.file({\n input: \"gcp-credentials.json\",\n }).then(invoke =\u003e invoke.result),\n credentialsWoVersion: 1,\n scopes: [\n \"https://www.googleapis.com/auth/cloudkms\",\n \"https://www.googleapis.com/auth/cloud-platform\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcpkms = vault.gcp.KmsSecretBackend(\"gcpkms\",\n path=\"gcpkms\",\n credentials_wo=std.file(input=\"gcp-credentials.json\").result,\n credentials_wo_version=1,\n scopes=[\n \"https://www.googleapis.com/auth/cloudkms\",\n \"https://www.googleapis.com/auth/cloud-platform\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpkms = new Vault.Gcp.KmsSecretBackend(\"gcpkms\", new()\n {\n Path = \"gcpkms\",\n CredentialsWo = Std.File.Invoke(new()\n {\n Input = \"gcp-credentials.json\",\n }).Apply(invoke =\u003e invoke.Result),\n CredentialsWoVersion = 1,\n Scopes = new[]\n {\n \"https://www.googleapis.com/auth/cloudkms\",\n \"https://www.googleapis.com/auth/cloud-platform\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"gcp-credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewKmsSecretBackend(ctx, \"gcpkms\", \u0026gcp.KmsSecretBackendArgs{\n\t\t\tPath: pulumi.String(\"gcpkms\"),\n\t\t\tCredentialsWo: pulumi.String(invokeFile.Result),\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t\tScopes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://www.googleapis.com/auth/cloudkms\"),\n\t\t\t\tpulumi.String(\"https://www.googleapis.com/auth/cloud-platform\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackend\" \"gcpkms\" {\n path = \"gcpkms\"\n credentials_wo = file(\"gcp-credentials.json\")\n credentials_wo_version = 1\n scopes = [\"https://www.googleapis.com/auth/cloudkms\", \"https://www.googleapis.com/auth/cloud-platform\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackend;\nimport com.pulumi.vault.gcp.KmsSecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpkms = new KmsSecretBackend(\"gcpkms\", KmsSecretBackendArgs.builder()\n .path(\"gcpkms\")\n .credentialsWo(StdFunctions.file(FileArgs.builder()\n .input(\"gcp-credentials.json\")\n .build()).result())\n .credentialsWoVersion(1)\n .scopes( \n \"https://www.googleapis.com/auth/cloudkms\",\n \"https://www.googleapis.com/auth/cloud-platform\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpkms:\n type: vault:gcp:KmsSecretBackend\n properties:\n path: gcpkms\n credentialsWo:\n fn::invoke:\n function: std:file\n arguments:\n input: gcp-credentials.json\n return: result\n credentialsWoVersion: 1\n scopes:\n - https://www.googleapis.com/auth/cloudkms\n - https://www.googleapis.com/auth/cloud-platform\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Rotating Credentials\n\nTo rotate credentials, update \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e and increment \u003cspan pulumi-lang-nodejs=\"`credentialsWoVersion`\" pulumi-lang-dotnet=\"`CredentialsWoVersion`\" pulumi-lang-go=\"`credentialsWoVersion`\" pulumi-lang-python=\"`credentials_wo_version`\" pulumi-lang-yaml=\"`credentialsWoVersion`\" pulumi-lang-java=\"`credentialsWoVersion`\" pulumi-lang-hcl=\"`credentials_wo_version`\"\u003e`credentialsWoVersion`\u003c/span\u003e.\nThe version change signals to Terraform that the new credentials should be sent to Vault.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpkms = new vault.gcp.KmsSecretBackend(\"gcpkms\", {\n path: \"gcpkms\",\n credentialsWo: std.file({\n input: \"gcp-credentials-new.json\",\n }).then(invoke =\u003e invoke.result),\n credentialsWoVersion: 2,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcpkms = vault.gcp.KmsSecretBackend(\"gcpkms\",\n path=\"gcpkms\",\n credentials_wo=std.file(input=\"gcp-credentials-new.json\").result,\n credentials_wo_version=2)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpkms = new Vault.Gcp.KmsSecretBackend(\"gcpkms\", new()\n {\n Path = \"gcpkms\",\n CredentialsWo = Std.File.Invoke(new()\n {\n Input = \"gcp-credentials-new.json\",\n }).Apply(invoke =\u003e invoke.Result),\n CredentialsWoVersion = 2,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"gcp-credentials-new.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewKmsSecretBackend(ctx, \"gcpkms\", \u0026gcp.KmsSecretBackendArgs{\n\t\t\tPath: pulumi.String(\"gcpkms\"),\n\t\t\tCredentialsWo: pulumi.String(invokeFile.Result),\n\t\t\tCredentialsWoVersion: pulumi.Int(2),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackend\" \"gcpkms\" {\n path = \"gcpkms\"\n credentials_wo = file(\"gcp-credentials-new.json\")\n credentials_wo_version = 2\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackend;\nimport com.pulumi.vault.gcp.KmsSecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpkms = new KmsSecretBackend(\"gcpkms\", KmsSecretBackendArgs.builder()\n .path(\"gcpkms\")\n .credentialsWo(StdFunctions.file(FileArgs.builder()\n .input(\"gcp-credentials-new.json\")\n .build()).result())\n .credentialsWoVersion(2)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpkms:\n type: vault:gcp:KmsSecretBackend\n properties:\n path: gcpkms\n credentialsWo:\n fn::invoke:\n function: std:file\n arguments:\n input: gcp-credentials-new.json\n return: result\n credentialsWoVersion: 2\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Default Application Credentials\n\nLeave \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e empty to have Vault use\n[Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials)\n(e.g. a Workload Identity or instance metadata service account).\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpkms = new vault.gcp.KmsSecretBackend(\"gcpkms\", {\n path: \"gcpkms\",\n credentialsWo: \"\",\n credentialsWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ngcpkms = vault.gcp.KmsSecretBackend(\"gcpkms\",\n path=\"gcpkms\",\n credentials_wo=\"\",\n credentials_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpkms = new Vault.Gcp.KmsSecretBackend(\"gcpkms\", new()\n {\n Path = \"gcpkms\",\n CredentialsWo = \"\",\n CredentialsWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := gcp.NewKmsSecretBackend(ctx, \"gcpkms\", \u0026gcp.KmsSecretBackendArgs{\n\t\t\tPath: pulumi.String(\"gcpkms\"),\n\t\t\tCredentialsWo: pulumi.String(\"\"),\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackend\" \"gcpkms\" {\n path = \"gcpkms\"\n credentials_wo = \"\"\n credentials_wo_version = 1\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackend;\nimport com.pulumi.vault.gcp.KmsSecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpkms = new KmsSecretBackend(\"gcpkms\", KmsSecretBackendArgs.builder()\n .path(\"gcpkms\")\n .credentialsWo(\"\")\n .credentialsWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpkms:\n type: vault:gcp:KmsSecretBackend\n properties:\n path: gcpkms\n credentialsWo: \"\"\n credentialsWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e - (Optional) JSON-encoded GCP service account credentials. This value is write-only\n and will not be stored in Terraform state. Leave empty (`\"\"`) to use Default Application Credentials\n or instance metadata authentication. The credentials should have the\n `cloudkms.cryptoKeyVersions.useToEncrypt`, `cloudkms.cryptoKeyVersions.useToDecrypt`, and\n `cloudkms.cryptoKeys.get` permissions at minimum.\n **Note**: This property is write-only and will not be read from the API. Requires Terraform 1.11+.\n\n## Required GCP Permissions\n\nThe service account credentials provided must have the following IAM permissions:\n\n- `cloudkms.cryptoKeyVersions.useToEncrypt` - For encryption operations\n- `cloudkms.cryptoKeyVersions.useToDecrypt` - For decryption operations\n- `cloudkms.cryptoKeyVersions.useToSign` - For signing operations\n- `cloudkms.cryptoKeyVersions.get` - For reading key version information\n- `cloudkms.cryptoKeys.get` - For reading key information\n- `cloudkms.cryptoKeys.create` - For creating new keys (optional)\n\nThese permissions are typically granted through the `Cloud KMS CryptoKey Encrypter/Decrypter` and\n`Cloud KMS Viewer` IAM roles.\n\n## Import\n\nGCP KMS secret backends can be imported using the mount path, e.g.\n\n```sh\n$ pulumi import vault:gcp/kmsSecretBackend:KmsSecretBackend gcpkms gcpkms\n```\n\n\u003e **Note:** Import populates all mount-level attributes from Vault. The \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`credentialsWoVersion`\" pulumi-lang-dotnet=\"`CredentialsWoVersion`\" pulumi-lang-go=\"`credentialsWoVersion`\" pulumi-lang-python=\"`credentials_wo_version`\" pulumi-lang-yaml=\"`credentialsWoVersion`\" pulumi-lang-java=\"`credentialsWoVersion`\" pulumi-lang-hcl=\"`credentials_wo_version`\"\u003e`credentialsWoVersion`\u003c/span\u003e fields will not be populated as they are not returned by the Vault API.\nYou must supply these values in your configuration after import.\n\n", "properties": { "accessor": { "type": "string", "description": "The mount accessor assigned by Vault.\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the plugin to the request" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object" }, "credentialsWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nJSON-encoded GCP service account credentials. Write-only — never stored in Terraform state. Leave this blank (`\"\"`) to use Default Application Credentials or instance metadata authentication. Requires Terraform 1.11+.", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this\nvalue to trigger a credential rotation. Changing this value will cause the credentials to be re-sent\nto Vault during the next apply. Requires \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e to also be set. For more info see\nupdating write-only attributes.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of auth accessor IDs that can delegate authentication to this mount" }, "description": { "type": "string", "description": "Human-friendly description of the mount" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's\nconfigured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "Path where the GCP KMS secrets engine will be mounted.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "scopes": { "type": "array", "items": { "type": "string" }, "description": "Set of OAuth scopes to use for GCP API requests. Defaults to `[\"https://www.googleapis.com/auth/cloudkms\"]`.\nCommon scopes include:\n- `https://www.googleapis.com/auth/cloudkms` - Cloud KMS access\n- `https://www.googleapis.com/auth/cloud-platform` - Full cloud platform access\n\nThe following mount-level arguments are also supported (see \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e for details):\n\u003cspan pulumi-lang-nodejs=\"`description`\" pulumi-lang-dotnet=\"`Description`\" pulumi-lang-go=\"`description`\" pulumi-lang-python=\"`description`\" pulumi-lang-yaml=\"`description`\" pulumi-lang-java=\"`description`\" pulumi-lang-hcl=\"`description`\"\u003e`description`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`defaultLeaseTtlSeconds`\" pulumi-lang-dotnet=\"`DefaultLeaseTtlSeconds`\" pulumi-lang-go=\"`defaultLeaseTtlSeconds`\" pulumi-lang-python=\"`default_lease_ttl_seconds`\" pulumi-lang-yaml=\"`defaultLeaseTtlSeconds`\" pulumi-lang-java=\"`defaultLeaseTtlSeconds`\" pulumi-lang-hcl=\"`default_lease_ttl_seconds`\"\u003e`defaultLeaseTtlSeconds`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`maxLeaseTtlSeconds`\" pulumi-lang-dotnet=\"`MaxLeaseTtlSeconds`\" pulumi-lang-go=\"`maxLeaseTtlSeconds`\" pulumi-lang-python=\"`max_lease_ttl_seconds`\" pulumi-lang-yaml=\"`maxLeaseTtlSeconds`\" pulumi-lang-java=\"`maxLeaseTtlSeconds`\" pulumi-lang-hcl=\"`max_lease_ttl_seconds`\"\u003e`maxLeaseTtlSeconds`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`auditNonHmacRequestKeys`\" pulumi-lang-dotnet=\"`AuditNonHmacRequestKeys`\" pulumi-lang-go=\"`auditNonHmacRequestKeys`\" pulumi-lang-python=\"`audit_non_hmac_request_keys`\" pulumi-lang-yaml=\"`auditNonHmacRequestKeys`\" pulumi-lang-java=\"`auditNonHmacRequestKeys`\" pulumi-lang-hcl=\"`audit_non_hmac_request_keys`\"\u003e`auditNonHmacRequestKeys`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`auditNonHmacResponseKeys`\" pulumi-lang-dotnet=\"`AuditNonHmacResponseKeys`\" pulumi-lang-go=\"`auditNonHmacResponseKeys`\" pulumi-lang-python=\"`audit_non_hmac_response_keys`\" pulumi-lang-yaml=\"`auditNonHmacResponseKeys`\" pulumi-lang-java=\"`auditNonHmacResponseKeys`\" pulumi-lang-hcl=\"`audit_non_hmac_response_keys`\"\u003e`auditNonHmacResponseKeys`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`listingVisibility`\" pulumi-lang-dotnet=\"`ListingVisibility`\" pulumi-lang-go=\"`listingVisibility`\" pulumi-lang-python=\"`listing_visibility`\" pulumi-lang-yaml=\"`listingVisibility`\" pulumi-lang-java=\"`listingVisibility`\" pulumi-lang-hcl=\"`listing_visibility`\"\u003e`listingVisibility`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`passthroughRequestHeaders`\" pulumi-lang-dotnet=\"`PassthroughRequestHeaders`\" pulumi-lang-go=\"`passthroughRequestHeaders`\" pulumi-lang-python=\"`passthrough_request_headers`\" pulumi-lang-yaml=\"`passthroughRequestHeaders`\" pulumi-lang-java=\"`passthroughRequestHeaders`\" pulumi-lang-hcl=\"`passthrough_request_headers`\"\u003e`passthroughRequestHeaders`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`allowedResponseHeaders`\" pulumi-lang-dotnet=\"`AllowedResponseHeaders`\" pulumi-lang-go=\"`allowedResponseHeaders`\" pulumi-lang-python=\"`allowed_response_headers`\" pulumi-lang-yaml=\"`allowedResponseHeaders`\" pulumi-lang-java=\"`allowedResponseHeaders`\" pulumi-lang-hcl=\"`allowed_response_headers`\"\u003e`allowedResponseHeaders`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`allowedManagedKeys`\" pulumi-lang-dotnet=\"`AllowedManagedKeys`\" pulumi-lang-go=\"`allowedManagedKeys`\" pulumi-lang-python=\"`allowed_managed_keys`\" pulumi-lang-yaml=\"`allowedManagedKeys`\" pulumi-lang-java=\"`allowedManagedKeys`\" pulumi-lang-hcl=\"`allowed_managed_keys`\"\u003e`allowedManagedKeys`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`local`\" pulumi-lang-dotnet=\"`Local`\" pulumi-lang-go=\"`local`\" pulumi-lang-python=\"`local`\" pulumi-lang-yaml=\"`local`\" pulumi-lang-java=\"`local`\" pulumi-lang-hcl=\"`local`\"\u003e`local`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`sealWrap`\" pulumi-lang-dotnet=\"`SealWrap`\" pulumi-lang-go=\"`sealWrap`\" pulumi-lang-python=\"`seal_wrap`\" pulumi-lang-yaml=\"`sealWrap`\" pulumi-lang-java=\"`sealWrap`\" pulumi-lang-hcl=\"`seal_wrap`\"\u003e`sealWrap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`externalEntropyAccess`\" pulumi-lang-dotnet=\"`ExternalEntropyAccess`\" pulumi-lang-go=\"`externalEntropyAccess`\" pulumi-lang-python=\"`external_entropy_access`\" pulumi-lang-yaml=\"`externalEntropyAccess`\" pulumi-lang-java=\"`externalEntropyAccess`\" pulumi-lang-hcl=\"`external_entropy_access`\"\u003e`externalEntropyAccess`\u003c/span\u003e.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "type": { "type": "string", "description": "Type of the backend, such as 'gcpkms'" } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "credentialsWoVersion", "defaultLeaseTtlSeconds", "externalEntropyAccess", "forceNoCache", "local", "maxLeaseTtlSeconds", "path", "scopes", "sealWrap", "type" ], "inputProperties": { "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the plugin to the request" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object" }, "credentialsWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nJSON-encoded GCP service account credentials. Write-only — never stored in Terraform state. Leave this blank (`\"\"`) to use Default Application Credentials or instance metadata authentication. Requires Terraform 1.11+.", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this\nvalue to trigger a credential rotation. Changing this value will cause the credentials to be re-sent\nto Vault during the next apply. Requires \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e to also be set. For more info see\nupdating write-only attributes.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of auth accessor IDs that can delegate authentication to this mount" }, "description": { "type": "string", "description": "Human-friendly description of the mount" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's\nconfigured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "Path where the GCP KMS secrets engine will be mounted.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "scopes": { "type": "array", "items": { "type": "string" }, "description": "Set of OAuth scopes to use for GCP API requests. Defaults to `[\"https://www.googleapis.com/auth/cloudkms\"]`.\nCommon scopes include:\n- `https://www.googleapis.com/auth/cloudkms` - Cloud KMS access\n- `https://www.googleapis.com/auth/cloud-platform` - Full cloud platform access\n\nThe following mount-level arguments are also supported (see \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e for details):\n\u003cspan pulumi-lang-nodejs=\"`description`\" pulumi-lang-dotnet=\"`Description`\" pulumi-lang-go=\"`description`\" pulumi-lang-python=\"`description`\" pulumi-lang-yaml=\"`description`\" pulumi-lang-java=\"`description`\" pulumi-lang-hcl=\"`description`\"\u003e`description`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`defaultLeaseTtlSeconds`\" pulumi-lang-dotnet=\"`DefaultLeaseTtlSeconds`\" pulumi-lang-go=\"`defaultLeaseTtlSeconds`\" pulumi-lang-python=\"`default_lease_ttl_seconds`\" pulumi-lang-yaml=\"`defaultLeaseTtlSeconds`\" pulumi-lang-java=\"`defaultLeaseTtlSeconds`\" pulumi-lang-hcl=\"`default_lease_ttl_seconds`\"\u003e`defaultLeaseTtlSeconds`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`maxLeaseTtlSeconds`\" pulumi-lang-dotnet=\"`MaxLeaseTtlSeconds`\" pulumi-lang-go=\"`maxLeaseTtlSeconds`\" pulumi-lang-python=\"`max_lease_ttl_seconds`\" pulumi-lang-yaml=\"`maxLeaseTtlSeconds`\" pulumi-lang-java=\"`maxLeaseTtlSeconds`\" pulumi-lang-hcl=\"`max_lease_ttl_seconds`\"\u003e`maxLeaseTtlSeconds`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`auditNonHmacRequestKeys`\" pulumi-lang-dotnet=\"`AuditNonHmacRequestKeys`\" pulumi-lang-go=\"`auditNonHmacRequestKeys`\" pulumi-lang-python=\"`audit_non_hmac_request_keys`\" pulumi-lang-yaml=\"`auditNonHmacRequestKeys`\" pulumi-lang-java=\"`auditNonHmacRequestKeys`\" pulumi-lang-hcl=\"`audit_non_hmac_request_keys`\"\u003e`auditNonHmacRequestKeys`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`auditNonHmacResponseKeys`\" pulumi-lang-dotnet=\"`AuditNonHmacResponseKeys`\" pulumi-lang-go=\"`auditNonHmacResponseKeys`\" pulumi-lang-python=\"`audit_non_hmac_response_keys`\" pulumi-lang-yaml=\"`auditNonHmacResponseKeys`\" pulumi-lang-java=\"`auditNonHmacResponseKeys`\" pulumi-lang-hcl=\"`audit_non_hmac_response_keys`\"\u003e`auditNonHmacResponseKeys`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`listingVisibility`\" pulumi-lang-dotnet=\"`ListingVisibility`\" pulumi-lang-go=\"`listingVisibility`\" pulumi-lang-python=\"`listing_visibility`\" pulumi-lang-yaml=\"`listingVisibility`\" pulumi-lang-java=\"`listingVisibility`\" pulumi-lang-hcl=\"`listing_visibility`\"\u003e`listingVisibility`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`passthroughRequestHeaders`\" pulumi-lang-dotnet=\"`PassthroughRequestHeaders`\" pulumi-lang-go=\"`passthroughRequestHeaders`\" pulumi-lang-python=\"`passthrough_request_headers`\" pulumi-lang-yaml=\"`passthroughRequestHeaders`\" pulumi-lang-java=\"`passthroughRequestHeaders`\" pulumi-lang-hcl=\"`passthrough_request_headers`\"\u003e`passthroughRequestHeaders`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`allowedResponseHeaders`\" pulumi-lang-dotnet=\"`AllowedResponseHeaders`\" pulumi-lang-go=\"`allowedResponseHeaders`\" pulumi-lang-python=\"`allowed_response_headers`\" pulumi-lang-yaml=\"`allowedResponseHeaders`\" pulumi-lang-java=\"`allowedResponseHeaders`\" pulumi-lang-hcl=\"`allowed_response_headers`\"\u003e`allowedResponseHeaders`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`allowedManagedKeys`\" pulumi-lang-dotnet=\"`AllowedManagedKeys`\" pulumi-lang-go=\"`allowedManagedKeys`\" pulumi-lang-python=\"`allowed_managed_keys`\" pulumi-lang-yaml=\"`allowedManagedKeys`\" pulumi-lang-java=\"`allowedManagedKeys`\" pulumi-lang-hcl=\"`allowed_managed_keys`\"\u003e`allowedManagedKeys`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`local`\" pulumi-lang-dotnet=\"`Local`\" pulumi-lang-go=\"`local`\" pulumi-lang-python=\"`local`\" pulumi-lang-yaml=\"`local`\" pulumi-lang-java=\"`local`\" pulumi-lang-hcl=\"`local`\"\u003e`local`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`sealWrap`\" pulumi-lang-dotnet=\"`SealWrap`\" pulumi-lang-go=\"`sealWrap`\" pulumi-lang-python=\"`seal_wrap`\" pulumi-lang-yaml=\"`sealWrap`\" pulumi-lang-java=\"`sealWrap`\" pulumi-lang-hcl=\"`seal_wrap`\"\u003e`sealWrap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`externalEntropyAccess`\" pulumi-lang-dotnet=\"`ExternalEntropyAccess`\" pulumi-lang-go=\"`externalEntropyAccess`\" pulumi-lang-python=\"`external_entropy_access`\" pulumi-lang-yaml=\"`externalEntropyAccess`\" pulumi-lang-java=\"`externalEntropyAccess`\" pulumi-lang-hcl=\"`external_entropy_access`\"\u003e`externalEntropyAccess`\u003c/span\u003e.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" } }, "requiredInputs": [ "credentialsWoVersion", "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering KmsSecretBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "The mount accessor assigned by Vault.\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the plugin to the request" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object" }, "credentialsWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nJSON-encoded GCP service account credentials. Write-only — never stored in Terraform state. Leave this blank (`\"\"`) to use Default Application Credentials or instance metadata authentication. Requires Terraform 1.11+.", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this\nvalue to trigger a credential rotation. Changing this value will cause the credentials to be re-sent\nto Vault during the next apply. Requires \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e to also be set. For more info see\nupdating write-only attributes.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of auth accessor IDs that can delegate authentication to this mount" }, "description": { "type": "string", "description": "Human-friendly description of the mount" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's\nconfigured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "Path where the GCP KMS secrets engine will be mounted.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "scopes": { "type": "array", "items": { "type": "string" }, "description": "Set of OAuth scopes to use for GCP API requests. Defaults to `[\"https://www.googleapis.com/auth/cloudkms\"]`.\nCommon scopes include:\n- `https://www.googleapis.com/auth/cloudkms` - Cloud KMS access\n- `https://www.googleapis.com/auth/cloud-platform` - Full cloud platform access\n\nThe following mount-level arguments are also supported (see \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e for details):\n\u003cspan pulumi-lang-nodejs=\"`description`\" pulumi-lang-dotnet=\"`Description`\" pulumi-lang-go=\"`description`\" pulumi-lang-python=\"`description`\" pulumi-lang-yaml=\"`description`\" pulumi-lang-java=\"`description`\" pulumi-lang-hcl=\"`description`\"\u003e`description`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`defaultLeaseTtlSeconds`\" pulumi-lang-dotnet=\"`DefaultLeaseTtlSeconds`\" pulumi-lang-go=\"`defaultLeaseTtlSeconds`\" pulumi-lang-python=\"`default_lease_ttl_seconds`\" pulumi-lang-yaml=\"`defaultLeaseTtlSeconds`\" pulumi-lang-java=\"`defaultLeaseTtlSeconds`\" pulumi-lang-hcl=\"`default_lease_ttl_seconds`\"\u003e`defaultLeaseTtlSeconds`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`maxLeaseTtlSeconds`\" pulumi-lang-dotnet=\"`MaxLeaseTtlSeconds`\" pulumi-lang-go=\"`maxLeaseTtlSeconds`\" pulumi-lang-python=\"`max_lease_ttl_seconds`\" pulumi-lang-yaml=\"`maxLeaseTtlSeconds`\" pulumi-lang-java=\"`maxLeaseTtlSeconds`\" pulumi-lang-hcl=\"`max_lease_ttl_seconds`\"\u003e`maxLeaseTtlSeconds`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`auditNonHmacRequestKeys`\" pulumi-lang-dotnet=\"`AuditNonHmacRequestKeys`\" pulumi-lang-go=\"`auditNonHmacRequestKeys`\" pulumi-lang-python=\"`audit_non_hmac_request_keys`\" pulumi-lang-yaml=\"`auditNonHmacRequestKeys`\" pulumi-lang-java=\"`auditNonHmacRequestKeys`\" pulumi-lang-hcl=\"`audit_non_hmac_request_keys`\"\u003e`auditNonHmacRequestKeys`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`auditNonHmacResponseKeys`\" pulumi-lang-dotnet=\"`AuditNonHmacResponseKeys`\" pulumi-lang-go=\"`auditNonHmacResponseKeys`\" pulumi-lang-python=\"`audit_non_hmac_response_keys`\" pulumi-lang-yaml=\"`auditNonHmacResponseKeys`\" pulumi-lang-java=\"`auditNonHmacResponseKeys`\" pulumi-lang-hcl=\"`audit_non_hmac_response_keys`\"\u003e`auditNonHmacResponseKeys`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`listingVisibility`\" pulumi-lang-dotnet=\"`ListingVisibility`\" pulumi-lang-go=\"`listingVisibility`\" pulumi-lang-python=\"`listing_visibility`\" pulumi-lang-yaml=\"`listingVisibility`\" pulumi-lang-java=\"`listingVisibility`\" pulumi-lang-hcl=\"`listing_visibility`\"\u003e`listingVisibility`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`passthroughRequestHeaders`\" pulumi-lang-dotnet=\"`PassthroughRequestHeaders`\" pulumi-lang-go=\"`passthroughRequestHeaders`\" pulumi-lang-python=\"`passthrough_request_headers`\" pulumi-lang-yaml=\"`passthroughRequestHeaders`\" pulumi-lang-java=\"`passthroughRequestHeaders`\" pulumi-lang-hcl=\"`passthrough_request_headers`\"\u003e`passthroughRequestHeaders`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`allowedResponseHeaders`\" pulumi-lang-dotnet=\"`AllowedResponseHeaders`\" pulumi-lang-go=\"`allowedResponseHeaders`\" pulumi-lang-python=\"`allowed_response_headers`\" pulumi-lang-yaml=\"`allowedResponseHeaders`\" pulumi-lang-java=\"`allowedResponseHeaders`\" pulumi-lang-hcl=\"`allowed_response_headers`\"\u003e`allowedResponseHeaders`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`allowedManagedKeys`\" pulumi-lang-dotnet=\"`AllowedManagedKeys`\" pulumi-lang-go=\"`allowedManagedKeys`\" pulumi-lang-python=\"`allowed_managed_keys`\" pulumi-lang-yaml=\"`allowedManagedKeys`\" pulumi-lang-java=\"`allowedManagedKeys`\" pulumi-lang-hcl=\"`allowed_managed_keys`\"\u003e`allowedManagedKeys`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`local`\" pulumi-lang-dotnet=\"`Local`\" pulumi-lang-go=\"`local`\" pulumi-lang-python=\"`local`\" pulumi-lang-yaml=\"`local`\" pulumi-lang-java=\"`local`\" pulumi-lang-hcl=\"`local`\"\u003e`local`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`sealWrap`\" pulumi-lang-dotnet=\"`SealWrap`\" pulumi-lang-go=\"`sealWrap`\" pulumi-lang-python=\"`seal_wrap`\" pulumi-lang-yaml=\"`sealWrap`\" pulumi-lang-java=\"`sealWrap`\" pulumi-lang-hcl=\"`seal_wrap`\"\u003e`sealWrap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`externalEntropyAccess`\" pulumi-lang-dotnet=\"`ExternalEntropyAccess`\" pulumi-lang-go=\"`externalEntropyAccess`\" pulumi-lang-python=\"`external_entropy_access`\" pulumi-lang-yaml=\"`externalEntropyAccess`\" pulumi-lang-java=\"`externalEntropyAccess`\" pulumi-lang-hcl=\"`external_entropy_access`\"\u003e`externalEntropyAccess`\u003c/span\u003e.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "type": { "type": "string", "description": "Type of the backend, such as 'gcpkms'" } }, "type": "object" } }, "vault:gcp/kmsSecretBackendKey:KmsSecretBackendKey": { "description": "Manages keys in the GCP KMS secrets engine. This resource creates or registers GCP KMS crypto keys\nwithin a Vault-managed key ring, making them available for cryptographic operations (encryption,\ndecryption, signing, verification) through Vault.\n\n\u003e **Important** All data provided in the resource configuration will be written in cleartext to\nstate and plan files generated by Terraform, and will appear in the console output when Terraform\nruns. Protect these artifacts accordingly. See\nthe main provider documentation for more details.\n\n## Example Usage\n\n### Symmetric Encryption Key\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpkms = new vault.gcp.KmsSecretBackend(\"gcpkms\", {\n path: \"gcpkms\",\n credentialsWo: std.file({\n input: \"gcp-credentials.json\",\n }).then(invoke =\u003e invoke.result),\n credentialsWoVersion: 1,\n});\nconst encryption = new vault.gcp.KmsSecretBackendKey(\"encryption\", {\n mount: gcpkms.path,\n keyName: \"my-encryption-key\",\n keyRing: \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n purpose: \"encrypt_decrypt\",\n algorithm: \"symmetric_encryption\",\n protectionLevel: \"software\",\n rotationPeriod: \"2592000s\",\n labels: {\n env: \"production\",\n managed_by: \"terraform\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcpkms = vault.gcp.KmsSecretBackend(\"gcpkms\",\n path=\"gcpkms\",\n credentials_wo=std.file(input=\"gcp-credentials.json\").result,\n credentials_wo_version=1)\nencryption = vault.gcp.KmsSecretBackendKey(\"encryption\",\n mount=gcpkms.path,\n key_name=\"my-encryption-key\",\n key_ring=\"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n purpose=\"encrypt_decrypt\",\n algorithm=\"symmetric_encryption\",\n protection_level=\"software\",\n rotation_period=\"2592000s\",\n labels={\n \"env\": \"production\",\n \"managed_by\": \"terraform\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpkms = new Vault.Gcp.KmsSecretBackend(\"gcpkms\", new()\n {\n Path = \"gcpkms\",\n CredentialsWo = Std.File.Invoke(new()\n {\n Input = \"gcp-credentials.json\",\n }).Apply(invoke =\u003e invoke.Result),\n CredentialsWoVersion = 1,\n });\n\n var encryption = new Vault.Gcp.KmsSecretBackendKey(\"encryption\", new()\n {\n Mount = gcpkms.Path,\n KeyName = \"my-encryption-key\",\n KeyRing = \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n Purpose = \"encrypt_decrypt\",\n Algorithm = \"symmetric_encryption\",\n ProtectionLevel = \"software\",\n RotationPeriod = \"2592000s\",\n Labels = \n {\n { \"env\", \"production\" },\n { \"managed_by\", \"terraform\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"gcp-credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tgcpkms, err := gcp.NewKmsSecretBackend(ctx, \"gcpkms\", \u0026gcp.KmsSecretBackendArgs{\n\t\t\tPath: pulumi.String(\"gcpkms\"),\n\t\t\tCredentialsWo: pulumi.String(invokeFile.Result),\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewKmsSecretBackendKey(ctx, \"encryption\", \u0026gcp.KmsSecretBackendKeyArgs{\n\t\t\tMount: gcpkms.Path,\n\t\t\tKeyName: pulumi.String(\"my-encryption-key\"),\n\t\t\tKeyRing: pulumi.String(\"projects/my-project/locations/us-central1/keyRings/my-keyring\"),\n\t\t\tPurpose: pulumi.String(\"encrypt_decrypt\"),\n\t\t\tAlgorithm: pulumi.String(\"symmetric_encryption\"),\n\t\t\tProtectionLevel: pulumi.String(\"software\"),\n\t\t\tRotationPeriod: pulumi.String(\"2592000s\"),\n\t\t\tLabels: pulumi.StringMap{\n\t\t\t\t\"env\": pulumi.String(\"production\"),\n\t\t\t\t\"managed_by\": pulumi.String(\"terraform\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackend\" \"gcpkms\" {\n path = \"gcpkms\"\n credentials_wo = file(\"gcp-credentials.json\")\n credentials_wo_version = 1\n}\nresource \"vault_gcp_kmssecretbackendkey\" \"encryption\" {\n mount = vault_gcp_kmssecretbackend.gcpkms.path\n key_name = \"my-encryption-key\"\n key_ring = \"projects/my-project/locations/us-central1/keyRings/my-keyring\"\n purpose = \"encrypt_decrypt\"\n algorithm = \"symmetric_encryption\"\n protection_level = \"software\"\n rotation_period = \"2592000s\"\n labels = {\n \"env\" = \"production\"\n \"managed_by\" = \"terraform\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackend;\nimport com.pulumi.vault.gcp.KmsSecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.vault.gcp.KmsSecretBackendKey;\nimport com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpkms = new KmsSecretBackend(\"gcpkms\", KmsSecretBackendArgs.builder()\n .path(\"gcpkms\")\n .credentialsWo(StdFunctions.file(FileArgs.builder()\n .input(\"gcp-credentials.json\")\n .build()).result())\n .credentialsWoVersion(1)\n .build());\n\n var encryption = new KmsSecretBackendKey(\"encryption\", KmsSecretBackendKeyArgs.builder()\n .mount(gcpkms.path())\n .keyName(\"my-encryption-key\")\n .keyRing(\"projects/my-project/locations/us-central1/keyRings/my-keyring\")\n .purpose(\"encrypt_decrypt\")\n .algorithm(\"symmetric_encryption\")\n .protectionLevel(\"software\")\n .rotationPeriod(\"2592000s\")\n .labels(Map.ofEntries(\n Map.entry(\"env\", \"production\"),\n Map.entry(\"managed_by\", \"terraform\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpkms:\n type: vault:gcp:KmsSecretBackend\n properties:\n path: gcpkms\n credentialsWo:\n fn::invoke:\n function: std:file\n arguments:\n input: gcp-credentials.json\n return: result\n credentialsWoVersion: 1\n encryption:\n type: vault:gcp:KmsSecretBackendKey\n properties:\n mount: ${gcpkms.path}\n keyName: my-encryption-key\n keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring\n purpose: encrypt_decrypt\n algorithm: symmetric_encryption\n protectionLevel: software\n rotationPeriod: 2592000s\n labels:\n env: production\n managed_by: terraform\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Asymmetric Signing Key\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst signing = new vault.gcp.KmsSecretBackendKey(\"signing\", {\n mount: gcpkms.path,\n keyName: \"my-signing-key\",\n keyRing: \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n purpose: \"asymmetric_sign\",\n algorithm: \"rsa_sign_pss_2048_sha256\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nsigning = vault.gcp.KmsSecretBackendKey(\"signing\",\n mount=gcpkms[\"path\"],\n key_name=\"my-signing-key\",\n key_ring=\"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n purpose=\"asymmetric_sign\",\n algorithm=\"rsa_sign_pss_2048_sha256\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var signing = new Vault.Gcp.KmsSecretBackendKey(\"signing\", new()\n {\n Mount = gcpkms.Path,\n KeyName = \"my-signing-key\",\n KeyRing = \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n Purpose = \"asymmetric_sign\",\n Algorithm = \"rsa_sign_pss_2048_sha256\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := gcp.NewKmsSecretBackendKey(ctx, \"signing\", \u0026gcp.KmsSecretBackendKeyArgs{\n\t\t\tMount: pulumi.Any(gcpkms.Path),\n\t\t\tKeyName: pulumi.String(\"my-signing-key\"),\n\t\t\tKeyRing: pulumi.String(\"projects/my-project/locations/us-central1/keyRings/my-keyring\"),\n\t\t\tPurpose: pulumi.String(\"asymmetric_sign\"),\n\t\t\tAlgorithm: pulumi.String(\"rsa_sign_pss_2048_sha256\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackendkey\" \"signing\" {\n mount = gcpkms.path\n key_name = \"my-signing-key\"\n key_ring = \"projects/my-project/locations/us-central1/keyRings/my-keyring\"\n purpose = \"asymmetric_sign\"\n algorithm = \"rsa_sign_pss_2048_sha256\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackendKey;\nimport com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var signing = new KmsSecretBackendKey(\"signing\", KmsSecretBackendKeyArgs.builder()\n .mount(gcpkms.path())\n .keyName(\"my-signing-key\")\n .keyRing(\"projects/my-project/locations/us-central1/keyRings/my-keyring\")\n .purpose(\"asymmetric_sign\")\n .algorithm(\"rsa_sign_pss_2048_sha256\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n signing:\n type: vault:gcp:KmsSecretBackendKey\n properties:\n mount: ${gcpkms.path}\n keyName: my-signing-key\n keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring\n purpose: asymmetric_sign\n algorithm: rsa_sign_pss_2048_sha256\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Asymmetric Decryption Key\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst decrypt = new vault.gcp.KmsSecretBackendKey(\"decrypt\", {\n mount: gcpkms.path,\n keyName: \"my-decrypt-key\",\n keyRing: \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n purpose: \"asymmetric_decrypt\",\n algorithm: \"rsa_decrypt_oaep_2048_sha256\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndecrypt = vault.gcp.KmsSecretBackendKey(\"decrypt\",\n mount=gcpkms[\"path\"],\n key_name=\"my-decrypt-key\",\n key_ring=\"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n purpose=\"asymmetric_decrypt\",\n algorithm=\"rsa_decrypt_oaep_2048_sha256\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var decrypt = new Vault.Gcp.KmsSecretBackendKey(\"decrypt\", new()\n {\n Mount = gcpkms.Path,\n KeyName = \"my-decrypt-key\",\n KeyRing = \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n Purpose = \"asymmetric_decrypt\",\n Algorithm = \"rsa_decrypt_oaep_2048_sha256\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := gcp.NewKmsSecretBackendKey(ctx, \"decrypt\", \u0026gcp.KmsSecretBackendKeyArgs{\n\t\t\tMount: pulumi.Any(gcpkms.Path),\n\t\t\tKeyName: pulumi.String(\"my-decrypt-key\"),\n\t\t\tKeyRing: pulumi.String(\"projects/my-project/locations/us-central1/keyRings/my-keyring\"),\n\t\t\tPurpose: pulumi.String(\"asymmetric_decrypt\"),\n\t\t\tAlgorithm: pulumi.String(\"rsa_decrypt_oaep_2048_sha256\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackendkey\" \"decrypt\" {\n mount = gcpkms.path\n key_name = \"my-decrypt-key\"\n key_ring = \"projects/my-project/locations/us-central1/keyRings/my-keyring\"\n purpose = \"asymmetric_decrypt\"\n algorithm = \"rsa_decrypt_oaep_2048_sha256\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackendKey;\nimport com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var decrypt = new KmsSecretBackendKey(\"decrypt\", KmsSecretBackendKeyArgs.builder()\n .mount(gcpkms.path())\n .keyName(\"my-decrypt-key\")\n .keyRing(\"projects/my-project/locations/us-central1/keyRings/my-keyring\")\n .purpose(\"asymmetric_decrypt\")\n .algorithm(\"rsa_decrypt_oaep_2048_sha256\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n decrypt:\n type: vault:gcp:KmsSecretBackendKey\n properties:\n mount: ${gcpkms.path}\n keyName: my-decrypt-key\n keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring\n purpose: asymmetric_decrypt\n algorithm: rsa_decrypt_oaep_2048_sha256\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### HSM-Protected Key\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst hsm = new vault.gcp.KmsSecretBackendKey(\"hsm\", {\n mount: gcpkms.path,\n keyName: \"hsm-key\",\n keyRing: \"projects/my-project/locations/us-central1/keyRings/hsm-keyring\",\n purpose: \"encrypt_decrypt\",\n algorithm: \"symmetric_encryption\",\n protectionLevel: \"hsm\",\n rotationPeriod: \"7776000s\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nhsm = vault.gcp.KmsSecretBackendKey(\"hsm\",\n mount=gcpkms[\"path\"],\n key_name=\"hsm-key\",\n key_ring=\"projects/my-project/locations/us-central1/keyRings/hsm-keyring\",\n purpose=\"encrypt_decrypt\",\n algorithm=\"symmetric_encryption\",\n protection_level=\"hsm\",\n rotation_period=\"7776000s\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var hsm = new Vault.Gcp.KmsSecretBackendKey(\"hsm\", new()\n {\n Mount = gcpkms.Path,\n KeyName = \"hsm-key\",\n KeyRing = \"projects/my-project/locations/us-central1/keyRings/hsm-keyring\",\n Purpose = \"encrypt_decrypt\",\n Algorithm = \"symmetric_encryption\",\n ProtectionLevel = \"hsm\",\n RotationPeriod = \"7776000s\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := gcp.NewKmsSecretBackendKey(ctx, \"hsm\", \u0026gcp.KmsSecretBackendKeyArgs{\n\t\t\tMount: pulumi.Any(gcpkms.Path),\n\t\t\tKeyName: pulumi.String(\"hsm-key\"),\n\t\t\tKeyRing: pulumi.String(\"projects/my-project/locations/us-central1/keyRings/hsm-keyring\"),\n\t\t\tPurpose: pulumi.String(\"encrypt_decrypt\"),\n\t\t\tAlgorithm: pulumi.String(\"symmetric_encryption\"),\n\t\t\tProtectionLevel: pulumi.String(\"hsm\"),\n\t\t\tRotationPeriod: pulumi.String(\"7776000s\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackendkey\" \"hsm\" {\n mount = gcpkms.path\n key_name = \"hsm-key\"\n key_ring = \"projects/my-project/locations/us-central1/keyRings/hsm-keyring\"\n purpose = \"encrypt_decrypt\"\n algorithm = \"symmetric_encryption\"\n protection_level = \"hsm\"\n rotation_period = \"7776000s\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackendKey;\nimport com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var hsm = new KmsSecretBackendKey(\"hsm\", KmsSecretBackendKeyArgs.builder()\n .mount(gcpkms.path())\n .keyName(\"hsm-key\")\n .keyRing(\"projects/my-project/locations/us-central1/keyRings/hsm-keyring\")\n .purpose(\"encrypt_decrypt\")\n .algorithm(\"symmetric_encryption\")\n .protectionLevel(\"hsm\")\n .rotationPeriod(\"7776000s\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n hsm:\n type: vault:gcp:KmsSecretBackendKey\n properties:\n mount: ${gcpkms.path}\n keyName: hsm-key\n keyRing: projects/my-project/locations/us-central1/keyRings/hsm-keyring\n purpose: encrypt_decrypt\n algorithm: symmetric_encryption\n protectionLevel: hsm\n rotationPeriod: 7776000s\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Custom GCP Crypto Key Name\n\nBy default, the GCP KMS crypto key uses the same name as the Vault key. Override it with \u003cspan pulumi-lang-nodejs=\"`cryptoKey`\" pulumi-lang-dotnet=\"`CryptoKey`\" pulumi-lang-go=\"`cryptoKey`\" pulumi-lang-python=\"`crypto_key`\" pulumi-lang-yaml=\"`cryptoKey`\" pulumi-lang-java=\"`cryptoKey`\" pulumi-lang-hcl=\"`crypto_key`\"\u003e`cryptoKey`\u003c/span\u003e:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst custom = new vault.gcp.KmsSecretBackendKey(\"custom\", {\n mount: gcpkms.path,\n keyName: \"vault-key-name\",\n keyRing: \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n cryptoKey: \"different-gcp-key-name\",\n purpose: \"encrypt_decrypt\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ncustom = vault.gcp.KmsSecretBackendKey(\"custom\",\n mount=gcpkms[\"path\"],\n key_name=\"vault-key-name\",\n key_ring=\"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n crypto_key=\"different-gcp-key-name\",\n purpose=\"encrypt_decrypt\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var custom = new Vault.Gcp.KmsSecretBackendKey(\"custom\", new()\n {\n Mount = gcpkms.Path,\n KeyName = \"vault-key-name\",\n KeyRing = \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n CryptoKey = \"different-gcp-key-name\",\n Purpose = \"encrypt_decrypt\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := gcp.NewKmsSecretBackendKey(ctx, \"custom\", \u0026gcp.KmsSecretBackendKeyArgs{\n\t\t\tMount: pulumi.Any(gcpkms.Path),\n\t\t\tKeyName: pulumi.String(\"vault-key-name\"),\n\t\t\tKeyRing: pulumi.String(\"projects/my-project/locations/us-central1/keyRings/my-keyring\"),\n\t\t\tCryptoKey: pulumi.String(\"different-gcp-key-name\"),\n\t\t\tPurpose: pulumi.String(\"encrypt_decrypt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackendkey\" \"custom\" {\n mount = gcpkms.path\n key_name = \"vault-key-name\"\n key_ring = \"projects/my-project/locations/us-central1/keyRings/my-keyring\"\n crypto_key = \"different-gcp-key-name\"\n purpose = \"encrypt_decrypt\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackendKey;\nimport com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var custom = new KmsSecretBackendKey(\"custom\", KmsSecretBackendKeyArgs.builder()\n .mount(gcpkms.path())\n .keyName(\"vault-key-name\")\n .keyRing(\"projects/my-project/locations/us-central1/keyRings/my-keyring\")\n .cryptoKey(\"different-gcp-key-name\")\n .purpose(\"encrypt_decrypt\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n custom:\n type: vault:gcp:KmsSecretBackendKey\n properties:\n mount: ${gcpkms.path}\n keyName: vault-key-name\n keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring\n cryptoKey: different-gcp-key-name\n purpose: encrypt_decrypt\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Updating Rotation Period\n\nOnly \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`labels`\" pulumi-lang-dotnet=\"`Labels`\" pulumi-lang-go=\"`labels`\" pulumi-lang-python=\"`labels`\" pulumi-lang-yaml=\"`labels`\" pulumi-lang-java=\"`labels`\" pulumi-lang-hcl=\"`labels`\"\u003e`labels`\u003c/span\u003e can be updated in-place. All other fields require resource replacement.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst updatable = new vault.gcp.KmsSecretBackendKey(\"updatable\", {\n mount: gcpkms.path,\n keyName: \"my-key\",\n keyRing: \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n rotationPeriod: \"72h\",\n labels: {\n version: \"v2\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nupdatable = vault.gcp.KmsSecretBackendKey(\"updatable\",\n mount=gcpkms[\"path\"],\n key_name=\"my-key\",\n key_ring=\"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n rotation_period=\"72h\",\n labels={\n \"version\": \"v2\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var updatable = new Vault.Gcp.KmsSecretBackendKey(\"updatable\", new()\n {\n Mount = gcpkms.Path,\n KeyName = \"my-key\",\n KeyRing = \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n RotationPeriod = \"72h\",\n Labels = \n {\n { \"version\", \"v2\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := gcp.NewKmsSecretBackendKey(ctx, \"updatable\", \u0026gcp.KmsSecretBackendKeyArgs{\n\t\t\tMount: pulumi.Any(gcpkms.Path),\n\t\t\tKeyName: pulumi.String(\"my-key\"),\n\t\t\tKeyRing: pulumi.String(\"projects/my-project/locations/us-central1/keyRings/my-keyring\"),\n\t\t\tRotationPeriod: pulumi.String(\"72h\"),\n\t\t\tLabels: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"v2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_kmssecretbackendkey\" \"updatable\" {\n mount = gcpkms.path\n key_name = \"my-key\"\n key_ring = \"projects/my-project/locations/us-central1/keyRings/my-keyring\"\n rotation_period = \"72h\"\n labels = {\n \"version\" = \"v2\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.KmsSecretBackendKey;\nimport com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var updatable = new KmsSecretBackendKey(\"updatable\", KmsSecretBackendKeyArgs.builder()\n .mount(gcpkms.path())\n .keyName(\"my-key\")\n .keyRing(\"projects/my-project/locations/us-central1/keyRings/my-keyring\")\n .rotationPeriod(\"72h\")\n .labels(Map.of(\"version\", \"v2\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n updatable:\n type: vault:gcp:KmsSecretBackendKey\n properties:\n mount: ${gcpkms.path}\n keyName: my-key\n keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring\n rotationPeriod: 72h\n labels:\n version: v2\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Key Purposes and Algorithms\n\n### Encryption Keys (\u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e)\n\nUsed for symmetric encryption and decryption operations. These keys use the \u003cspan pulumi-lang-nodejs=\"`symmetricEncryption`\" pulumi-lang-dotnet=\"`SymmetricEncryption`\" pulumi-lang-go=\"`symmetricEncryption`\" pulumi-lang-python=\"`symmetric_encryption`\" pulumi-lang-yaml=\"`symmetricEncryption`\" pulumi-lang-java=\"`symmetricEncryption`\" pulumi-lang-hcl=\"`symmetric_encryption`\"\u003e`symmetricEncryption`\u003c/span\u003e\nalgorithm and support automatic key rotation via \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e. Use them with the\n\u003cspan pulumi-lang-nodejs=\"`vaultGcpkmsEncrypt`\" pulumi-lang-dotnet=\"`VaultGcpkmsEncrypt`\" pulumi-lang-go=\"`vaultGcpkmsEncrypt`\" pulumi-lang-python=\"`vault_gcpkms_encrypt`\" pulumi-lang-yaml=\"`vaultGcpkmsEncrypt`\" pulumi-lang-java=\"`vaultGcpkmsEncrypt`\" pulumi-lang-hcl=\"`vault_gcpkms_encrypt`\"\u003e`vaultGcpkmsEncrypt`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`vaultGcpkmsDecrypt`\" pulumi-lang-dotnet=\"`VaultGcpkmsDecrypt`\" pulumi-lang-go=\"`vaultGcpkmsDecrypt`\" pulumi-lang-python=\"`vault_gcpkms_decrypt`\" pulumi-lang-yaml=\"`vaultGcpkmsDecrypt`\" pulumi-lang-java=\"`vaultGcpkmsDecrypt`\" pulumi-lang-hcl=\"`vault_gcpkms_decrypt`\"\u003e`vaultGcpkmsDecrypt`\u003c/span\u003e ephemeral resources.\n\nSupported algorithms:\n- \u003cspan pulumi-lang-nodejs=\"`symmetricEncryption`\" pulumi-lang-dotnet=\"`SymmetricEncryption`\" pulumi-lang-go=\"`symmetricEncryption`\" pulumi-lang-python=\"`symmetric_encryption`\" pulumi-lang-yaml=\"`symmetricEncryption`\" pulumi-lang-java=\"`symmetricEncryption`\" pulumi-lang-hcl=\"`symmetric_encryption`\"\u003e`symmetricEncryption`\u003c/span\u003e (default and only option)\n\n### Signing Keys (\u003cspan pulumi-lang-nodejs=\"`asymmetricSign`\" pulumi-lang-dotnet=\"`AsymmetricSign`\" pulumi-lang-go=\"`asymmetricSign`\" pulumi-lang-python=\"`asymmetric_sign`\" pulumi-lang-yaml=\"`asymmetricSign`\" pulumi-lang-java=\"`asymmetricSign`\" pulumi-lang-hcl=\"`asymmetric_sign`\"\u003e`asymmetricSign`\u003c/span\u003e)\n\nUsed for digital signing and verification. These keys do not support rotation. Use them with the\n\u003cspan pulumi-lang-nodejs=\"`vaultGcpkmsSign`\" pulumi-lang-dotnet=\"`VaultGcpkmsSign`\" pulumi-lang-go=\"`vaultGcpkmsSign`\" pulumi-lang-python=\"`vault_gcpkms_sign`\" pulumi-lang-yaml=\"`vaultGcpkmsSign`\" pulumi-lang-java=\"`vaultGcpkmsSign`\" pulumi-lang-hcl=\"`vault_gcpkms_sign`\"\u003e`vaultGcpkmsSign`\u003c/span\u003e ephemeral resource and \u003cspan pulumi-lang-nodejs=\"`vault.gcp.getKmsVerify`\" pulumi-lang-dotnet=\"`vault.gcp.getKmsVerify`\" pulumi-lang-go=\"`gcp.getKmsVerify`\" pulumi-lang-python=\"`gcp_get_kms_verify`\" pulumi-lang-yaml=\"`vault.gcp.getKmsVerify`\" pulumi-lang-java=\"`vault.gcp.getKmsVerify`\" pulumi-lang-hcl=\"`data.vault_gcpkms_verify`\"\u003e`vault.gcp.getKmsVerify`\u003c/span\u003e data source.\n\nSupported algorithms:\n\n| Algorithm | Key type | Hash |\n|---|---|---|\n| \u003cspan pulumi-lang-nodejs=\"`rsaSignPss2048Sha256`\" pulumi-lang-dotnet=\"`RsaSignPss2048Sha256`\" pulumi-lang-go=\"`rsaSignPss2048Sha256`\" pulumi-lang-python=\"`rsa_sign_pss_2048_sha256`\" pulumi-lang-yaml=\"`rsaSignPss2048Sha256`\" pulumi-lang-java=\"`rsaSignPss2048Sha256`\" pulumi-lang-hcl=\"`rsa_sign_pss_2048_sha256`\"\u003e`rsaSignPss2048Sha256`\u003c/span\u003e | RSA 2048-bit | SHA-256 |\n| \u003cspan pulumi-lang-nodejs=\"`rsaSignPss3072Sha256`\" pulumi-lang-dotnet=\"`RsaSignPss3072Sha256`\" pulumi-lang-go=\"`rsaSignPss3072Sha256`\" pulumi-lang-python=\"`rsa_sign_pss_3072_sha256`\" pulumi-lang-yaml=\"`rsaSignPss3072Sha256`\" pulumi-lang-java=\"`rsaSignPss3072Sha256`\" pulumi-lang-hcl=\"`rsa_sign_pss_3072_sha256`\"\u003e`rsaSignPss3072Sha256`\u003c/span\u003e | RSA 3072-bit | SHA-256 |\n| \u003cspan pulumi-lang-nodejs=\"`rsaSignPss4096Sha256`\" pulumi-lang-dotnet=\"`RsaSignPss4096Sha256`\" pulumi-lang-go=\"`rsaSignPss4096Sha256`\" pulumi-lang-python=\"`rsa_sign_pss_4096_sha256`\" pulumi-lang-yaml=\"`rsaSignPss4096Sha256`\" pulumi-lang-java=\"`rsaSignPss4096Sha256`\" pulumi-lang-hcl=\"`rsa_sign_pss_4096_sha256`\"\u003e`rsaSignPss4096Sha256`\u003c/span\u003e | RSA 4096-bit | SHA-256 |\n| \u003cspan pulumi-lang-nodejs=\"`rsaSignPkcs12048Sha256`\" pulumi-lang-dotnet=\"`RsaSignPkcs12048Sha256`\" pulumi-lang-go=\"`rsaSignPkcs12048Sha256`\" pulumi-lang-python=\"`rsa_sign_pkcs1_2048_sha256`\" pulumi-lang-yaml=\"`rsaSignPkcs12048Sha256`\" pulumi-lang-java=\"`rsaSignPkcs12048Sha256`\" pulumi-lang-hcl=\"`rsa_sign_pkcs1_2048_sha256`\"\u003e`rsaSignPkcs12048Sha256`\u003c/span\u003e | RSA 2048-bit (PKCS#1) | SHA-256 |\n| \u003cspan pulumi-lang-nodejs=\"`rsaSignPkcs13072Sha256`\" pulumi-lang-dotnet=\"`RsaSignPkcs13072Sha256`\" pulumi-lang-go=\"`rsaSignPkcs13072Sha256`\" pulumi-lang-python=\"`rsa_sign_pkcs1_3072_sha256`\" pulumi-lang-yaml=\"`rsaSignPkcs13072Sha256`\" pulumi-lang-java=\"`rsaSignPkcs13072Sha256`\" pulumi-lang-hcl=\"`rsa_sign_pkcs1_3072_sha256`\"\u003e`rsaSignPkcs13072Sha256`\u003c/span\u003e | RSA 3072-bit (PKCS#1) | SHA-256 |\n| \u003cspan pulumi-lang-nodejs=\"`rsaSignPkcs14096Sha256`\" pulumi-lang-dotnet=\"`RsaSignPkcs14096Sha256`\" pulumi-lang-go=\"`rsaSignPkcs14096Sha256`\" pulumi-lang-python=\"`rsa_sign_pkcs1_4096_sha256`\" pulumi-lang-yaml=\"`rsaSignPkcs14096Sha256`\" pulumi-lang-java=\"`rsaSignPkcs14096Sha256`\" pulumi-lang-hcl=\"`rsa_sign_pkcs1_4096_sha256`\"\u003e`rsaSignPkcs14096Sha256`\u003c/span\u003e | RSA 4096-bit (PKCS#1) | SHA-256 |\n| \u003cspan pulumi-lang-nodejs=\"`ecSignP256Sha256`\" pulumi-lang-dotnet=\"`EcSignP256Sha256`\" pulumi-lang-go=\"`ecSignP256Sha256`\" pulumi-lang-python=\"`ec_sign_p256_sha256`\" pulumi-lang-yaml=\"`ecSignP256Sha256`\" pulumi-lang-java=\"`ecSignP256Sha256`\" pulumi-lang-hcl=\"`ec_sign_p256_sha256`\"\u003e`ecSignP256Sha256`\u003c/span\u003e | EC P-256 | SHA-256 |\n| \u003cspan pulumi-lang-nodejs=\"`ecSignP384Sha384`\" pulumi-lang-dotnet=\"`EcSignP384Sha384`\" pulumi-lang-go=\"`ecSignP384Sha384`\" pulumi-lang-python=\"`ec_sign_p384_sha384`\" pulumi-lang-yaml=\"`ecSignP384Sha384`\" pulumi-lang-java=\"`ecSignP384Sha384`\" pulumi-lang-hcl=\"`ec_sign_p384_sha384`\"\u003e`ecSignP384Sha384`\u003c/span\u003e | EC P-384 | SHA-384 |\n\n### Asymmetric Decryption Keys (\u003cspan pulumi-lang-nodejs=\"`asymmetricDecrypt`\" pulumi-lang-dotnet=\"`AsymmetricDecrypt`\" pulumi-lang-go=\"`asymmetricDecrypt`\" pulumi-lang-python=\"`asymmetric_decrypt`\" pulumi-lang-yaml=\"`asymmetricDecrypt`\" pulumi-lang-java=\"`asymmetricDecrypt`\" pulumi-lang-hcl=\"`asymmetric_decrypt`\"\u003e`asymmetricDecrypt`\u003c/span\u003e)\n\nUsed for asymmetric encryption where data is encrypted with the public key and decrypted with the\nprivate key via Vault. These keys do not support rotation.\n\nSupported algorithms:\n\n| Algorithm | Key type | Hash |\n|---|---|---|\n| \u003cspan pulumi-lang-nodejs=\"`rsaDecryptOaep2048Sha256`\" pulumi-lang-dotnet=\"`RsaDecryptOaep2048Sha256`\" pulumi-lang-go=\"`rsaDecryptOaep2048Sha256`\" pulumi-lang-python=\"`rsa_decrypt_oaep_2048_sha256`\" pulumi-lang-yaml=\"`rsaDecryptOaep2048Sha256`\" pulumi-lang-java=\"`rsaDecryptOaep2048Sha256`\" pulumi-lang-hcl=\"`rsa_decrypt_oaep_2048_sha256`\"\u003e`rsaDecryptOaep2048Sha256`\u003c/span\u003e | RSA 2048-bit | SHA-256 |\n| \u003cspan pulumi-lang-nodejs=\"`rsaDecryptOaep3072Sha256`\" pulumi-lang-dotnet=\"`RsaDecryptOaep3072Sha256`\" pulumi-lang-go=\"`rsaDecryptOaep3072Sha256`\" pulumi-lang-python=\"`rsa_decrypt_oaep_3072_sha256`\" pulumi-lang-yaml=\"`rsaDecryptOaep3072Sha256`\" pulumi-lang-java=\"`rsaDecryptOaep3072Sha256`\" pulumi-lang-hcl=\"`rsa_decrypt_oaep_3072_sha256`\"\u003e`rsaDecryptOaep3072Sha256`\u003c/span\u003e | RSA 3072-bit | SHA-256 |\n| \u003cspan pulumi-lang-nodejs=\"`rsaDecryptOaep4096Sha256`\" pulumi-lang-dotnet=\"`RsaDecryptOaep4096Sha256`\" pulumi-lang-go=\"`rsaDecryptOaep4096Sha256`\" pulumi-lang-python=\"`rsa_decrypt_oaep_4096_sha256`\" pulumi-lang-yaml=\"`rsaDecryptOaep4096Sha256`\" pulumi-lang-java=\"`rsaDecryptOaep4096Sha256`\" pulumi-lang-hcl=\"`rsa_decrypt_oaep_4096_sha256`\"\u003e`rsaDecryptOaep4096Sha256`\u003c/span\u003e | RSA 4096-bit | SHA-256 |\n\n## Version Management\n\nGCP KMS keys support multiple versions for key rotation:\n\n- \u003cspan pulumi-lang-nodejs=\"`primaryVersion`\" pulumi-lang-dotnet=\"`PrimaryVersion`\" pulumi-lang-go=\"`primaryVersion`\" pulumi-lang-python=\"`primary_version`\" pulumi-lang-yaml=\"`primaryVersion`\" pulumi-lang-java=\"`primaryVersion`\" pulumi-lang-hcl=\"`primary_version`\"\u003e`primaryVersion`\u003c/span\u003e — The version used by default for new cryptographic operations. Only changes\n when a key rotation occurs in GCP KMS (triggered by \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e). Preserved in state between\n applies using `UseStateForUnknown`.\n- \u003cspan pulumi-lang-nodejs=\"`rotationScheduleSeconds`\" pulumi-lang-dotnet=\"`RotationScheduleSeconds`\" pulumi-lang-go=\"`rotationScheduleSeconds`\" pulumi-lang-python=\"`rotation_schedule_seconds`\" pulumi-lang-yaml=\"`rotationScheduleSeconds`\" pulumi-lang-java=\"`rotationScheduleSeconds`\" pulumi-lang-hcl=\"`rotation_schedule_seconds`\"\u003e`rotationScheduleSeconds`\u003c/span\u003e — The rotation interval in seconds exactly as stored by Vault.\n Refreshed from the API on every read.\n- \u003cspan pulumi-lang-nodejs=\"`nextRotationTimeSeconds`\" pulumi-lang-dotnet=\"`NextRotationTimeSeconds`\" pulumi-lang-go=\"`nextRotationTimeSeconds`\" pulumi-lang-python=\"`next_rotation_time_seconds`\" pulumi-lang-yaml=\"`nextRotationTimeSeconds`\" pulumi-lang-java=\"`nextRotationTimeSeconds`\" pulumi-lang-hcl=\"`next_rotation_time_seconds`\"\u003e`nextRotationTimeSeconds`\u003c/span\u003e — Unix timestamp of the next scheduled rotation. Refreshed from the\n API on every read. Useful for alerting or audit purposes.\n\n## Import\n\nGCP KMS keys can be imported using the format `{mount}/keys/{name}`:\n\n```sh\n$ pulumi import vault:gcp/kmsSecretBackendKey:KmsSecretBackendKey encryption gcpkms/keys/my-encryption-key\n```\n\n\u003e **Note:** After import, \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e will be populated from the API as `\"{N}s\"` (e.g.\n`\"2592000s\"`). If your configuration uses a different format (e.g. `\"720h\"`), Terraform will show a\ndiff on the next plan. Update your configuration to match, or leave \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e unset to\naccept the API-formatted value.\n\n\u003e **Note:** The Vault API does not return \u003cspan pulumi-lang-nodejs=\"`keyRing`\" pulumi-lang-dotnet=\"`KeyRing`\" pulumi-lang-go=\"`keyRing`\" pulumi-lang-python=\"`key_ring`\" pulumi-lang-yaml=\"`keyRing`\" pulumi-lang-java=\"`keyRing`\" pulumi-lang-hcl=\"`key_ring`\"\u003e`keyRing`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`cryptoKey`\" pulumi-lang-dotnet=\"`CryptoKey`\" pulumi-lang-go=\"`cryptoKey`\" pulumi-lang-python=\"`crypto_key`\" pulumi-lang-yaml=\"`cryptoKey`\" pulumi-lang-java=\"`cryptoKey`\" pulumi-lang-hcl=\"`crypto_key`\"\u003e`cryptoKey`\u003c/span\u003e on read. After import, both\nfields will be \u003cspan pulumi-lang-nodejs=\"`null`\" pulumi-lang-dotnet=\"`Null`\" pulumi-lang-go=\"`null`\" pulumi-lang-python=\"`null`\" pulumi-lang-yaml=\"`null`\" pulumi-lang-java=\"`null`\" pulumi-lang-hcl=\"`null`\"\u003e`null`\u003c/span\u003e in state. Ensure your Terraform configuration includes the correct \u003cspan pulumi-lang-nodejs=\"`keyRing`\" pulumi-lang-dotnet=\"`KeyRing`\" pulumi-lang-go=\"`keyRing`\" pulumi-lang-python=\"`key_ring`\" pulumi-lang-yaml=\"`keyRing`\" pulumi-lang-java=\"`keyRing`\" pulumi-lang-hcl=\"`key_ring`\"\u003e`keyRing`\u003c/span\u003e\n(and \u003cspan pulumi-lang-nodejs=\"`cryptoKey`\" pulumi-lang-dotnet=\"`CryptoKey`\" pulumi-lang-go=\"`cryptoKey`\" pulumi-lang-python=\"`crypto_key`\" pulumi-lang-yaml=\"`cryptoKey`\" pulumi-lang-java=\"`cryptoKey`\" pulumi-lang-hcl=\"`crypto_key`\"\u003e`cryptoKey`\u003c/span\u003e if applicable) values before running `pulumi preview` after an import — otherwise,\nbecause both fields have `RequiresReplace`, Terraform will plan a **destroy and recreate** of the key.\n\n", "properties": { "algorithm": { "type": "string", "description": "Algorithm for the key. Vault stores and\nreturns this value in lowercase. Defaults to \u003cspan pulumi-lang-nodejs=\"`symmetricEncryption`\" pulumi-lang-dotnet=\"`SymmetricEncryption`\" pulumi-lang-go=\"`symmetricEncryption`\" pulumi-lang-python=\"`symmetric_encryption`\" pulumi-lang-yaml=\"`symmetricEncryption`\" pulumi-lang-java=\"`symmetricEncryption`\" pulumi-lang-hcl=\"`symmetric_encryption`\"\u003e`symmetricEncryption`\u003c/span\u003e for \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e keys.\nValid values depend on \u003cspan pulumi-lang-nodejs=\"`purpose`\" pulumi-lang-dotnet=\"`Purpose`\" pulumi-lang-go=\"`purpose`\" pulumi-lang-python=\"`purpose`\" pulumi-lang-yaml=\"`purpose`\" pulumi-lang-java=\"`purpose`\" pulumi-lang-hcl=\"`purpose`\"\u003e`purpose`\u003c/span\u003e:\n\nFor \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e:\n" }, "cryptoKey": { "type": "string", "description": "Name of the crypto key in GCP KMS. Defaults to the\nVault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.\n" }, "keyName": { "type": "string", "description": "Name of the key in Vault. Used to reference the key for\ncryptographic operations.\n" }, "keyRing": { "type": "string", "description": "Full resource name of the GCP KMS key ring where the\ncrypto key will be created. Format:\n`projects/{project}/locations/{location}/keyRings/{keyring}`\n" }, "labels": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of labels to apply to the GCP KMS crypto key. Can be updated after\ncreation without replacing the resource.\n" }, "mount": { "type": "string", "description": "Path where the GCP KMS secrets engine is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "nextRotationTimeSeconds": { "type": "integer", "description": "Unix timestamp (seconds since epoch) of the next scheduled key\nrotation. Only set for \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e keys that have a \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e configured. Set to\n\u003cspan pulumi-lang-nodejs=\"`null`\" pulumi-lang-dotnet=\"`Null`\" pulumi-lang-go=\"`null`\" pulumi-lang-python=\"`null`\" pulumi-lang-yaml=\"`null`\" pulumi-lang-java=\"`null`\" pulumi-lang-hcl=\"`null`\"\u003e`null`\u003c/span\u003e for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.\n" }, "primaryVersion": { "type": "integer", "description": "The primary version number of the GCP KMS crypto key used for new\ncryptographic operations. Increments only when a key rotation occurs in GCP.\n" }, "protectionLevel": { "type": "string", "description": "Protection level for the key. Vault\nstores and returns this value in lowercase. Valid values:\n" }, "purpose": { "type": "string", "description": "Purpose of the key. Vault stores and returns\nthis value in lowercase. Valid values:\n" }, "rotationPeriod": { "type": "string", "description": "Rotation period for the key. Accepts Go duration strings (e.g.\n`\"72h\"`, `\"30m\"`) or explicit second strings (e.g. `\"2592000s\"`). Only valid for \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e\nkeys. Can be updated after creation without replacing the resource.\n\nThe value you set here is preserved **exactly** in state to avoid format drift. Use the computed\n\u003cspan pulumi-lang-nodejs=\"`rotationScheduleSeconds`\" pulumi-lang-dotnet=\"`RotationScheduleSeconds`\" pulumi-lang-go=\"`rotationScheduleSeconds`\" pulumi-lang-python=\"`rotation_schedule_seconds`\" pulumi-lang-yaml=\"`rotationScheduleSeconds`\" pulumi-lang-java=\"`rotationScheduleSeconds`\" pulumi-lang-hcl=\"`rotation_schedule_seconds`\"\u003e`rotationScheduleSeconds`\u003c/span\u003e attribute to read the canonical numeric value that Vault stores.\n" }, "rotationScheduleSeconds": { "type": "integer", "description": "The rotation period in seconds as stored and returned by Vault. For\nexample, if \u003cspan pulumi-lang-nodejs=\"`rotationPeriod \" pulumi-lang-dotnet=\"`RotationPeriod \" pulumi-lang-go=\"`rotationPeriod \" pulumi-lang-python=\"`rotation_period \" pulumi-lang-yaml=\"`rotationPeriod \" pulumi-lang-java=\"`rotationPeriod \" pulumi-lang-hcl=\"`rotation_period \"\u003e`rotationPeriod \u003c/span\u003e= \"72h\"` then this will be \u003cspan pulumi-lang-nodejs=\"`259200`\" pulumi-lang-dotnet=\"`259200`\" pulumi-lang-go=\"`259200`\" pulumi-lang-python=\"`259200`\" pulumi-lang-yaml=\"`259200`\" pulumi-lang-java=\"`259200`\" pulumi-lang-hcl=\"`259200`\"\u003e`259200`\u003c/span\u003e. Always refreshed from the API on\neach read. Set to \u003cspan pulumi-lang-nodejs=\"`null`\" pulumi-lang-dotnet=\"`Null`\" pulumi-lang-go=\"`null`\" pulumi-lang-python=\"`null`\" pulumi-lang-yaml=\"`null`\" pulumi-lang-java=\"`null`\" pulumi-lang-hcl=\"`null`\"\u003e`null`\u003c/span\u003e for asymmetric keys.\n" } }, "required": [ "algorithm", "keyName", "keyRing", "mount", "nextRotationTimeSeconds", "primaryVersion", "protectionLevel", "purpose", "rotationScheduleSeconds" ], "inputProperties": { "algorithm": { "type": "string", "description": "Algorithm for the key. Vault stores and\nreturns this value in lowercase. Defaults to \u003cspan pulumi-lang-nodejs=\"`symmetricEncryption`\" pulumi-lang-dotnet=\"`SymmetricEncryption`\" pulumi-lang-go=\"`symmetricEncryption`\" pulumi-lang-python=\"`symmetric_encryption`\" pulumi-lang-yaml=\"`symmetricEncryption`\" pulumi-lang-java=\"`symmetricEncryption`\" pulumi-lang-hcl=\"`symmetric_encryption`\"\u003e`symmetricEncryption`\u003c/span\u003e for \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e keys.\nValid values depend on \u003cspan pulumi-lang-nodejs=\"`purpose`\" pulumi-lang-dotnet=\"`Purpose`\" pulumi-lang-go=\"`purpose`\" pulumi-lang-python=\"`purpose`\" pulumi-lang-yaml=\"`purpose`\" pulumi-lang-java=\"`purpose`\" pulumi-lang-hcl=\"`purpose`\"\u003e`purpose`\u003c/span\u003e:\n\nFor \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e:\n" }, "cryptoKey": { "type": "string", "description": "Name of the crypto key in GCP KMS. Defaults to the\nVault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.\n" }, "keyName": { "type": "string", "description": "Name of the key in Vault. Used to reference the key for\ncryptographic operations.\n" }, "keyRing": { "type": "string", "description": "Full resource name of the GCP KMS key ring where the\ncrypto key will be created. Format:\n`projects/{project}/locations/{location}/keyRings/{keyring}`\n" }, "labels": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of labels to apply to the GCP KMS crypto key. Can be updated after\ncreation without replacing the resource.\n" }, "mount": { "type": "string", "description": "Path where the GCP KMS secrets engine is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "protectionLevel": { "type": "string", "description": "Protection level for the key. Vault\nstores and returns this value in lowercase. Valid values:\n" }, "purpose": { "type": "string", "description": "Purpose of the key. Vault stores and returns\nthis value in lowercase. Valid values:\n" }, "rotationPeriod": { "type": "string", "description": "Rotation period for the key. Accepts Go duration strings (e.g.\n`\"72h\"`, `\"30m\"`) or explicit second strings (e.g. `\"2592000s\"`). Only valid for \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e\nkeys. Can be updated after creation without replacing the resource.\n\nThe value you set here is preserved **exactly** in state to avoid format drift. Use the computed\n\u003cspan pulumi-lang-nodejs=\"`rotationScheduleSeconds`\" pulumi-lang-dotnet=\"`RotationScheduleSeconds`\" pulumi-lang-go=\"`rotationScheduleSeconds`\" pulumi-lang-python=\"`rotation_schedule_seconds`\" pulumi-lang-yaml=\"`rotationScheduleSeconds`\" pulumi-lang-java=\"`rotationScheduleSeconds`\" pulumi-lang-hcl=\"`rotation_schedule_seconds`\"\u003e`rotationScheduleSeconds`\u003c/span\u003e attribute to read the canonical numeric value that Vault stores.\n" } }, "requiredInputs": [ "keyName", "keyRing", "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering KmsSecretBackendKey resources.\n", "properties": { "algorithm": { "type": "string", "description": "Algorithm for the key. Vault stores and\nreturns this value in lowercase. Defaults to \u003cspan pulumi-lang-nodejs=\"`symmetricEncryption`\" pulumi-lang-dotnet=\"`SymmetricEncryption`\" pulumi-lang-go=\"`symmetricEncryption`\" pulumi-lang-python=\"`symmetric_encryption`\" pulumi-lang-yaml=\"`symmetricEncryption`\" pulumi-lang-java=\"`symmetricEncryption`\" pulumi-lang-hcl=\"`symmetric_encryption`\"\u003e`symmetricEncryption`\u003c/span\u003e for \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e keys.\nValid values depend on \u003cspan pulumi-lang-nodejs=\"`purpose`\" pulumi-lang-dotnet=\"`Purpose`\" pulumi-lang-go=\"`purpose`\" pulumi-lang-python=\"`purpose`\" pulumi-lang-yaml=\"`purpose`\" pulumi-lang-java=\"`purpose`\" pulumi-lang-hcl=\"`purpose`\"\u003e`purpose`\u003c/span\u003e:\n\nFor \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e:\n" }, "cryptoKey": { "type": "string", "description": "Name of the crypto key in GCP KMS. Defaults to the\nVault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.\n" }, "keyName": { "type": "string", "description": "Name of the key in Vault. Used to reference the key for\ncryptographic operations.\n" }, "keyRing": { "type": "string", "description": "Full resource name of the GCP KMS key ring where the\ncrypto key will be created. Format:\n`projects/{project}/locations/{location}/keyRings/{keyring}`\n" }, "labels": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of labels to apply to the GCP KMS crypto key. Can be updated after\ncreation without replacing the resource.\n" }, "mount": { "type": "string", "description": "Path where the GCP KMS secrets engine is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "nextRotationTimeSeconds": { "type": "integer", "description": "Unix timestamp (seconds since epoch) of the next scheduled key\nrotation. Only set for \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e keys that have a \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e configured. Set to\n\u003cspan pulumi-lang-nodejs=\"`null`\" pulumi-lang-dotnet=\"`Null`\" pulumi-lang-go=\"`null`\" pulumi-lang-python=\"`null`\" pulumi-lang-yaml=\"`null`\" pulumi-lang-java=\"`null`\" pulumi-lang-hcl=\"`null`\"\u003e`null`\u003c/span\u003e for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.\n" }, "primaryVersion": { "type": "integer", "description": "The primary version number of the GCP KMS crypto key used for new\ncryptographic operations. Increments only when a key rotation occurs in GCP.\n" }, "protectionLevel": { "type": "string", "description": "Protection level for the key. Vault\nstores and returns this value in lowercase. Valid values:\n" }, "purpose": { "type": "string", "description": "Purpose of the key. Vault stores and returns\nthis value in lowercase. Valid values:\n" }, "rotationPeriod": { "type": "string", "description": "Rotation period for the key. Accepts Go duration strings (e.g.\n`\"72h\"`, `\"30m\"`) or explicit second strings (e.g. `\"2592000s\"`). Only valid for \u003cspan pulumi-lang-nodejs=\"`encryptDecrypt`\" pulumi-lang-dotnet=\"`EncryptDecrypt`\" pulumi-lang-go=\"`encryptDecrypt`\" pulumi-lang-python=\"`encrypt_decrypt`\" pulumi-lang-yaml=\"`encryptDecrypt`\" pulumi-lang-java=\"`encryptDecrypt`\" pulumi-lang-hcl=\"`encrypt_decrypt`\"\u003e`encryptDecrypt`\u003c/span\u003e\nkeys. Can be updated after creation without replacing the resource.\n\nThe value you set here is preserved **exactly** in state to avoid format drift. Use the computed\n\u003cspan pulumi-lang-nodejs=\"`rotationScheduleSeconds`\" pulumi-lang-dotnet=\"`RotationScheduleSeconds`\" pulumi-lang-go=\"`rotationScheduleSeconds`\" pulumi-lang-python=\"`rotation_schedule_seconds`\" pulumi-lang-yaml=\"`rotationScheduleSeconds`\" pulumi-lang-java=\"`rotationScheduleSeconds`\" pulumi-lang-hcl=\"`rotation_schedule_seconds`\"\u003e`rotationScheduleSeconds`\u003c/span\u003e attribute to read the canonical numeric value that Vault stores.\n" }, "rotationScheduleSeconds": { "type": "integer", "description": "The rotation period in seconds as stored and returned by Vault. For\nexample, if \u003cspan pulumi-lang-nodejs=\"`rotationPeriod \" pulumi-lang-dotnet=\"`RotationPeriod \" pulumi-lang-go=\"`rotationPeriod \" pulumi-lang-python=\"`rotation_period \" pulumi-lang-yaml=\"`rotationPeriod \" pulumi-lang-java=\"`rotationPeriod \" pulumi-lang-hcl=\"`rotation_period \"\u003e`rotationPeriod \u003c/span\u003e= \"72h\"` then this will be \u003cspan pulumi-lang-nodejs=\"`259200`\" pulumi-lang-dotnet=\"`259200`\" pulumi-lang-go=\"`259200`\" pulumi-lang-python=\"`259200`\" pulumi-lang-yaml=\"`259200`\" pulumi-lang-java=\"`259200`\" pulumi-lang-hcl=\"`259200`\"\u003e`259200`\u003c/span\u003e. Always refreshed from the API on\neach read. Set to \u003cspan pulumi-lang-nodejs=\"`null`\" pulumi-lang-dotnet=\"`Null`\" pulumi-lang-go=\"`null`\" pulumi-lang-python=\"`null`\" pulumi-lang-yaml=\"`null`\" pulumi-lang-java=\"`null`\" pulumi-lang-hcl=\"`null`\"\u003e`null`\u003c/span\u003e for asymmetric keys.\n" } }, "type": "object" } }, "vault:gcp/secretBackend:SecretBackend": { "description": "Creates an GCP Secret Backend for Vault. GCP secret backends can then issue GCP\nOAuth token or Service Account keys, once a role has been added to the backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\nYou can setup the GCP secret backend with Workload Identity Federation (WIF) for a secret-less configuration:\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcp = new vault.gcp.SecretBackend(\"gcp\", {\n identityTokenKey: \"example-key\",\n identityTokenTtl: 1800,\n identityTokenAudience: \"\u003cTOKEN_AUDIENCE\u003e\",\n serviceAccountEmail: \"\u003cSERVICE_ACCOUNT_EMAIL\u003e\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ngcp = vault.gcp.SecretBackend(\"gcp\",\n identity_token_key=\"example-key\",\n identity_token_ttl=1800,\n identity_token_audience=\"\u003cTOKEN_AUDIENCE\u003e\",\n service_account_email=\"\u003cSERVICE_ACCOUNT_EMAIL\u003e\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcp = new Vault.Gcp.SecretBackend(\"gcp\", new()\n {\n IdentityTokenKey = \"example-key\",\n IdentityTokenTtl = 1800,\n IdentityTokenAudience = \"\u003cTOKEN_AUDIENCE\u003e\",\n ServiceAccountEmail = \"\u003cSERVICE_ACCOUNT_EMAIL\u003e\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := gcp.NewSecretBackend(ctx, \"gcp\", \u0026gcp.SecretBackendArgs{\n\t\t\tIdentityTokenKey: pulumi.String(\"example-key\"),\n\t\t\tIdentityTokenTtl: pulumi.Int(1800),\n\t\t\tIdentityTokenAudience: pulumi.String(\"\u003cTOKEN_AUDIENCE\u003e\"),\n\t\t\tServiceAccountEmail: pulumi.String(\"\u003cSERVICE_ACCOUNT_EMAIL\u003e\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_secretbackend\" \"gcp\" {\n identity_token_key = \"example-key\"\n identity_token_ttl = 1800\n identity_token_audience = \"\u003cTOKEN_AUDIENCE\u003e\"\n service_account_email = \"\u003cSERVICE_ACCOUNT_EMAIL\u003e\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.SecretBackend;\nimport com.pulumi.vault.gcp.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcp = new SecretBackend(\"gcp\", SecretBackendArgs.builder()\n .identityTokenKey(\"example-key\")\n .identityTokenTtl(1800)\n .identityTokenAudience(\"\u003cTOKEN_AUDIENCE\u003e\")\n .serviceAccountEmail(\"\u003cSERVICE_ACCOUNT_EMAIL\u003e\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcp:\n type: vault:gcp:SecretBackend\n properties:\n identityTokenKey: example-key\n identityTokenTtl: 1800\n identityTokenAudience: \u003cTOKEN_AUDIENCE\u003e\n serviceAccountEmail: \u003cSERVICE_ACCOUNT_EMAIL\u003e\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcp = new vault.gcp.SecretBackend(\"gcp\", {\n credentials: std.file({\n input: \"credentials.json\",\n }).then(invoke =\u003e invoke.result),\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp = vault.gcp.SecretBackend(\"gcp\",\n credentials=std.file(input=\"credentials.json\").result,\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcp = new Vault.Gcp.SecretBackend(\"gcp\", new()\n {\n Credentials = Std.File.Invoke(new()\n {\n Input = \"credentials.json\",\n }).Apply(invoke =\u003e invoke.Result),\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewSecretBackend(ctx, \"gcp\", \u0026gcp.SecretBackendArgs{\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_secretbackend\" \"gcp\" {\n credentials = file(\"credentials.json\")\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.SecretBackend;\nimport com.pulumi.vault.gcp.SecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcp = new SecretBackend(\"gcp\", SecretBackendArgs.builder()\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(\"credentials.json\")\n .build()).result())\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcp:\n type: vault:gcp:SecretBackend\n properties:\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: credentials.json\n return: result\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e - (Optional) The GCP service account credentials in JSON format. Can be updated.\n **Note**: This property is write-only and will not be read from the API.\n", "properties": { "accessor": { "type": "string", "description": "The accessor of the created GCP mount.\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "credentials": { "type": "string", "description": "The GCP service account credentials in JSON format.\n\n\u003e **Important** Because Vault does not support reading the configured\ncredentials back from the API, Terraform cannot detect and correct drift\non \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e. Changing the values, however, _will_ overwrite the\npreviously stored values.\n", "secret": true }, "credentialsWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only JSON-encoded credentials to use to connect to GCP", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenAudience": { "type": "string", "description": "The audience claim value for plugin identity\ntokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens. Defaults to\n1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).\nRequires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "maxTtl": { "type": "integer", "description": "The maximum TTL for long-lived credentials (i.e. service account keys)." }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`gcp`\" pulumi-lang-dotnet=\"`Gcp`\" pulumi-lang-go=\"`gcp`\" pulumi-lang-python=\"`gcp`\" pulumi-lang-yaml=\"`gcp`\" pulumi-lang-java=\"`gcp`\" pulumi-lang-hcl=\"`gcp`\"\u003e`gcp`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "serviceAccountEmail": { "type": "string", "description": "Service Account to impersonate for plugin workload identity federation.\nRequired with \u003cspan pulumi-lang-nodejs=\"`identityTokenAudience`\" pulumi-lang-dotnet=\"`IdentityTokenAudience`\" pulumi-lang-go=\"`identityTokenAudience`\" pulumi-lang-python=\"`identity_token_audience`\" pulumi-lang-yaml=\"`identityTokenAudience`\" pulumi-lang-java=\"`identityTokenAudience`\" pulumi-lang-hcl=\"`identity_token_audience`\"\u003e`identityTokenAudience`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "ttl": { "type": "integer", "description": "The default TTL for long-lived credentials (i.e. service account keys)." } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "forceNoCache", "sealWrap" ], "inputProperties": { "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "credentials": { "type": "string", "description": "The GCP service account credentials in JSON format.\n\n\u003e **Important** Because Vault does not support reading the configured\ncredentials back from the API, Terraform cannot detect and correct drift\non \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e. Changing the values, however, _will_ overwrite the\npreviously stored values.\n", "secret": true }, "credentialsWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only JSON-encoded credentials to use to connect to GCP", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenAudience": { "type": "string", "description": "The audience claim value for plugin identity\ntokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens. Defaults to\n1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).\nRequires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "maxTtl": { "type": "integer", "description": "The maximum TTL for long-lived credentials (i.e. service account keys)." }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`gcp`\" pulumi-lang-dotnet=\"`Gcp`\" pulumi-lang-go=\"`gcp`\" pulumi-lang-python=\"`gcp`\" pulumi-lang-yaml=\"`gcp`\" pulumi-lang-java=\"`gcp`\" pulumi-lang-hcl=\"`gcp`\"\u003e`gcp`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "serviceAccountEmail": { "type": "string", "description": "Service Account to impersonate for plugin workload identity federation.\nRequired with \u003cspan pulumi-lang-nodejs=\"`identityTokenAudience`\" pulumi-lang-dotnet=\"`IdentityTokenAudience`\" pulumi-lang-go=\"`identityTokenAudience`\" pulumi-lang-python=\"`identity_token_audience`\" pulumi-lang-yaml=\"`identityTokenAudience`\" pulumi-lang-java=\"`identityTokenAudience`\" pulumi-lang-hcl=\"`identity_token_audience`\"\u003e`identityTokenAudience`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "ttl": { "type": "integer", "description": "The default TTL for long-lived credentials (i.e. service account keys)." } }, "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "The accessor of the created GCP mount.\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "credentials": { "type": "string", "description": "The GCP service account credentials in JSON format.\n\n\u003e **Important** Because Vault does not support reading the configured\ncredentials back from the API, Terraform cannot detect and correct drift\non \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e. Changing the values, however, _will_ overwrite the\npreviously stored values.\n", "secret": true }, "credentialsWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only JSON-encoded credentials to use to connect to GCP", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenAudience": { "type": "string", "description": "The audience claim value for plugin identity\ntokens. Must match an allowed audience configured for the target [Workload Identity Pool](https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#prepare).\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`credentials`\" pulumi-lang-dotnet=\"`Credentials`\" pulumi-lang-go=\"`credentials`\" pulumi-lang-python=\"`credentials`\" pulumi-lang-yaml=\"`credentials`\" pulumi-lang-java=\"`credentials`\" pulumi-lang-hcl=\"`credentials`\"\u003e`credentials`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens. Defaults to\n1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).\nRequires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "maxTtl": { "type": "integer", "description": "The maximum TTL for long-lived credentials (i.e. service account keys)." }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`gcp`\" pulumi-lang-dotnet=\"`Gcp`\" pulumi-lang-go=\"`gcp`\" pulumi-lang-python=\"`gcp`\" pulumi-lang-yaml=\"`gcp`\" pulumi-lang-java=\"`gcp`\" pulumi-lang-hcl=\"`gcp`\"\u003e`gcp`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n*Available only for Vault Enterprise*.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+. *Available only for Vault Enterprise*.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "serviceAccountEmail": { "type": "string", "description": "Service Account to impersonate for plugin workload identity federation.\nRequired with \u003cspan pulumi-lang-nodejs=\"`identityTokenAudience`\" pulumi-lang-dotnet=\"`IdentityTokenAudience`\" pulumi-lang-go=\"`identityTokenAudience`\" pulumi-lang-python=\"`identity_token_audience`\" pulumi-lang-yaml=\"`identityTokenAudience`\" pulumi-lang-java=\"`identityTokenAudience`\" pulumi-lang-hcl=\"`identity_token_audience`\"\u003e`identityTokenAudience`\u003c/span\u003e. Requires Vault 1.17+. *Available only for Vault Enterprise*.\n" }, "ttl": { "type": "integer", "description": "The default TTL for long-lived credentials (i.e. service account keys)." } }, "type": "object" } }, "vault:gcp/secretImpersonatedAccount:SecretImpersonatedAccount": { "description": "Creates a Impersonated Account in the [GCP Secrets Engine](https://www.vaultproject.io/docs/secrets/gcp/index.html) for Vault.\n\nEach [impersonated account](https://www.vaultproject.io/docs/secrets/gcp/index.html#impersonated-accounts) is tied to a separately managed\nService Account.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as google from \"@pulumi/google\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _this = new google.index.ServiceAccount(\"this\", {accountId: \"my-awesome-account\"});\nconst gcp = new vault.gcp.SecretBackend(\"gcp\", {\n path: \"gcp\",\n credentials: std.file({\n input: \"credentials.json\",\n }).then(invoke =\u003e invoke.result),\n});\nconst impersonatedAccount = new vault.gcp.SecretImpersonatedAccount(\"impersonated_account\", {\n backend: gcp.path,\n impersonatedAccount: \"this\",\n serviceAccountEmail: _this.email,\n tokenScopes: [\"https://www.googleapis.com/auth/cloud-platform\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_google as google\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nthis = google.ServiceAccount(\"this\", account_id=my-awesome-account)\ngcp = vault.gcp.SecretBackend(\"gcp\",\n path=\"gcp\",\n credentials=std.file(input=\"credentials.json\").result)\nimpersonated_account = vault.gcp.SecretImpersonatedAccount(\"impersonated_account\",\n backend=gcp.path,\n impersonated_account=\"this\",\n service_account_email=this[\"email\"],\n token_scopes=[\"https://www.googleapis.com/auth/cloud-platform\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Google = Pulumi.Google;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @this = new Google.ServiceAccount(\"this\", new()\n {\n AccountId = \"my-awesome-account\",\n });\n\n var gcp = new Vault.Gcp.SecretBackend(\"gcp\", new()\n {\n Path = \"gcp\",\n Credentials = Std.File.Invoke(new()\n {\n Input = \"credentials.json\",\n }).Apply(invoke =\u003e invoke.Result),\n });\n\n var impersonatedAccount = new Vault.Gcp.SecretImpersonatedAccount(\"impersonated_account\", new()\n {\n Backend = gcp.Path,\n ImpersonatedAccount = \"this\",\n ServiceAccountEmail = @this.Email,\n TokenScopes = new[]\n {\n \"https://www.googleapis.com/auth/cloud-platform\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-google/sdk/go/google\"\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tthis, err := google.NewServiceAccount(ctx, \"this\", \u0026google.ServiceAccountArgs{\n\t\t\tAccountId: \"my-awesome-account\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tgcp2, err := gcp.NewSecretBackend(ctx, \"gcp\", \u0026gcp.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"gcp\"),\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewSecretImpersonatedAccount(ctx, \"impersonated_account\", \u0026gcp.SecretImpersonatedAccountArgs{\n\t\t\tBackend: gcp2.Path,\n\t\t\tImpersonatedAccount: pulumi.String(\"this\"),\n\t\t\tServiceAccountEmail: this.Email,\n\t\t\tTokenScopes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://www.googleapis.com/auth/cloud-platform\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"google_serviceaccount\" \"this\" {\n account_id = \"my-awesome-account\"\n}\nresource \"vault_gcp_secretbackend\" \"gcp\" {\n path = \"gcp\"\n credentials = file(\"credentials.json\")\n}\nresource \"vault_gcp_secretimpersonatedaccount\" \"impersonated_account\" {\n backend = vault_gcp_secretbackend.gcp.path\n impersonated_account = \"this\"\n service_account_email = google_serviceaccount.this.email\n token_scopes = [\"https://www.googleapis.com/auth/cloud-platform\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.google.ServiceAccount;\nimport com.pulumi.google.ServiceAccountArgs;\nimport com.pulumi.vault.gcp.SecretBackend;\nimport com.pulumi.vault.gcp.SecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.vault.gcp.SecretImpersonatedAccount;\nimport com.pulumi.vault.gcp.SecretImpersonatedAccountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var this_ = new ServiceAccount(\"this\", ServiceAccountArgs.builder()\n .accountId(\"my-awesome-account\")\n .build());\n\n var gcp = new SecretBackend(\"gcp\", SecretBackendArgs.builder()\n .path(\"gcp\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(\"credentials.json\")\n .build()).result())\n .build());\n\n var impersonatedAccount = new SecretImpersonatedAccount(\"impersonatedAccount\", SecretImpersonatedAccountArgs.builder()\n .backend(gcp.path())\n .impersonatedAccount(\"this\")\n .serviceAccountEmail(this_.email())\n .tokenScopes(\"https://www.googleapis.com/auth/cloud-platform\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n this:\n type: google:ServiceAccount\n properties:\n accountId: my-awesome-account\n gcp:\n type: vault:gcp:SecretBackend\n properties:\n path: gcp\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: credentials.json\n return: result\n impersonatedAccount:\n type: vault:gcp:SecretImpersonatedAccount\n name: impersonated_account\n properties:\n backend: ${gcp.path}\n impersonatedAccount: this\n serviceAccountEmail: ${this.email}\n tokenScopes:\n - https://www.googleapis.com/auth/cloud-platform\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nA impersonated account can be imported using its Vault Path. For example, referencing the example above,\n\n```sh\n$ pulumi import vault:gcp/secretImpersonatedAccount:SecretImpersonatedAccount impersonated_account gcp/impersonated-account/project_viewer\n```\n\n", "properties": { "backend": { "type": "string", "description": "Path where the GCP Secrets Engine is mounted\n" }, "impersonatedAccount": { "type": "string", "description": "Name of the Impersonated Account to create\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "serviceAccountEmail": { "type": "string", "description": "Email of the GCP service account to impersonate.\n" }, "serviceAccountProject": { "type": "string", "description": "Project the service account belongs to.\n" }, "tokenScopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to access tokens generated under this impersonated account.\n" }, "ttl": { "type": "string", "description": "Specifies the default TTL for service principals generated using this role.\nAccepts time suffixed strings (\"1h\") or an integer number of seconds. Defaults to the system/engine default TTL time.\n" } }, "required": [ "backend", "impersonatedAccount", "serviceAccountEmail", "serviceAccountProject", "ttl" ], "inputProperties": { "backend": { "type": "string", "description": "Path where the GCP Secrets Engine is mounted\n", "willReplaceOnChanges": true }, "impersonatedAccount": { "type": "string", "description": "Name of the Impersonated Account to create\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true }, "serviceAccountEmail": { "type": "string", "description": "Email of the GCP service account to impersonate.\n", "willReplaceOnChanges": true }, "tokenScopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to access tokens generated under this impersonated account.\n" }, "ttl": { "type": "string", "description": "Specifies the default TTL for service principals generated using this role.\nAccepts time suffixed strings (\"1h\") or an integer number of seconds. Defaults to the system/engine default TTL time.\n" } }, "requiredInputs": [ "backend", "impersonatedAccount", "serviceAccountEmail" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretImpersonatedAccount resources.\n", "properties": { "backend": { "type": "string", "description": "Path where the GCP Secrets Engine is mounted\n", "willReplaceOnChanges": true }, "impersonatedAccount": { "type": "string", "description": "Name of the Impersonated Account to create\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true }, "serviceAccountEmail": { "type": "string", "description": "Email of the GCP service account to impersonate.\n", "willReplaceOnChanges": true }, "serviceAccountProject": { "type": "string", "description": "Project the service account belongs to.\n" }, "tokenScopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to access tokens generated under this impersonated account.\n" }, "ttl": { "type": "string", "description": "Specifies the default TTL for service principals generated using this role.\nAccepts time suffixed strings (\"1h\") or an integer number of seconds. Defaults to the system/engine default TTL time.\n" } }, "type": "object" } }, "vault:gcp/secretRoleset:SecretRoleset": { "description": "Creates a Roleset in the [GCP Secrets Engine](https://www.vaultproject.io/docs/secrets/gcp/index.html) for Vault.\n\nEach Roleset is [tied](https://www.vaultproject.io/docs/secrets/gcp/index.html#service-accounts-are-tied-to-rolesets) to a Service Account, and can have one or more [bindings](https://www.vaultproject.io/docs/secrets/gcp/index.html#roleset-bindings) associated with it.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst project = \"my-awesome-project\";\nconst gcp = new vault.gcp.SecretBackend(\"gcp\", {\n path: \"gcp\",\n credentials: std.file({\n input: \"credentials.json\",\n }).then(invoke =\u003e invoke.result),\n});\nconst roleset = new vault.gcp.SecretRoleset(\"roleset\", {\n backend: gcp.path,\n roleset: \"project_viewer\",\n secretType: \"access_token\",\n project: project,\n tokenScopes: [\"https://www.googleapis.com/auth/cloud-platform\"],\n bindings: [{\n resource: `//cloudresourcemanager.googleapis.com/projects/${project}`,\n roles: [\"roles/viewer\"],\n }],\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nproject = \"my-awesome-project\"\ngcp = vault.gcp.SecretBackend(\"gcp\",\n path=\"gcp\",\n credentials=std.file(input=\"credentials.json\").result)\nroleset = vault.gcp.SecretRoleset(\"roleset\",\n backend=gcp.path,\n roleset=\"project_viewer\",\n secret_type=\"access_token\",\n project=project,\n token_scopes=[\"https://www.googleapis.com/auth/cloud-platform\"],\n bindings=[{\n \"resource\": f\"//cloudresourcemanager.googleapis.com/projects/{project}\",\n \"roles\": [\"roles/viewer\"],\n }])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var project = \"my-awesome-project\";\n\n var gcp = new Vault.Gcp.SecretBackend(\"gcp\", new()\n {\n Path = \"gcp\",\n Credentials = Std.File.Invoke(new()\n {\n Input = \"credentials.json\",\n }).Apply(invoke =\u003e invoke.Result),\n });\n\n var roleset = new Vault.Gcp.SecretRoleset(\"roleset\", new()\n {\n Backend = gcp.Path,\n Roleset = \"project_viewer\",\n SecretType = \"access_token\",\n Project = project,\n TokenScopes = new[]\n {\n \"https://www.googleapis.com/auth/cloud-platform\",\n },\n Bindings = new[]\n {\n new Vault.Gcp.Inputs.SecretRolesetBindingArgs\n {\n Resource = $\"//cloudresourcemanager.googleapis.com/projects/{project}\",\n Roles = new[]\n {\n \"roles/viewer\",\n },\n },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tproject := \"my-awesome-project\"\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tgcp2, err := gcp.NewSecretBackend(ctx, \"gcp\", \u0026gcp.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"gcp\"),\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewSecretRoleset(ctx, \"roleset\", \u0026gcp.SecretRolesetArgs{\n\t\t\tBackend: gcp2.Path,\n\t\t\tRoleset: pulumi.String(\"project_viewer\"),\n\t\t\tSecretType: pulumi.String(\"access_token\"),\n\t\t\tProject: pulumi.String(project),\n\t\t\tTokenScopes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://www.googleapis.com/auth/cloud-platform\"),\n\t\t\t},\n\t\t\tBindings: gcp.SecretRolesetBindingArray{\n\t\t\t\t\u0026gcp.SecretRolesetBindingArgs{\n\t\t\t\t\tResource: pulumi.Sprintf(\"//cloudresourcemanager.googleapis.com/projects/%v\", project),\n\t\t\t\t\tRoles: pulumi.StringArray{\n\t\t\t\t\t\tpulumi.String(\"roles/viewer\"),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_gcp_secretbackend\" \"gcp\" {\n path = \"gcp\"\n credentials = file(\"credentials.json\")\n}\nresource \"vault_gcp_secretroleset\" \"roleset\" {\n backend = vault_gcp_secretbackend.gcp.path\n roleset = \"project_viewer\"\n secret_type = \"access_token\"\n project = local.project\n token_scopes = [\"https://www.googleapis.com/auth/cloud-platform\"]\n bindings {\n resource =\"//cloudresourcemanager.googleapis.com/projects/${local.project}\"\n roles = [\"roles/viewer\"]\n }\n}\nlocals {\n project = \"my-awesome-project\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.gcp.SecretBackend;\nimport com.pulumi.vault.gcp.SecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.vault.gcp.SecretRoleset;\nimport com.pulumi.vault.gcp.SecretRolesetArgs;\nimport com.pulumi.vault.gcp.inputs.SecretRolesetBindingArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n final var project = \"my-awesome-project\";\n\n var gcp = new SecretBackend(\"gcp\", SecretBackendArgs.builder()\n .path(\"gcp\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(\"credentials.json\")\n .build()).result())\n .build());\n\n var roleset = new SecretRoleset(\"roleset\", SecretRolesetArgs.builder()\n .backend(gcp.path())\n .roleset(\"project_viewer\")\n .secretType(\"access_token\")\n .project(project)\n .tokenScopes(\"https://www.googleapis.com/auth/cloud-platform\")\n .bindings(SecretRolesetBindingArgs.builder()\n .resource(String.format(\"//cloudresourcemanager.googleapis.com/projects/%s\", project))\n .roles(\"roles/viewer\")\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcp:\n type: vault:gcp:SecretBackend\n properties:\n path: gcp\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: credentials.json\n return: result\n roleset:\n type: vault:gcp:SecretRoleset\n properties:\n backend: ${gcp.path}\n roleset: project_viewer\n secretType: access_token\n project: ${project}\n tokenScopes:\n - https://www.googleapis.com/auth/cloud-platform\n bindings:\n - resource: //cloudresourcemanager.googleapis.com/projects/${project}\n roles:\n - roles/viewer\nvariables:\n project: my-awesome-project\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nA roleset can be imported using its Vault Path. For example, referencing the example above,\n\n```sh\n$ pulumi import vault:gcp/secretRoleset:SecretRoleset roleset gcp/roleset/project_viewer\n```\n\n", "properties": { "backend": { "type": "string", "description": "Path where the GCP Secrets Engine is mounted\n" }, "bindings": { "type": "array", "items": { "$ref": "#/types/vault:gcp/SecretRolesetBinding:SecretRolesetBinding" }, "description": "Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "project": { "type": "string", "description": "Name of the GCP project that this roleset's service account will belong to.\n" }, "roleset": { "type": "string", "description": "Name of the Roleset to create\n" }, "secretType": { "type": "string", "description": "Type of secret generated for this role set. Accepted values: \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceAccountKey`\" pulumi-lang-dotnet=\"`ServiceAccountKey`\" pulumi-lang-go=\"`serviceAccountKey`\" pulumi-lang-python=\"`service_account_key`\" pulumi-lang-yaml=\"`serviceAccountKey`\" pulumi-lang-java=\"`serviceAccountKey`\" pulumi-lang-hcl=\"`service_account_key`\"\u003e`serviceAccountKey`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e.\n" }, "serviceAccountEmail": { "type": "string", "description": "Email of the service account created by Vault for this Roleset.\n" }, "tokenScopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e secrets generated under this role set (\u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e role sets only).\n" } }, "required": [ "backend", "bindings", "project", "roleset", "secretType", "serviceAccountEmail" ], "inputProperties": { "backend": { "type": "string", "description": "Path where the GCP Secrets Engine is mounted\n", "willReplaceOnChanges": true }, "bindings": { "type": "array", "items": { "$ref": "#/types/vault:gcp/SecretRolesetBinding:SecretRolesetBinding" }, "description": "Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "project": { "type": "string", "description": "Name of the GCP project that this roleset's service account will belong to.\n", "willReplaceOnChanges": true }, "roleset": { "type": "string", "description": "Name of the Roleset to create\n", "willReplaceOnChanges": true }, "secretType": { "type": "string", "description": "Type of secret generated for this role set. Accepted values: \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceAccountKey`\" pulumi-lang-dotnet=\"`ServiceAccountKey`\" pulumi-lang-go=\"`serviceAccountKey`\" pulumi-lang-python=\"`service_account_key`\" pulumi-lang-yaml=\"`serviceAccountKey`\" pulumi-lang-java=\"`serviceAccountKey`\" pulumi-lang-hcl=\"`service_account_key`\"\u003e`serviceAccountKey`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "tokenScopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e secrets generated under this role set (\u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e role sets only).\n" } }, "requiredInputs": [ "backend", "bindings", "project", "roleset" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretRoleset resources.\n", "properties": { "backend": { "type": "string", "description": "Path where the GCP Secrets Engine is mounted\n", "willReplaceOnChanges": true }, "bindings": { "type": "array", "items": { "$ref": "#/types/vault:gcp/SecretRolesetBinding:SecretRolesetBinding" }, "description": "Bindings to create for this roleset. This can be specified multiple times for multiple bindings. Structure is documented below.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "project": { "type": "string", "description": "Name of the GCP project that this roleset's service account will belong to.\n", "willReplaceOnChanges": true }, "roleset": { "type": "string", "description": "Name of the Roleset to create\n", "willReplaceOnChanges": true }, "secretType": { "type": "string", "description": "Type of secret generated for this role set. Accepted values: \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceAccountKey`\" pulumi-lang-dotnet=\"`ServiceAccountKey`\" pulumi-lang-go=\"`serviceAccountKey`\" pulumi-lang-python=\"`service_account_key`\" pulumi-lang-yaml=\"`serviceAccountKey`\" pulumi-lang-java=\"`serviceAccountKey`\" pulumi-lang-hcl=\"`service_account_key`\"\u003e`serviceAccountKey`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "serviceAccountEmail": { "type": "string", "description": "Email of the service account created by Vault for this Roleset.\n" }, "tokenScopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e secrets generated under this role set (\u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e role sets only).\n" } }, "type": "object" } }, "vault:gcp/secretStaticAccount:SecretStaticAccount": { "description": "Creates a Static Account in the [GCP Secrets Engine](https://www.vaultproject.io/docs/secrets/gcp/index.html) for Vault.\n\nEach [static account](https://www.vaultproject.io/docs/secrets/gcp/index.html#static-accounts) is tied to a separately managed\nService Account, and can have one or more [bindings](https://www.vaultproject.io/docs/secrets/gcp/index.html#bindings) associated with it.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as google from \"@pulumi/google\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _this = new google.index.ServiceAccount(\"this\", {accountId: \"my-awesome-account\"});\nconst gcp = new vault.gcp.SecretBackend(\"gcp\", {\n path: \"gcp\",\n credentials: std.file({\n input: \"credentials.json\",\n }).then(invoke =\u003e invoke.result),\n});\nconst staticAccount = new vault.gcp.SecretStaticAccount(\"static_account\", {\n backend: gcp.path,\n staticAccount: \"project_viewer\",\n secretType: \"access_token\",\n tokenScopes: [\"https://www.googleapis.com/auth/cloud-platform\"],\n serviceAccountEmail: _this.email,\n bindings: [{\n resource: `//cloudresourcemanager.googleapis.com/projects/${_this.project}`,\n roles: [\"roles/viewer\"],\n }],\n});\n```\n```python\nimport pulumi\nimport pulumi_google as google\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nthis = google.ServiceAccount(\"this\", account_id=my-awesome-account)\ngcp = vault.gcp.SecretBackend(\"gcp\",\n path=\"gcp\",\n credentials=std.file(input=\"credentials.json\").result)\nstatic_account = vault.gcp.SecretStaticAccount(\"static_account\",\n backend=gcp.path,\n static_account=\"project_viewer\",\n secret_type=\"access_token\",\n token_scopes=[\"https://www.googleapis.com/auth/cloud-platform\"],\n service_account_email=this[\"email\"],\n bindings=[{\n \"resource\": f\"//cloudresourcemanager.googleapis.com/projects/{this['project']}\",\n \"roles\": [\"roles/viewer\"],\n }])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Google = Pulumi.Google;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @this = new Google.ServiceAccount(\"this\", new()\n {\n AccountId = \"my-awesome-account\",\n });\n\n var gcp = new Vault.Gcp.SecretBackend(\"gcp\", new()\n {\n Path = \"gcp\",\n Credentials = Std.File.Invoke(new()\n {\n Input = \"credentials.json\",\n }).Apply(invoke =\u003e invoke.Result),\n });\n\n var staticAccount = new Vault.Gcp.SecretStaticAccount(\"static_account\", new()\n {\n Backend = gcp.Path,\n StaticAccount = \"project_viewer\",\n SecretType = \"access_token\",\n TokenScopes = new[]\n {\n \"https://www.googleapis.com/auth/cloud-platform\",\n },\n ServiceAccountEmail = @this.Email,\n Bindings = new[]\n {\n new Vault.Gcp.Inputs.SecretStaticAccountBindingArgs\n {\n Resource = $\"//cloudresourcemanager.googleapis.com/projects/{@this.Project}\",\n Roles = new[]\n {\n \"roles/viewer\",\n },\n },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-google/sdk/go/google\"\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tthis, err := google.NewServiceAccount(ctx, \"this\", \u0026google.ServiceAccountArgs{\n\t\t\tAccountId: \"my-awesome-account\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tgcp2, err := gcp.NewSecretBackend(ctx, \"gcp\", \u0026gcp.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"gcp\"),\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = gcp.NewSecretStaticAccount(ctx, \"static_account\", \u0026gcp.SecretStaticAccountArgs{\n\t\t\tBackend: gcp2.Path,\n\t\t\tStaticAccount: pulumi.String(\"project_viewer\"),\n\t\t\tSecretType: pulumi.String(\"access_token\"),\n\t\t\tTokenScopes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://www.googleapis.com/auth/cloud-platform\"),\n\t\t\t},\n\t\t\tServiceAccountEmail: this.Email,\n\t\t\tBindings: gcp.SecretStaticAccountBindingArray{\n\t\t\t\t\u0026gcp.SecretStaticAccountBindingArgs{\n\t\t\t\t\tResource: pulumi.Sprintf(\"//cloudresourcemanager.googleapis.com/projects/%v\", this.Project),\n\t\t\t\t\tRoles: pulumi.StringArray{\n\t\t\t\t\t\tpulumi.String(\"roles/viewer\"),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"google_serviceaccount\" \"this\" {\n account_id = \"my-awesome-account\"\n}\nresource \"vault_gcp_secretbackend\" \"gcp\" {\n path = \"gcp\"\n credentials = file(\"credentials.json\")\n}\nresource \"vault_gcp_secretstaticaccount\" \"static_account\" {\n backend = vault_gcp_secretbackend.gcp.path\n static_account = \"project_viewer\"\n secret_type = \"access_token\"\n token_scopes = [\"https://www.googleapis.com/auth/cloud-platform\"]\n service_account_email = google_serviceaccount.this.email\n bindings {\n resource =\"//cloudresourcemanager.googleapis.com/projects/${google_serviceaccount.this.project}\"\n roles = [\"roles/viewer\"]\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.google.ServiceAccount;\nimport com.pulumi.google.ServiceAccountArgs;\nimport com.pulumi.vault.gcp.SecretBackend;\nimport com.pulumi.vault.gcp.SecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.vault.gcp.SecretStaticAccount;\nimport com.pulumi.vault.gcp.SecretStaticAccountArgs;\nimport com.pulumi.vault.gcp.inputs.SecretStaticAccountBindingArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var this_ = new ServiceAccount(\"this\", ServiceAccountArgs.builder()\n .accountId(\"my-awesome-account\")\n .build());\n\n var gcp = new SecretBackend(\"gcp\", SecretBackendArgs.builder()\n .path(\"gcp\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(\"credentials.json\")\n .build()).result())\n .build());\n\n var staticAccount = new SecretStaticAccount(\"staticAccount\", SecretStaticAccountArgs.builder()\n .backend(gcp.path())\n .staticAccount(\"project_viewer\")\n .secretType(\"access_token\")\n .tokenScopes(\"https://www.googleapis.com/auth/cloud-platform\")\n .serviceAccountEmail(this_.email())\n .bindings(SecretStaticAccountBindingArgs.builder()\n .resource(String.format(\"//cloudresourcemanager.googleapis.com/projects/%s\", this_.project()))\n .roles(\"roles/viewer\")\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n this:\n type: google:ServiceAccount\n properties:\n accountId: my-awesome-account\n gcp:\n type: vault:gcp:SecretBackend\n properties:\n path: gcp\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: credentials.json\n return: result\n staticAccount:\n type: vault:gcp:SecretStaticAccount\n name: static_account\n properties:\n backend: ${gcp.path}\n staticAccount: project_viewer\n secretType: access_token\n tokenScopes:\n - https://www.googleapis.com/auth/cloud-platform\n serviceAccountEmail: ${this.email}\n bindings:\n - resource: //cloudresourcemanager.googleapis.com/projects/${this.project}\n roles:\n - roles/viewer\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nA static account can be imported using its Vault Path. For example, referencing the example above,\n\n```sh\n$ pulumi import vault:gcp/secretStaticAccount:SecretStaticAccount static_account gcp/static-account/project_viewer\n```\n\n", "properties": { "backend": { "type": "string", "description": "Path where the GCP Secrets Engine is mounted\n" }, "bindings": { "type": "array", "items": { "$ref": "#/types/vault:gcp/SecretStaticAccountBinding:SecretStaticAccountBinding" }, "description": "Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "secretType": { "type": "string", "description": "Type of secret generated for this static account. Accepted values: \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceAccountKey`\" pulumi-lang-dotnet=\"`ServiceAccountKey`\" pulumi-lang-go=\"`serviceAccountKey`\" pulumi-lang-python=\"`service_account_key`\" pulumi-lang-yaml=\"`serviceAccountKey`\" pulumi-lang-java=\"`serviceAccountKey`\" pulumi-lang-hcl=\"`service_account_key`\"\u003e`serviceAccountKey`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e.\n" }, "serviceAccountEmail": { "type": "string", "description": "Email of the GCP service account to manage.\n" }, "serviceAccountProject": { "type": "string", "description": "Project the service account belongs to.\n" }, "staticAccount": { "type": "string", "description": "Name of the Static Account to create\n" }, "tokenScopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e secrets generated under this static account (\u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e static accounts only).\n" } }, "required": [ "backend", "secretType", "serviceAccountEmail", "serviceAccountProject", "staticAccount" ], "inputProperties": { "backend": { "type": "string", "description": "Path where the GCP Secrets Engine is mounted\n", "willReplaceOnChanges": true }, "bindings": { "type": "array", "items": { "$ref": "#/types/vault:gcp/SecretStaticAccountBinding:SecretStaticAccountBinding" }, "description": "Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "secretType": { "type": "string", "description": "Type of secret generated for this static account. Accepted values: \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceAccountKey`\" pulumi-lang-dotnet=\"`ServiceAccountKey`\" pulumi-lang-go=\"`serviceAccountKey`\" pulumi-lang-python=\"`service_account_key`\" pulumi-lang-yaml=\"`serviceAccountKey`\" pulumi-lang-java=\"`serviceAccountKey`\" pulumi-lang-hcl=\"`service_account_key`\"\u003e`serviceAccountKey`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "serviceAccountEmail": { "type": "string", "description": "Email of the GCP service account to manage.\n", "willReplaceOnChanges": true }, "staticAccount": { "type": "string", "description": "Name of the Static Account to create\n", "willReplaceOnChanges": true }, "tokenScopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e secrets generated under this static account (\u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e static accounts only).\n" } }, "requiredInputs": [ "backend", "serviceAccountEmail", "staticAccount" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretStaticAccount resources.\n", "properties": { "backend": { "type": "string", "description": "Path where the GCP Secrets Engine is mounted\n", "willReplaceOnChanges": true }, "bindings": { "type": "array", "items": { "$ref": "#/types/vault:gcp/SecretStaticAccountBinding:SecretStaticAccountBinding" }, "description": "Bindings to create for this static account. This can be specified multiple times for multiple bindings. Structure is documented below.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "secretType": { "type": "string", "description": "Type of secret generated for this static account. Accepted values: \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceAccountKey`\" pulumi-lang-dotnet=\"`ServiceAccountKey`\" pulumi-lang-go=\"`serviceAccountKey`\" pulumi-lang-python=\"`service_account_key`\" pulumi-lang-yaml=\"`serviceAccountKey`\" pulumi-lang-java=\"`serviceAccountKey`\" pulumi-lang-hcl=\"`service_account_key`\"\u003e`serviceAccountKey`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "serviceAccountEmail": { "type": "string", "description": "Email of the GCP service account to manage.\n", "willReplaceOnChanges": true }, "serviceAccountProject": { "type": "string", "description": "Project the service account belongs to.\n" }, "staticAccount": { "type": "string", "description": "Name of the Static Account to create\n", "willReplaceOnChanges": true }, "tokenScopes": { "type": "array", "items": { "type": "string" }, "description": "List of OAuth scopes to assign to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e secrets generated under this static account (\u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e static accounts only).\n" } }, "type": "object" } }, "vault:generic/endpoint:Endpoint": { "description": "Writes and manages arbitrary data at a given path in Vault.\n\nThis resource enables configuration of arbitrary vault endpoints. It can\nbe used when a resource type is not available for a type of endpoint,\nincluding when the endpoint is provided by a third-party plugin. This\nresource can be used for endpoints with dynamic behavior including\nwrite-only configuration endpoints, endpoints that return different\nfields when read from those that were written, and endpoints that return\ndata when written to. This makes it more flexible than\nthe generic secret resource for use with\narbitrary endpoints.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst userpass = new vault.AuthBackend(\"userpass\", {type: \"userpass\"});\nconst u1 = new vault.generic.Endpoint(\"u1\", {\n path: \"auth/userpass/users/u1\",\n ignoreAbsentFields: true,\n dataJson: `{\n \\\\\"policies\\\\\": [\\\\\"p1\\\\\"],\n \\\\\"password\\\\\": \\\\\"changeme\\\\\"\n}\n`,\n}, {\n dependsOn: [userpass],\n});\nconst u1Token = new vault.generic.Endpoint(\"u1_token\", {\n path: \"auth/userpass/login/u1\",\n disableRead: true,\n disableDelete: true,\n dataJson: `{\n \\\\\"password\\\\\": \\\\\"changeme\\\\\"\n}\n`,\n}, {\n dependsOn: [u1],\n});\nconst u1Entity = new vault.generic.Endpoint(\"u1_entity\", {\n disableRead: true,\n disableDelete: true,\n path: \"identity/lookup/entity\",\n ignoreAbsentFields: true,\n writeFields: [\"id\"],\n dataJson: `{\n \\\\\"alias_name\\\\\": \\\\\"u1\\\\\",\n \\\\\"alias_mount_accessor\\\\\": vault_auth_backend.userpass.accessor\n}\n`,\n}, {\n dependsOn: [u1Token],\n});\nexport const u1Id = u1Entity.writeData.id;\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nuserpass = vault.AuthBackend(\"userpass\", type=\"userpass\")\nu1 = vault.generic.Endpoint(\"u1\",\n path=\"auth/userpass/users/u1\",\n ignore_absent_fields=True,\n data_json=\"\"\"{\n \\\"policies\\\": [\\\"p1\\\"],\n \\\"password\\\": \\\"changeme\\\"\n}\n\"\"\",\n opts = pulumi.ResourceOptions(depends_on=[userpass]))\nu1_token = vault.generic.Endpoint(\"u1_token\",\n path=\"auth/userpass/login/u1\",\n disable_read=True,\n disable_delete=True,\n data_json=\"\"\"{\n \\\"password\\\": \\\"changeme\\\"\n}\n\"\"\",\n opts = pulumi.ResourceOptions(depends_on=[u1]))\nu1_entity = vault.generic.Endpoint(\"u1_entity\",\n disable_read=True,\n disable_delete=True,\n path=\"identity/lookup/entity\",\n ignore_absent_fields=True,\n write_fields=[\"id\"],\n data_json=\"\"\"{\n \\\"alias_name\\\": \\\"u1\\\",\n \\\"alias_mount_accessor\\\": vault_auth_backend.userpass.accessor\n}\n\"\"\",\n opts = pulumi.ResourceOptions(depends_on=[u1_token]))\npulumi.export(\"u1Id\", u1_entity.write_data[\"id\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var userpass = new Vault.AuthBackend(\"userpass\", new()\n {\n Type = \"userpass\",\n });\n\n var u1 = new Vault.Generic.Endpoint(\"u1\", new()\n {\n Path = \"auth/userpass/users/u1\",\n IgnoreAbsentFields = true,\n DataJson = @\"{\n \\\"\"policies\\\"\": [\\\"\"p1\\\"\"],\n \\\"\"password\\\"\": \\\"\"changeme\\\"\"\n}\n\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n userpass,\n },\n });\n\n var u1Token = new Vault.Generic.Endpoint(\"u1_token\", new()\n {\n Path = \"auth/userpass/login/u1\",\n DisableRead = true,\n DisableDelete = true,\n DataJson = @\"{\n \\\"\"password\\\"\": \\\"\"changeme\\\"\"\n}\n\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n u1,\n },\n });\n\n var u1Entity = new Vault.Generic.Endpoint(\"u1_entity\", new()\n {\n DisableRead = true,\n DisableDelete = true,\n Path = \"identity/lookup/entity\",\n IgnoreAbsentFields = true,\n WriteFields = new[]\n {\n \"id\",\n },\n DataJson = @\"{\n \\\"\"alias_name\\\"\": \\\"\"u1\\\"\",\n \\\"\"alias_mount_accessor\\\"\": vault_auth_backend.userpass.accessor\n}\n\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n u1Token,\n },\n });\n\n return new Dictionary\u003cstring, object?\u003e\n {\n [\"u1Id\"] = u1Entity.WriteData.Apply(writeData =\u003e writeData.Id),\n };\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/generic\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tuserpass, err := vault.NewAuthBackend(ctx, \"userpass\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"userpass\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tu1, err := generic.NewEndpoint(ctx, \"u1\", \u0026generic.EndpointArgs{\n\t\t\tPath: pulumi.String(\"auth/userpass/users/u1\"),\n\t\t\tIgnoreAbsentFields: pulumi.Bool(true),\n\t\t\tDataJson: pulumi.String(\"{\\n \\\\\\\"policies\\\\\\\": [\\\\\\\"p1\\\\\\\"],\\n \\\\\\\"password\\\\\\\": \\\\\\\"changeme\\\\\\\"\\n}\\n\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tuserpass,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tu1Token, err := generic.NewEndpoint(ctx, \"u1_token\", \u0026generic.EndpointArgs{\n\t\t\tPath: pulumi.String(\"auth/userpass/login/u1\"),\n\t\t\tDisableRead: pulumi.Bool(true),\n\t\t\tDisableDelete: pulumi.Bool(true),\n\t\t\tDataJson: pulumi.String(\"{\\n \\\\\\\"password\\\\\\\": \\\\\\\"changeme\\\\\\\"\\n}\\n\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tu1,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tu1Entity, err := generic.NewEndpoint(ctx, \"u1_entity\", \u0026generic.EndpointArgs{\n\t\t\tDisableRead: pulumi.Bool(true),\n\t\t\tDisableDelete: pulumi.Bool(true),\n\t\t\tPath: pulumi.String(\"identity/lookup/entity\"),\n\t\t\tIgnoreAbsentFields: pulumi.Bool(true),\n\t\t\tWriteFields: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"id\"),\n\t\t\t},\n\t\t\tDataJson: pulumi.String(\"{\\n \\\\\\\"alias_name\\\\\\\": \\\\\\\"u1\\\\\\\",\\n \\\\\\\"alias_mount_accessor\\\\\\\": vault_auth_backend.userpass.accessor\\n}\\n\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tu1Token,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tctx.Export(\"u1Id\", u1Entity.WriteData.ApplyT(func(writeData map[string]string) (string, error) {\n\t\t\treturn writeData[\"id\"], nil\n\t\t}).(pulumi.StringOutput))\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"userpass\" {\n type = \"userpass\"\n}\nresource \"vault_generic_endpoint\" \"u1\" {\n depends_on = [vault_authbackend.userpass]\n path = \"auth/userpass/users/u1\"\n ignore_absent_fields = true\n data_json = \"{\\n \\\\\\\"policies\\\\\\\": [\\\\\\\"p1\\\\\\\"],\\n \\\\\\\"password\\\\\\\": \\\\\\\"changeme\\\\\\\"\\n}\\n\"\n}\nresource \"vault_generic_endpoint\" \"u1_token\" {\n depends_on = [vault_generic_endpoint.u1]\n path = \"auth/userpass/login/u1\"\n disable_read = true\n disable_delete = true\n data_json = \"{\\n \\\\\\\"password\\\\\\\": \\\\\\\"changeme\\\\\\\"\\n}\\n\"\n}\nresource \"vault_generic_endpoint\" \"u1_entity\" {\n depends_on = [vault_generic_endpoint.u1_token]\n disable_read = true\n disable_delete = true\n path = \"identity/lookup/entity\"\n ignore_absent_fields = true\n write_fields = [\"id\"]\n data_json = \"{\\n \\\\\\\"alias_name\\\\\\\": \\\\\\\"u1\\\\\\\",\\n \\\\\\\"alias_mount_accessor\\\\\\\": vault_auth_backend.userpass.accessor\\n}\\n\"\n}\noutput \"u1Id\" {\n value = vault_generic_endpoint.u1_entity.write_data[\"id\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.generic.Endpoint;\nimport com.pulumi.vault.generic.EndpointArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var userpass = new AuthBackend(\"userpass\", AuthBackendArgs.builder()\n .type(\"userpass\")\n .build());\n\n var u1 = new Endpoint(\"u1\", EndpointArgs.builder()\n .path(\"auth/userpass/users/u1\")\n .ignoreAbsentFields(true)\n .dataJson(\"\"\"\n{\n \\\"policies\\\": [\\\"p1\\\"],\n \\\"password\\\": \\\"changeme\\\"\n}\n \"\"\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(userpass)\n .build());\n\n var u1Token = new Endpoint(\"u1Token\", EndpointArgs.builder()\n .path(\"auth/userpass/login/u1\")\n .disableRead(true)\n .disableDelete(true)\n .dataJson(\"\"\"\n{\n \\\"password\\\": \\\"changeme\\\"\n}\n \"\"\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(u1)\n .build());\n\n var u1Entity = new Endpoint(\"u1Entity\", EndpointArgs.builder()\n .disableRead(true)\n .disableDelete(true)\n .path(\"identity/lookup/entity\")\n .ignoreAbsentFields(true)\n .writeFields(\"id\")\n .dataJson(\"\"\"\n{\n \\\"alias_name\\\": \\\"u1\\\",\n \\\"alias_mount_accessor\\\": vault_auth_backend.userpass.accessor\n}\n \"\"\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(u1Token)\n .build());\n\n ctx.export(\"u1Id\", u1Entity.writeData().applyValue(_writeData -\u003e _writeData.id()));\n }\n}\n```\n```yaml\nresources:\n userpass:\n type: vault:AuthBackend\n properties:\n type: userpass\n u1:\n type: vault:generic:Endpoint\n properties:\n path: auth/userpass/users/u1\n ignoreAbsentFields: true\n dataJson: |\n {\n \\\"policies\\\": [\\\"p1\\\"],\n \\\"password\\\": \\\"changeme\\\"\n }\n options:\n dependsOn:\n - ${userpass}\n u1Token:\n type: vault:generic:Endpoint\n name: u1_token\n properties:\n path: auth/userpass/login/u1\n disableRead: true\n disableDelete: true\n dataJson: |\n {\n \\\"password\\\": \\\"changeme\\\"\n }\n options:\n dependsOn:\n - ${u1}\n u1Entity:\n type: vault:generic:Endpoint\n name: u1_entity\n properties:\n disableRead: true\n disableDelete: true\n path: identity/lookup/entity\n ignoreAbsentFields: true\n writeFields:\n - id\n dataJson: |\n {\n \\\"alias_name\\\": \\\"u1\\\",\n \\\"alias_mount_accessor\\\": vault_auth_backend.userpass.accessor\n }\n options:\n dependsOn:\n - ${u1Token}\noutputs:\n u1Id: ${u1Entity.writeData.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Required Vault Capabilities\n\nUse of this resource requires the \u003cspan pulumi-lang-nodejs=\"`create`\" pulumi-lang-dotnet=\"`Create`\" pulumi-lang-go=\"`create`\" pulumi-lang-python=\"`create`\" pulumi-lang-yaml=\"`create`\" pulumi-lang-java=\"`create`\" pulumi-lang-hcl=\"`create`\"\u003e`create`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`update`\" pulumi-lang-dotnet=\"`Update`\" pulumi-lang-go=\"`update`\" pulumi-lang-python=\"`update`\" pulumi-lang-yaml=\"`update`\" pulumi-lang-java=\"`update`\" pulumi-lang-hcl=\"`update`\"\u003e`update`\u003c/span\u003e capability\n(depending on whether the resource already exists) on the given path. If\n\u003cspan pulumi-lang-nodejs=\"`disableDelete`\" pulumi-lang-dotnet=\"`DisableDelete`\" pulumi-lang-go=\"`disableDelete`\" pulumi-lang-python=\"`disable_delete`\" pulumi-lang-yaml=\"`disableDelete`\" pulumi-lang-java=\"`disableDelete`\" pulumi-lang-hcl=\"`disable_delete`\"\u003e`disableDelete`\u003c/span\u003e is false, the \u003cspan pulumi-lang-nodejs=\"`delete`\" pulumi-lang-dotnet=\"`Delete`\" pulumi-lang-go=\"`delete`\" pulumi-lang-python=\"`delete`\" pulumi-lang-yaml=\"`delete`\" pulumi-lang-java=\"`delete`\" pulumi-lang-hcl=\"`delete`\"\u003e`delete`\u003c/span\u003e capability is also required. If\n\u003cspan pulumi-lang-nodejs=\"`disableRead`\" pulumi-lang-dotnet=\"`DisableRead`\" pulumi-lang-go=\"`disableRead`\" pulumi-lang-python=\"`disable_read`\" pulumi-lang-yaml=\"`disableRead`\" pulumi-lang-java=\"`disableRead`\" pulumi-lang-hcl=\"`disable_read`\"\u003e`disableRead`\u003c/span\u003e is false, the \u003cspan pulumi-lang-nodejs=\"`read`\" pulumi-lang-dotnet=\"`Read`\" pulumi-lang-go=\"`read`\" pulumi-lang-python=\"`read`\" pulumi-lang-yaml=\"`read`\" pulumi-lang-java=\"`read`\" pulumi-lang-hcl=\"`read`\"\u003e`read`\u003c/span\u003e capability is required.\n\n## Import\n\nImport is not supported for this resource.\n\n", "properties": { "dataJson": { "type": "string", "description": "String containing a JSON-encoded object that will be\nwritten to the given path as the secret data.\n", "secret": true }, "disableDelete": { "type": "boolean", "description": "- (Optional) True/false. Set this to true if your\nvault authentication is not able to delete the data or if the endpoint\ndoes not support the `DELETE` method. Defaults to false.\n" }, "disableRead": { "type": "boolean", "description": "True/false. Set this to true if your vault\nauthentication is not able to read the data or if the endpoint does\nnot support the `GET` method. Setting this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e will break drift\ndetection. You should set this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e for endpoints that are\nwrite-only. Defaults to false.\n" }, "ignoreAbsentFields": { "type": "boolean", "description": "- (Optional) True/false. If set to true,\nignore any fields present when the endpoint is read but that were not\nin \u003cspan pulumi-lang-nodejs=\"`dataJson`\" pulumi-lang-dotnet=\"`DataJson`\" pulumi-lang-go=\"`dataJson`\" pulumi-lang-python=\"`data_json`\" pulumi-lang-yaml=\"`dataJson`\" pulumi-lang-java=\"`dataJson`\" pulumi-lang-hcl=\"`data_json`\"\u003e`dataJson`\u003c/span\u003e. Also, if a field that was written is not returned when\nthe endpoint is read, treat that field as being up to date. You should\nset this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e when writing to endpoint that, when read, returns a\ndifferent set of fields from the ones you wrote, as is common with\nmany configuration endpoints. Defaults to false.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "The full logical path at which to write the given\ndata. Consult each backend's documentation to see which endpoints\nsupport the `PUT` methods and to determine whether they also support\n`DELETE` and `GET`.\n" }, "writeData": { "type": "object", "additionalProperties": { "type": "string" }, "description": "- A map whose keys are the top-level data keys\nreturned from Vault by the write operation and whose values are the\ncorresponding values. This map can only represent string data, so\nany non-string values returned from Vault are serialized as JSON.\nOnly fields set in \u003cspan pulumi-lang-nodejs=\"`writeFields`\" pulumi-lang-dotnet=\"`WriteFields`\" pulumi-lang-go=\"`writeFields`\" pulumi-lang-python=\"`write_fields`\" pulumi-lang-yaml=\"`writeFields`\" pulumi-lang-java=\"`writeFields`\" pulumi-lang-hcl=\"`write_fields`\"\u003e`writeFields`\u003c/span\u003e are present in the JSON data.\n" }, "writeDataJson": { "type": "string", "description": "- The JSON data returned by the write operation.\nOnly fields set in \u003cspan pulumi-lang-nodejs=\"`writeFields`\" pulumi-lang-dotnet=\"`WriteFields`\" pulumi-lang-go=\"`writeFields`\" pulumi-lang-python=\"`write_fields`\" pulumi-lang-yaml=\"`writeFields`\" pulumi-lang-java=\"`writeFields`\" pulumi-lang-hcl=\"`write_fields`\"\u003e`writeFields`\u003c/span\u003e are present in the JSON data.\n" }, "writeFields": { "type": "array", "items": { "type": "string" }, "description": "- (Optional). A list of fields that should be returned\nin \u003cspan pulumi-lang-nodejs=\"`writeDataJson`\" pulumi-lang-dotnet=\"`WriteDataJson`\" pulumi-lang-go=\"`writeDataJson`\" pulumi-lang-python=\"`write_data_json`\" pulumi-lang-yaml=\"`writeDataJson`\" pulumi-lang-java=\"`writeDataJson`\" pulumi-lang-hcl=\"`write_data_json`\"\u003e`writeDataJson`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`writeData`\" pulumi-lang-dotnet=\"`WriteData`\" pulumi-lang-go=\"`writeData`\" pulumi-lang-python=\"`write_data`\" pulumi-lang-yaml=\"`writeData`\" pulumi-lang-java=\"`writeData`\" pulumi-lang-hcl=\"`write_data`\"\u003e`writeData`\u003c/span\u003e. If omitted, data returned by\nthe write operation is not available to the resource or included in\nstate. This helps to avoid accidental storage of sensitive values in\nstate. Some endpoints, such as many dynamic secrets endpoints, return\ndata from writing to an endpoint rather than reading it. You should\nuse \u003cspan pulumi-lang-nodejs=\"`writeFields`\" pulumi-lang-dotnet=\"`WriteFields`\" pulumi-lang-go=\"`writeFields`\" pulumi-lang-python=\"`write_fields`\" pulumi-lang-yaml=\"`writeFields`\" pulumi-lang-java=\"`writeFields`\" pulumi-lang-hcl=\"`write_fields`\"\u003e`writeFields`\u003c/span\u003e if you need information returned in this way.\n" } }, "required": [ "dataJson", "path", "writeData", "writeDataJson" ], "inputProperties": { "dataJson": { "type": "string", "description": "String containing a JSON-encoded object that will be\nwritten to the given path as the secret data.\n", "secret": true }, "disableDelete": { "type": "boolean", "description": "- (Optional) True/false. Set this to true if your\nvault authentication is not able to delete the data or if the endpoint\ndoes not support the `DELETE` method. Defaults to false.\n" }, "disableRead": { "type": "boolean", "description": "True/false. Set this to true if your vault\nauthentication is not able to read the data or if the endpoint does\nnot support the `GET` method. Setting this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e will break drift\ndetection. You should set this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e for endpoints that are\nwrite-only. Defaults to false.\n" }, "ignoreAbsentFields": { "type": "boolean", "description": "- (Optional) True/false. If set to true,\nignore any fields present when the endpoint is read but that were not\nin \u003cspan pulumi-lang-nodejs=\"`dataJson`\" pulumi-lang-dotnet=\"`DataJson`\" pulumi-lang-go=\"`dataJson`\" pulumi-lang-python=\"`data_json`\" pulumi-lang-yaml=\"`dataJson`\" pulumi-lang-java=\"`dataJson`\" pulumi-lang-hcl=\"`data_json`\"\u003e`dataJson`\u003c/span\u003e. Also, if a field that was written is not returned when\nthe endpoint is read, treat that field as being up to date. You should\nset this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e when writing to endpoint that, when read, returns a\ndifferent set of fields from the ones you wrote, as is common with\nmany configuration endpoints. Defaults to false.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The full logical path at which to write the given\ndata. Consult each backend's documentation to see which endpoints\nsupport the `PUT` methods and to determine whether they also support\n`DELETE` and `GET`.\n", "willReplaceOnChanges": true }, "writeFields": { "type": "array", "items": { "type": "string" }, "description": "- (Optional). A list of fields that should be returned\nin \u003cspan pulumi-lang-nodejs=\"`writeDataJson`\" pulumi-lang-dotnet=\"`WriteDataJson`\" pulumi-lang-go=\"`writeDataJson`\" pulumi-lang-python=\"`write_data_json`\" pulumi-lang-yaml=\"`writeDataJson`\" pulumi-lang-java=\"`writeDataJson`\" pulumi-lang-hcl=\"`write_data_json`\"\u003e`writeDataJson`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`writeData`\" pulumi-lang-dotnet=\"`WriteData`\" pulumi-lang-go=\"`writeData`\" pulumi-lang-python=\"`write_data`\" pulumi-lang-yaml=\"`writeData`\" pulumi-lang-java=\"`writeData`\" pulumi-lang-hcl=\"`write_data`\"\u003e`writeData`\u003c/span\u003e. If omitted, data returned by\nthe write operation is not available to the resource or included in\nstate. This helps to avoid accidental storage of sensitive values in\nstate. Some endpoints, such as many dynamic secrets endpoints, return\ndata from writing to an endpoint rather than reading it. You should\nuse \u003cspan pulumi-lang-nodejs=\"`writeFields`\" pulumi-lang-dotnet=\"`WriteFields`\" pulumi-lang-go=\"`writeFields`\" pulumi-lang-python=\"`write_fields`\" pulumi-lang-yaml=\"`writeFields`\" pulumi-lang-java=\"`writeFields`\" pulumi-lang-hcl=\"`write_fields`\"\u003e`writeFields`\u003c/span\u003e if you need information returned in this way.\n" } }, "requiredInputs": [ "dataJson", "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering Endpoint resources.\n", "properties": { "dataJson": { "type": "string", "description": "String containing a JSON-encoded object that will be\nwritten to the given path as the secret data.\n", "secret": true }, "disableDelete": { "type": "boolean", "description": "- (Optional) True/false. Set this to true if your\nvault authentication is not able to delete the data or if the endpoint\ndoes not support the `DELETE` method. Defaults to false.\n" }, "disableRead": { "type": "boolean", "description": "True/false. Set this to true if your vault\nauthentication is not able to read the data or if the endpoint does\nnot support the `GET` method. Setting this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e will break drift\ndetection. You should set this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e for endpoints that are\nwrite-only. Defaults to false.\n" }, "ignoreAbsentFields": { "type": "boolean", "description": "- (Optional) True/false. If set to true,\nignore any fields present when the endpoint is read but that were not\nin \u003cspan pulumi-lang-nodejs=\"`dataJson`\" pulumi-lang-dotnet=\"`DataJson`\" pulumi-lang-go=\"`dataJson`\" pulumi-lang-python=\"`data_json`\" pulumi-lang-yaml=\"`dataJson`\" pulumi-lang-java=\"`dataJson`\" pulumi-lang-hcl=\"`data_json`\"\u003e`dataJson`\u003c/span\u003e. Also, if a field that was written is not returned when\nthe endpoint is read, treat that field as being up to date. You should\nset this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e when writing to endpoint that, when read, returns a\ndifferent set of fields from the ones you wrote, as is common with\nmany configuration endpoints. Defaults to false.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The full logical path at which to write the given\ndata. Consult each backend's documentation to see which endpoints\nsupport the `PUT` methods and to determine whether they also support\n`DELETE` and `GET`.\n", "willReplaceOnChanges": true }, "writeData": { "type": "object", "additionalProperties": { "type": "string" }, "description": "- A map whose keys are the top-level data keys\nreturned from Vault by the write operation and whose values are the\ncorresponding values. This map can only represent string data, so\nany non-string values returned from Vault are serialized as JSON.\nOnly fields set in \u003cspan pulumi-lang-nodejs=\"`writeFields`\" pulumi-lang-dotnet=\"`WriteFields`\" pulumi-lang-go=\"`writeFields`\" pulumi-lang-python=\"`write_fields`\" pulumi-lang-yaml=\"`writeFields`\" pulumi-lang-java=\"`writeFields`\" pulumi-lang-hcl=\"`write_fields`\"\u003e`writeFields`\u003c/span\u003e are present in the JSON data.\n" }, "writeDataJson": { "type": "string", "description": "- The JSON data returned by the write operation.\nOnly fields set in \u003cspan pulumi-lang-nodejs=\"`writeFields`\" pulumi-lang-dotnet=\"`WriteFields`\" pulumi-lang-go=\"`writeFields`\" pulumi-lang-python=\"`write_fields`\" pulumi-lang-yaml=\"`writeFields`\" pulumi-lang-java=\"`writeFields`\" pulumi-lang-hcl=\"`write_fields`\"\u003e`writeFields`\u003c/span\u003e are present in the JSON data.\n" }, "writeFields": { "type": "array", "items": { "type": "string" }, "description": "- (Optional). A list of fields that should be returned\nin \u003cspan pulumi-lang-nodejs=\"`writeDataJson`\" pulumi-lang-dotnet=\"`WriteDataJson`\" pulumi-lang-go=\"`writeDataJson`\" pulumi-lang-python=\"`write_data_json`\" pulumi-lang-yaml=\"`writeDataJson`\" pulumi-lang-java=\"`writeDataJson`\" pulumi-lang-hcl=\"`write_data_json`\"\u003e`writeDataJson`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`writeData`\" pulumi-lang-dotnet=\"`WriteData`\" pulumi-lang-go=\"`writeData`\" pulumi-lang-python=\"`write_data`\" pulumi-lang-yaml=\"`writeData`\" pulumi-lang-java=\"`writeData`\" pulumi-lang-hcl=\"`write_data`\"\u003e`writeData`\u003c/span\u003e. If omitted, data returned by\nthe write operation is not available to the resource or included in\nstate. This helps to avoid accidental storage of sensitive values in\nstate. Some endpoints, such as many dynamic secrets endpoints, return\ndata from writing to an endpoint rather than reading it. You should\nuse \u003cspan pulumi-lang-nodejs=\"`writeFields`\" pulumi-lang-dotnet=\"`WriteFields`\" pulumi-lang-go=\"`writeFields`\" pulumi-lang-python=\"`write_fields`\" pulumi-lang-yaml=\"`writeFields`\" pulumi-lang-java=\"`writeFields`\" pulumi-lang-hcl=\"`write_fields`\"\u003e`writeFields`\u003c/span\u003e if you need information returned in this way.\n" } }, "type": "object" } }, "vault:generic/secret:Secret": { "description": "Writes and manages secrets stored in\n[Vault's \"generic\" secret backend](https://www.vaultproject.io/docs/secrets/generic/index.html)\n\nThis resource is primarily intended to be used with both v1 and v2 of\n[Vault's \"generic\" secret backend](https://www.vaultproject.io/docs/secrets/generic/index.html).\nWhile it is also compatible, with some limitations, with other Vault\nendpoints that support the `vault write` command to create and the\n`vault delete` command to delete, see also\nthe generic endpoint resource for a more\nflexible way to manage arbitrary data.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.generic.Secret(\"example\", {\n path: \"secret/foo\",\n dataJson: `{\n \\\\\"foo\\\\\": \\\\\"bar\\\\\",\n \\\\\"pizza\\\\\": \\\\\"cheese\\\\\"\n}\n`,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.generic.Secret(\"example\",\n path=\"secret/foo\",\n data_json=\"\"\"{\n \\\"foo\\\": \\\"bar\\\",\n \\\"pizza\\\": \\\"cheese\\\"\n}\n\"\"\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Generic.Secret(\"example\", new()\n {\n Path = \"secret/foo\",\n DataJson = @\"{\n \\\"\"foo\\\"\": \\\"\"bar\\\"\",\n \\\"\"pizza\\\"\": \\\"\"cheese\\\"\"\n}\n\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/generic\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := generic.NewSecret(ctx, \"example\", \u0026generic.SecretArgs{\n\t\t\tPath: pulumi.String(\"secret/foo\"),\n\t\t\tDataJson: pulumi.String(\"{\\n \\\\\\\"foo\\\\\\\": \\\\\\\"bar\\\\\\\",\\n \\\\\\\"pizza\\\\\\\": \\\\\\\"cheese\\\\\\\"\\n}\\n\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_generic_secret\" \"example\" {\n path = \"secret/foo\"\n data_json = \"{\\n \\\\\\\"foo\\\\\\\": \\\\\\\"bar\\\\\\\",\\n \\\\\\\"pizza\\\\\\\": \\\\\\\"cheese\\\\\\\"\\n}\\n\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.generic.Secret;\nimport com.pulumi.vault.generic.SecretArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new Secret(\"example\", SecretArgs.builder()\n .path(\"secret/foo\")\n .dataJson(\"\"\"\n{\n \\\"foo\\\": \\\"bar\\\",\n \\\"pizza\\\": \\\"cheese\\\"\n}\n \"\"\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:generic:Secret\n properties:\n path: secret/foo\n dataJson: |\n {\n \\\"foo\\\": \\\"bar\\\",\n \\\"pizza\\\": \\\"cheese\\\"\n }\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Required Vault Capabilities\n\nUse of this resource requires the \u003cspan pulumi-lang-nodejs=\"`create`\" pulumi-lang-dotnet=\"`Create`\" pulumi-lang-go=\"`create`\" pulumi-lang-python=\"`create`\" pulumi-lang-yaml=\"`create`\" pulumi-lang-java=\"`create`\" pulumi-lang-hcl=\"`create`\"\u003e`create`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`update`\" pulumi-lang-dotnet=\"`Update`\" pulumi-lang-go=\"`update`\" pulumi-lang-python=\"`update`\" pulumi-lang-yaml=\"`update`\" pulumi-lang-java=\"`update`\" pulumi-lang-hcl=\"`update`\"\u003e`update`\u003c/span\u003e capability\n(depending on whether the resource already exists) on the given path,\nthe \u003cspan pulumi-lang-nodejs=\"`delete`\" pulumi-lang-dotnet=\"`Delete`\" pulumi-lang-go=\"`delete`\" pulumi-lang-python=\"`delete`\" pulumi-lang-yaml=\"`delete`\" pulumi-lang-java=\"`delete`\" pulumi-lang-hcl=\"`delete`\"\u003e`delete`\u003c/span\u003e capability if the resource is removed from configuration,\nand the \u003cspan pulumi-lang-nodejs=\"`read`\" pulumi-lang-dotnet=\"`Read`\" pulumi-lang-go=\"`read`\" pulumi-lang-python=\"`read`\" pulumi-lang-yaml=\"`read`\" pulumi-lang-java=\"`read`\" pulumi-lang-hcl=\"`read`\"\u003e`read`\u003c/span\u003e capability for drift detection (by default).\n\n### Drift Detection\n\nThis resource does not necessarily need to *read* the secret data back from\nTerraform on refresh. To avoid the need for \u003cspan pulumi-lang-nodejs=\"`read`\" pulumi-lang-dotnet=\"`Read`\" pulumi-lang-go=\"`read`\" pulumi-lang-python=\"`read`\" pulumi-lang-yaml=\"`read`\" pulumi-lang-java=\"`read`\" pulumi-lang-hcl=\"`read`\"\u003e`read`\u003c/span\u003e access on the given path\nset the \u003cspan pulumi-lang-nodejs=\"`disableRead`\" pulumi-lang-dotnet=\"`DisableRead`\" pulumi-lang-go=\"`disableRead`\" pulumi-lang-python=\"`disable_read`\" pulumi-lang-yaml=\"`disableRead`\" pulumi-lang-java=\"`disableRead`\" pulumi-lang-hcl=\"`disable_read`\"\u003e`disableRead`\u003c/span\u003e argument to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. This means that Terraform *will not*\nbe able to detect and repair \"drift\" on this resource,\nshould the data be updated or deleted outside of Terraform.\n\n## Import\n\nGeneric secrets can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:generic/secret:Secret example secret/foo\n```\n\n", "properties": { "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A mapping whose keys are the top-level data keys returned from\nVault and whose values are the corresponding values. This map can only\nrepresent string data, so any non-string values returned from Vault are\nserialized as JSON.\n", "secret": true }, "dataJson": { "type": "string", "description": "String containing a JSON-encoded object that will be\nwritten as the secret data at the given path.\n", "secret": true }, "deleteAllVersions": { "type": "boolean", "description": "true/false. Only applicable for kv-v2 stores.\nIf set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, permanently deletes all versions for\nthe specified key. The default behavior is to only delete the latest version of the\nsecret.\n" }, "disableRead": { "type": "boolean", "description": "true/false. Set this to true if your vault\nauthentication is not able to read the data. Setting this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e will\nbreak drift detection. Defaults to false.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "The full logical path at which to write the given data.\nTo write data into the \"generic\" secret backend mounted in Vault by default,\nthis should be prefixed with `secret/`. Writing to other backends with this\nresource is possible; consult each backend's documentation to see which\nendpoints support the `PUT` and `DELETE` methods.\n" } }, "required": [ "data", "dataJson", "path" ], "inputProperties": { "dataJson": { "type": "string", "description": "String containing a JSON-encoded object that will be\nwritten as the secret data at the given path.\n", "secret": true }, "deleteAllVersions": { "type": "boolean", "description": "true/false. Only applicable for kv-v2 stores.\nIf set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, permanently deletes all versions for\nthe specified key. The default behavior is to only delete the latest version of the\nsecret.\n" }, "disableRead": { "type": "boolean", "description": "true/false. Set this to true if your vault\nauthentication is not able to read the data. Setting this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e will\nbreak drift detection. Defaults to false.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The full logical path at which to write the given data.\nTo write data into the \"generic\" secret backend mounted in Vault by default,\nthis should be prefixed with `secret/`. Writing to other backends with this\nresource is possible; consult each backend's documentation to see which\nendpoints support the `PUT` and `DELETE` methods.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "dataJson", "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering Secret resources.\n", "properties": { "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A mapping whose keys are the top-level data keys returned from\nVault and whose values are the corresponding values. This map can only\nrepresent string data, so any non-string values returned from Vault are\nserialized as JSON.\n", "secret": true }, "dataJson": { "type": "string", "description": "String containing a JSON-encoded object that will be\nwritten as the secret data at the given path.\n", "secret": true }, "deleteAllVersions": { "type": "boolean", "description": "true/false. Only applicable for kv-v2 stores.\nIf set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, permanently deletes all versions for\nthe specified key. The default behavior is to only delete the latest version of the\nsecret.\n" }, "disableRead": { "type": "boolean", "description": "true/false. Set this to true if your vault\nauthentication is not able to read the data. Setting this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e will\nbreak drift detection. Defaults to false.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The full logical path at which to write the given data.\nTo write data into the \"generic\" secret backend mounted in Vault by default,\nthis should be prefixed with `secret/`. Writing to other backends with this\nresource is possible; consult each backend's documentation to see which\nendpoints support the `PUT` and `DELETE` methods.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:github/authBackend:AuthBackend": { "description": "Manages a GitHub Auth mount in a Vault server. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/github/) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.github.AuthBackend(\"example\", {organization: \"myorg\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.github.AuthBackend(\"example\", organization=\"myorg\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.GitHub.AuthBackend(\"example\", new()\n {\n Organization = \"myorg\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/github\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := github.NewAuthBackend(ctx, \"example\", \u0026github.AuthBackendArgs{\n\t\t\tOrganization: pulumi.String(\"myorg\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_github_authbackend\" \"example\" {\n organization = \"myorg\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.github.AuthBackend;\nimport com.pulumi.vault.github.AuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .organization(\"myorg\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:github:AuthBackend\n properties:\n organization: myorg\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nGitHub authentication mounts can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:github/authBackend:AuthBackend example github\n```\n\n", "properties": { "accessor": { "type": "string", "description": "The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).\n" }, "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "(Optional) The metadata to be tied to generated entity alias.\nThis should be a list or map containing the metadata in key value pairs.\n" }, "baseUrl": { "type": "string", "description": "The API endpoint to use. Useful if you\nare running GitHub Enterprise or an API-compatible authentication server.\n" }, "description": { "type": "string", "description": "Specifies the description of the mount.\nThis overrides the current stored value, if any.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "organization": { "type": "string", "description": "The organization configured users must be part of.\n" }, "organizationId": { "type": "integer", "description": "The ID of the organization users must be part of.\nVault will attempt to fetch and set this value if it is not provided. (Vault 1.10+)\n" }, "path": { "type": "string", "description": "Path where the auth backend is mounted. Defaults to `auth/github`\nif not specified.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "(Optional) List of CIDR blocks; if set, specifies blocks of IP\naddresses which can authenticate successfully, and ties the resulting token to these blocks\nas well.\n" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "(Optional) If set, will encode an\n[explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)\nonto the token in number of seconds. This is a hard cap even if \u003cspan pulumi-lang-nodejs=\"`tokenTtl`\" pulumi-lang-dotnet=\"`TokenTtl`\" pulumi-lang-go=\"`tokenTtl`\" pulumi-lang-python=\"`token_ttl`\" pulumi-lang-yaml=\"`tokenTtl`\" pulumi-lang-java=\"`tokenTtl`\" pulumi-lang-hcl=\"`token_ttl`\"\u003e`tokenTtl`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`tokenMaxTtl`\" pulumi-lang-dotnet=\"`TokenMaxTtl`\" pulumi-lang-go=\"`tokenMaxTtl`\" pulumi-lang-python=\"`token_max_ttl`\" pulumi-lang-yaml=\"`tokenMaxTtl`\" pulumi-lang-java=\"`tokenMaxTtl`\" pulumi-lang-hcl=\"`token_max_ttl`\"\u003e`tokenMaxTtl`\u003c/span\u003e would otherwise allow a renewal.\n" }, "tokenMaxTtl": { "type": "integer", "description": "(Optional) The maximum lifetime for generated tokens in number of seconds.\nIts current value will be referenced at renewal time.\n" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "(Optional) If set, the default policy will not be set on\ngenerated tokens; otherwise it will be added to the policies set in token_policies.\n" }, "tokenNumUses": { "type": "integer", "description": "(Optional) The [maximum number](https://www.vaultproject.io/api-docs/github#token_num_uses)\nof times a generated token may be used (within its lifetime); 0 means unlimited.\n" }, "tokenPeriod": { "type": "integer", "description": "(Optional) If set, indicates that the\ntoken generated using this role should never expire. The token should be renewed within the\nduration specified by this value. At each renewal, the token's TTL will be set to the\nvalue of this field. Specified in seconds.\n" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "(Optional) List of policies to encode onto generated tokens. Depending\non the auth method, this list may be supplemented by user/group/other values.\n" }, "tokenTtl": { "type": "integer", "description": "(Optional) The incremental lifetime for generated tokens in number of seconds.\nIts current value will be referenced at renewal time.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" }, "tune": { "$ref": "#/types/vault:github/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" } }, "required": [ "accessor", "organization", "organizationId", "tune" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "(Optional) The metadata to be tied to generated entity alias.\nThis should be a list or map containing the metadata in key value pairs.\n" }, "baseUrl": { "type": "string", "description": "The API endpoint to use. Useful if you\nare running GitHub Enterprise or an API-compatible authentication server.\n" }, "description": { "type": "string", "description": "Specifies the description of the mount.\nThis overrides the current stored value, if any.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "organization": { "type": "string", "description": "The organization configured users must be part of.\n" }, "organizationId": { "type": "integer", "description": "The ID of the organization users must be part of.\nVault will attempt to fetch and set this value if it is not provided. (Vault 1.10+)\n" }, "path": { "type": "string", "description": "Path where the auth backend is mounted. Defaults to `auth/github`\nif not specified.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "(Optional) List of CIDR blocks; if set, specifies blocks of IP\naddresses which can authenticate successfully, and ties the resulting token to these blocks\nas well.\n" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "(Optional) If set, will encode an\n[explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)\nonto the token in number of seconds. This is a hard cap even if \u003cspan pulumi-lang-nodejs=\"`tokenTtl`\" pulumi-lang-dotnet=\"`TokenTtl`\" pulumi-lang-go=\"`tokenTtl`\" pulumi-lang-python=\"`token_ttl`\" pulumi-lang-yaml=\"`tokenTtl`\" pulumi-lang-java=\"`tokenTtl`\" pulumi-lang-hcl=\"`token_ttl`\"\u003e`tokenTtl`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`tokenMaxTtl`\" pulumi-lang-dotnet=\"`TokenMaxTtl`\" pulumi-lang-go=\"`tokenMaxTtl`\" pulumi-lang-python=\"`token_max_ttl`\" pulumi-lang-yaml=\"`tokenMaxTtl`\" pulumi-lang-java=\"`tokenMaxTtl`\" pulumi-lang-hcl=\"`token_max_ttl`\"\u003e`tokenMaxTtl`\u003c/span\u003e would otherwise allow a renewal.\n" }, "tokenMaxTtl": { "type": "integer", "description": "(Optional) The maximum lifetime for generated tokens in number of seconds.\nIts current value will be referenced at renewal time.\n" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "(Optional) If set, the default policy will not be set on\ngenerated tokens; otherwise it will be added to the policies set in token_policies.\n" }, "tokenNumUses": { "type": "integer", "description": "(Optional) The [maximum number](https://www.vaultproject.io/api-docs/github#token_num_uses)\nof times a generated token may be used (within its lifetime); 0 means unlimited.\n" }, "tokenPeriod": { "type": "integer", "description": "(Optional) If set, indicates that the\ntoken generated using this role should never expire. The token should be renewed within the\nduration specified by this value. At each renewal, the token's TTL will be set to the\nvalue of this field. Specified in seconds.\n" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "(Optional) List of policies to encode onto generated tokens. Depending\non the auth method, this list may be supplemented by user/group/other values.\n" }, "tokenTtl": { "type": "integer", "description": "(Optional) The incremental lifetime for generated tokens in number of seconds.\nIts current value will be referenced at renewal time.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" }, "tune": { "$ref": "#/types/vault:github/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" } }, "requiredInputs": [ "organization" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).\n" }, "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "(Optional) The metadata to be tied to generated entity alias.\nThis should be a list or map containing the metadata in key value pairs.\n" }, "baseUrl": { "type": "string", "description": "The API endpoint to use. Useful if you\nare running GitHub Enterprise or an API-compatible authentication server.\n" }, "description": { "type": "string", "description": "Specifies the description of the mount.\nThis overrides the current stored value, if any.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "organization": { "type": "string", "description": "The organization configured users must be part of.\n" }, "organizationId": { "type": "integer", "description": "The ID of the organization users must be part of.\nVault will attempt to fetch and set this value if it is not provided. (Vault 1.10+)\n" }, "path": { "type": "string", "description": "Path where the auth backend is mounted. Defaults to `auth/github`\nif not specified.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "(Optional) List of CIDR blocks; if set, specifies blocks of IP\naddresses which can authenticate successfully, and ties the resulting token to these blocks\nas well.\n" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "(Optional) If set, will encode an\n[explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)\nonto the token in number of seconds. This is a hard cap even if \u003cspan pulumi-lang-nodejs=\"`tokenTtl`\" pulumi-lang-dotnet=\"`TokenTtl`\" pulumi-lang-go=\"`tokenTtl`\" pulumi-lang-python=\"`token_ttl`\" pulumi-lang-yaml=\"`tokenTtl`\" pulumi-lang-java=\"`tokenTtl`\" pulumi-lang-hcl=\"`token_ttl`\"\u003e`tokenTtl`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`tokenMaxTtl`\" pulumi-lang-dotnet=\"`TokenMaxTtl`\" pulumi-lang-go=\"`tokenMaxTtl`\" pulumi-lang-python=\"`token_max_ttl`\" pulumi-lang-yaml=\"`tokenMaxTtl`\" pulumi-lang-java=\"`tokenMaxTtl`\" pulumi-lang-hcl=\"`token_max_ttl`\"\u003e`tokenMaxTtl`\u003c/span\u003e would otherwise allow a renewal.\n" }, "tokenMaxTtl": { "type": "integer", "description": "(Optional) The maximum lifetime for generated tokens in number of seconds.\nIts current value will be referenced at renewal time.\n" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "(Optional) If set, the default policy will not be set on\ngenerated tokens; otherwise it will be added to the policies set in token_policies.\n" }, "tokenNumUses": { "type": "integer", "description": "(Optional) The [maximum number](https://www.vaultproject.io/api-docs/github#token_num_uses)\nof times a generated token may be used (within its lifetime); 0 means unlimited.\n" }, "tokenPeriod": { "type": "integer", "description": "(Optional) If set, indicates that the\ntoken generated using this role should never expire. The token should be renewed within the\nduration specified by this value. At each renewal, the token's TTL will be set to the\nvalue of this field. Specified in seconds.\n" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "(Optional) List of policies to encode onto generated tokens. Depending\non the auth method, this list may be supplemented by user/group/other values.\n" }, "tokenTtl": { "type": "integer", "description": "(Optional) The incremental lifetime for generated tokens in number of seconds.\nIts current value will be referenced at renewal time.\n" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" }, "tune": { "$ref": "#/types/vault:github/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" } }, "type": "object" } }, "vault:github/team:Team": { "description": "Manages policy mappings for Github Teams authenticated via Github. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/github/) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.github.AuthBackend(\"example\", {organization: \"myorg\"});\nconst tfDevs = new vault.github.Team(\"tf_devs\", {\n backend: example.id,\n team: \"terraform-developers\",\n policies: [\n \"developer\",\n \"read-only\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.github.AuthBackend(\"example\", organization=\"myorg\")\ntf_devs = vault.github.Team(\"tf_devs\",\n backend=example.id,\n team=\"terraform-developers\",\n policies=[\n \"developer\",\n \"read-only\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.GitHub.AuthBackend(\"example\", new()\n {\n Organization = \"myorg\",\n });\n\n var tfDevs = new Vault.GitHub.Team(\"tf_devs\", new()\n {\n Backend = example.Id,\n TeamCity = \"terraform-developers\",\n Policies = new[]\n {\n \"developer\",\n \"read-only\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/github\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := github.NewAuthBackend(ctx, \"example\", \u0026github.AuthBackendArgs{\n\t\t\tOrganization: pulumi.String(\"myorg\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = github.NewTeam(ctx, \"tf_devs\", \u0026github.TeamArgs{\n\t\t\tBackend: example.ID().ToIDOutput().ToStringOutput(),\n\t\t\tTeam: pulumi.String(\"terraform-developers\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"developer\"),\n\t\t\t\tpulumi.String(\"read-only\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_github_authbackend\" \"example\" {\n organization = \"myorg\"\n}\nresource \"vault_github_team\" \"tf_devs\" {\n backend = vault_github_authbackend.example.id\n team = \"terraform-developers\"\n policies = [\"developer\", \"read-only\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.github.AuthBackend;\nimport com.pulumi.vault.github.AuthBackendArgs;\nimport com.pulumi.vault.github.Team;\nimport com.pulumi.vault.github.TeamArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .organization(\"myorg\")\n .build());\n\n var tfDevs = new Team(\"tfDevs\", TeamArgs.builder()\n .backend(example.id())\n .team(\"terraform-developers\")\n .policies( \n \"developer\",\n \"read-only\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:github:AuthBackend\n properties:\n organization: myorg\n tfDevs:\n type: vault:github:Team\n name: tf_devs\n properties:\n backend: ${example.id}\n team: terraform-developers\n policies:\n - developer\n - read-only\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nGithub team mappings can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:github/team:Team tf_devs auth/github/map/teams/terraform-developers\n```\n\n", "properties": { "backend": { "type": "string", "description": "Path where the github auth backend is mounted. Defaults to \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e\nif not specified.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "An array of strings specifying the policies to be set on tokens\nissued using this role.\n" }, "team": { "type": "string", "description": "GitHub team name in \"slugified\" format, for example: Terraform\nDevelopers \u003e `terraform-developers`.\n", "language": { "csharp": { "name": "TeamCity" } } } }, "required": [ "team" ], "inputProperties": { "backend": { "type": "string", "description": "Path where the github auth backend is mounted. Defaults to \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e\nif not specified.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "An array of strings specifying the policies to be set on tokens\nissued using this role.\n" }, "team": { "type": "string", "description": "GitHub team name in \"slugified\" format, for example: Terraform\nDevelopers \u003e `terraform-developers`.\n", "language": { "csharp": { "name": "TeamCity" } }, "willReplaceOnChanges": true } }, "requiredInputs": [ "team" ], "stateInputs": { "description": "Input properties used for looking up and filtering Team resources.\n", "properties": { "backend": { "type": "string", "description": "Path where the github auth backend is mounted. Defaults to \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e\nif not specified.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "An array of strings specifying the policies to be set on tokens\nissued using this role.\n" }, "team": { "type": "string", "description": "GitHub team name in \"slugified\" format, for example: Terraform\nDevelopers \u003e `terraform-developers`.\n", "language": { "csharp": { "name": "TeamCity" } }, "willReplaceOnChanges": true } }, "type": "object" } }, "vault:github/user:User": { "description": "Manages policy mappings for Github Users authenticated via Github. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/github/) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.github.AuthBackend(\"example\", {organization: \"myorg\"});\nconst tfUser = new vault.github.User(\"tf_user\", {\n backend: example.id,\n user: \"john.doe\",\n policies: [\n \"developer\",\n \"read-only\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.github.AuthBackend(\"example\", organization=\"myorg\")\ntf_user = vault.github.User(\"tf_user\",\n backend=example.id,\n user=\"john.doe\",\n policies=[\n \"developer\",\n \"read-only\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.GitHub.AuthBackend(\"example\", new()\n {\n Organization = \"myorg\",\n });\n\n var tfUser = new Vault.GitHub.User(\"tf_user\", new()\n {\n Backend = example.Id,\n UserName = \"john.doe\",\n Policies = new[]\n {\n \"developer\",\n \"read-only\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/github\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := github.NewAuthBackend(ctx, \"example\", \u0026github.AuthBackendArgs{\n\t\t\tOrganization: pulumi.String(\"myorg\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = github.NewUser(ctx, \"tf_user\", \u0026github.UserArgs{\n\t\t\tBackend: example.ID().ToIDOutput().ToStringOutput(),\n\t\t\tUser: pulumi.String(\"john.doe\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"developer\"),\n\t\t\t\tpulumi.String(\"read-only\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_github_authbackend\" \"example\" {\n organization = \"myorg\"\n}\nresource \"vault_github_user\" \"tf_user\" {\n backend = vault_github_authbackend.example.id\n user = \"john.doe\"\n policies = [\"developer\", \"read-only\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.github.AuthBackend;\nimport com.pulumi.vault.github.AuthBackendArgs;\nimport com.pulumi.vault.github.User;\nimport com.pulumi.vault.github.UserArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .organization(\"myorg\")\n .build());\n\n var tfUser = new User(\"tfUser\", UserArgs.builder()\n .backend(example.id())\n .user(\"john.doe\")\n .policies( \n \"developer\",\n \"read-only\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:github:AuthBackend\n properties:\n organization: myorg\n tfUser:\n type: vault:github:User\n name: tf_user\n properties:\n backend: ${example.id}\n user: john.doe\n policies:\n - developer\n - read-only\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nGithub user mappings can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:github/user:User tf_user auth/github/map/users/john.doe\n```\n\n", "properties": { "backend": { "type": "string", "description": "Path where the github auth backend is mounted. Defaults to \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e\nif not specified.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "An array of strings specifying the policies to be set on tokens issued\nusing this role.\n" }, "user": { "type": "string", "description": "GitHub user name.\n", "language": { "csharp": { "name": "UserName" } } } }, "required": [ "user" ], "inputProperties": { "backend": { "type": "string", "description": "Path where the github auth backend is mounted. Defaults to \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e\nif not specified.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "An array of strings specifying the policies to be set on tokens issued\nusing this role.\n" }, "user": { "type": "string", "description": "GitHub user name.\n", "language": { "csharp": { "name": "UserName" } }, "willReplaceOnChanges": true } }, "requiredInputs": [ "user" ], "stateInputs": { "description": "Input properties used for looking up and filtering User resources.\n", "properties": { "backend": { "type": "string", "description": "Path where the github auth backend is mounted. Defaults to \u003cspan pulumi-lang-nodejs=\"`github`\" pulumi-lang-dotnet=\"`Github`\" pulumi-lang-go=\"`github`\" pulumi-lang-python=\"`github`\" pulumi-lang-yaml=\"`github`\" pulumi-lang-java=\"`github`\" pulumi-lang-hcl=\"`github`\"\u003e`github`\u003c/span\u003e\nif not specified.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "An array of strings specifying the policies to be set on tokens issued\nusing this role.\n" }, "user": { "type": "string", "description": "GitHub user name.\n", "language": { "csharp": { "name": "UserName" } }, "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/entity:Entity": { "description": "Creates an Identity Entity for Vault. The Identity secrets engine is the identity management solution for Vault. It internally maintains the clients who are recognized by Vault.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.identity.Entity(\"test\", {\n name: \"tester1\",\n policies: [\"test\"],\n metadata: {\n foo: \"bar\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.identity.Entity(\"test\",\n name=\"tester1\",\n policies=[\"test\"],\n metadata={\n \"foo\": \"bar\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Identity.Entity(\"test\", new()\n {\n Name = \"tester1\",\n Policies = new[]\n {\n \"test\",\n },\n Metadata = \n {\n { \"foo\", \"bar\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewEntity(ctx, \"test\", \u0026identity.EntityArgs{\n\t\t\tName: pulumi.String(\"tester1\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"foo\": pulumi.String(\"bar\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_entity\" \"test\" {\n name = \"tester1\"\n policies = [\"test\"]\n metadata = {\n \"foo\" = \"bar\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Entity;\nimport com.pulumi.vault.identity.EntityArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new Entity(\"test\", EntityArgs.builder()\n .name(\"tester1\")\n .policies(\"test\")\n .metadata(Map.of(\"foo\", \"bar\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:identity:Entity\n properties:\n name: tester1\n policies:\n - test\n metadata:\n foo: bar\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nIdentity entity can be imported using the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:identity/entity:Entity test \"ae6f8ued-0f1a-9f6b-2915-1a2be20dc053\"\n```\n\n", "properties": { "disabled": { "type": "boolean", "description": "True/false Is this entity currently disabled. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "externalPolicies": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any policies return from Vault or specified in the resource. You can use \u003cspan pulumi-lang-nodejs=\"`vault.identity.EntityPolicies`\" pulumi-lang-dotnet=\"`vault.identity.EntityPolicies`\" pulumi-lang-go=\"`identity.EntityPolicies`\" pulumi-lang-python=\"`identity.EntityPolicies`\" pulumi-lang-yaml=\"`vault.identity.EntityPolicies`\" pulumi-lang-java=\"`vault.identity.EntityPolicies`\" pulumi-lang-hcl=\"`vault_identity_entity_policies`\"\u003e`vault.identity.EntityPolicies`\u003c/span\u003e to manage policies for this entity in a decoupled manner.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A Map of additional metadata to associate with the user.\n" }, "name": { "type": "string", "description": "Name of the identity entity to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A list of policies to apply to the entity.\n" } }, "required": [ "name" ], "inputProperties": { "disabled": { "type": "boolean", "description": "True/false Is this entity currently disabled. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "externalPolicies": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any policies return from Vault or specified in the resource. You can use \u003cspan pulumi-lang-nodejs=\"`vault.identity.EntityPolicies`\" pulumi-lang-dotnet=\"`vault.identity.EntityPolicies`\" pulumi-lang-go=\"`identity.EntityPolicies`\" pulumi-lang-python=\"`identity.EntityPolicies`\" pulumi-lang-yaml=\"`vault.identity.EntityPolicies`\" pulumi-lang-java=\"`vault.identity.EntityPolicies`\" pulumi-lang-hcl=\"`vault_identity_entity_policies`\"\u003e`vault.identity.EntityPolicies`\u003c/span\u003e to manage policies for this entity in a decoupled manner.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A Map of additional metadata to associate with the user.\n" }, "name": { "type": "string", "description": "Name of the identity entity to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A list of policies to apply to the entity.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering Entity resources.\n", "properties": { "disabled": { "type": "boolean", "description": "True/false Is this entity currently disabled. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "externalPolicies": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any policies return from Vault or specified in the resource. You can use \u003cspan pulumi-lang-nodejs=\"`vault.identity.EntityPolicies`\" pulumi-lang-dotnet=\"`vault.identity.EntityPolicies`\" pulumi-lang-go=\"`identity.EntityPolicies`\" pulumi-lang-python=\"`identity.EntityPolicies`\" pulumi-lang-yaml=\"`vault.identity.EntityPolicies`\" pulumi-lang-java=\"`vault.identity.EntityPolicies`\" pulumi-lang-hcl=\"`vault_identity_entity_policies`\"\u003e`vault.identity.EntityPolicies`\u003c/span\u003e to manage policies for this entity in a decoupled manner.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A Map of additional metadata to associate with the user.\n" }, "name": { "type": "string", "description": "Name of the identity entity to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A list of policies to apply to the entity.\n" } }, "type": "object" } }, "vault:identity/entityAlias:EntityAlias": { "description": "Creates an Identity Entity Alias for Vault. \n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.identity.EntityAlias(\"test\", {\n name: \"user_1\",\n mountAccessor: \"token_1f2bd5\",\n canonicalId: \"49877D63-07AD-4B85-BDA8-B61626C477E8\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.identity.EntityAlias(\"test\",\n name=\"user_1\",\n mount_accessor=\"token_1f2bd5\",\n canonical_id=\"49877D63-07AD-4B85-BDA8-B61626C477E8\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Identity.EntityAlias(\"test\", new()\n {\n Name = \"user_1\",\n MountAccessor = \"token_1f2bd5\",\n CanonicalId = \"49877D63-07AD-4B85-BDA8-B61626C477E8\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewEntityAlias(ctx, \"test\", \u0026identity.EntityAliasArgs{\n\t\t\tName: pulumi.String(\"user_1\"),\n\t\t\tMountAccessor: pulumi.String(\"token_1f2bd5\"),\n\t\t\tCanonicalId: pulumi.String(\"49877D63-07AD-4B85-BDA8-B61626C477E8\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_entityalias\" \"test\" {\n name = \"user_1\"\n mount_accessor = \"token_1f2bd5\"\n canonical_id = \"49877D63-07AD-4B85-BDA8-B61626C477E8\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.EntityAlias;\nimport com.pulumi.vault.identity.EntityAliasArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new EntityAlias(\"test\", EntityAliasArgs.builder()\n .name(\"user_1\")\n .mountAccessor(\"token_1f2bd5\")\n .canonicalId(\"49877D63-07AD-4B85-BDA8-B61626C477E8\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:identity:EntityAlias\n properties:\n name: user_1\n mountAccessor: token_1f2bd5\n canonicalId: 49877D63-07AD-4B85-BDA8-B61626C477E8\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nIdentity entity alias can be imported using the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:identity/entityAlias:EntityAlias test \"3856fb4d-3c91-dcaf-2401-68f446796bfb\"\n```\n\n", "properties": { "canonicalId": { "type": "string", "description": "Entity ID to which this alias belongs to.\n" }, "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom metadata to be associated with this alias.\n" }, "externalId": { "type": "string", "description": "Unique external identifier from the external IdP.\n*Available only for Vault Enterprise*.\n" }, "issuer": { "type": "string", "description": "Issuer name associated with this alias.\n*Available only for Vault Enterprise*.\n" }, "mountAccessor": { "type": "string", "description": "Accessor of the mount to which the alias should belong to.\n" }, "name": { "type": "string", "description": "Name of the alias. Name should be the identifier of the client in the authentication source. For example, if the alias belongs to userpass backend, the name should be a valid username within userpass backend. If alias belongs to GitHub, it should be the GitHub username.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "canonicalId", "mountAccessor", "name" ], "inputProperties": { "canonicalId": { "type": "string", "description": "Entity ID to which this alias belongs to.\n" }, "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom metadata to be associated with this alias.\n" }, "externalId": { "type": "string", "description": "Unique external identifier from the external IdP.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "issuer": { "type": "string", "description": "Issuer name associated with this alias.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "mountAccessor": { "type": "string", "description": "Accessor of the mount to which the alias should belong to.\n" }, "name": { "type": "string", "description": "Name of the alias. Name should be the identifier of the client in the authentication source. For example, if the alias belongs to userpass backend, the name should be a valid username within userpass backend. If alias belongs to GitHub, it should be the GitHub username.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "canonicalId", "mountAccessor" ], "stateInputs": { "description": "Input properties used for looking up and filtering EntityAlias resources.\n", "properties": { "canonicalId": { "type": "string", "description": "Entity ID to which this alias belongs to.\n" }, "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom metadata to be associated with this alias.\n" }, "externalId": { "type": "string", "description": "Unique external identifier from the external IdP.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "issuer": { "type": "string", "description": "Issuer name associated with this alias.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "mountAccessor": { "type": "string", "description": "Accessor of the mount to which the alias should belong to.\n" }, "name": { "type": "string", "description": "Name of the alias. Name should be the identifier of the client in the authentication source. For example, if the alias belongs to userpass backend, the name should be a valid username within userpass backend. If alias belongs to GitHub, it should be the GitHub username.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/entityPolicies:EntityPolicies": { "description": "Manages policies for an Identity Entity for Vault. The [Identity secrets engine](https://www.vaultproject.io/docs/secrets/identity/index.html) is the identity management solution for Vault.\n\n## Example Usage\n\n### Exclusive Policies\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst entity = new vault.identity.Entity(\"entity\", {\n name: \"entity\",\n externalPolicies: true,\n});\nconst policies = new vault.identity.EntityPolicies(\"policies\", {\n policies: [\n \"default\",\n \"test\",\n ],\n exclusive: true,\n entityId: entity.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nentity = vault.identity.Entity(\"entity\",\n name=\"entity\",\n external_policies=True)\npolicies = vault.identity.EntityPolicies(\"policies\",\n policies=[\n \"default\",\n \"test\",\n ],\n exclusive=True,\n entity_id=entity.id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var entity = new Vault.Identity.Entity(\"entity\", new()\n {\n Name = \"entity\",\n ExternalPolicies = true,\n });\n\n var policies = new Vault.Identity.EntityPolicies(\"policies\", new()\n {\n Policies = new[]\n {\n \"default\",\n \"test\",\n },\n Exclusive = true,\n EntityId = entity.Id,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tentity, err := identity.NewEntity(ctx, \"entity\", \u0026identity.EntityArgs{\n\t\t\tName: pulumi.String(\"entity\"),\n\t\t\tExternalPolicies: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewEntityPolicies(ctx, \"policies\", \u0026identity.EntityPoliciesArgs{\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tExclusive: pulumi.Bool(true),\n\t\t\tEntityId: entity.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_entity\" \"entity\" {\n name = \"entity\"\n external_policies = true\n}\nresource \"vault_identity_entitypolicies\" \"policies\" {\n policies = [\"default\", \"test\"]\n exclusive = true\n entity_id = vault_identity_entity.entity.id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Entity;\nimport com.pulumi.vault.identity.EntityArgs;\nimport com.pulumi.vault.identity.EntityPolicies;\nimport com.pulumi.vault.identity.EntityPoliciesArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var entity = new Entity(\"entity\", EntityArgs.builder()\n .name(\"entity\")\n .externalPolicies(true)\n .build());\n\n var policies = new EntityPolicies(\"policies\", EntityPoliciesArgs.builder()\n .policies( \n \"default\",\n \"test\")\n .exclusive(true)\n .entityId(entity.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n entity:\n type: vault:identity:Entity\n properties:\n name: entity\n externalPolicies: true\n policies:\n type: vault:identity:EntityPolicies\n properties:\n policies:\n - default\n - test\n exclusive: true\n entityId: ${entity.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Non-exclusive Policies\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst entity = new vault.identity.Entity(\"entity\", {\n name: \"entity\",\n externalPolicies: true,\n});\nconst _default = new vault.identity.EntityPolicies(\"default\", {\n policies: [\n \"default\",\n \"test\",\n ],\n exclusive: false,\n entityId: entity.id,\n});\nconst others = new vault.identity.EntityPolicies(\"others\", {\n policies: [\"others\"],\n exclusive: false,\n entityId: entity.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nentity = vault.identity.Entity(\"entity\",\n name=\"entity\",\n external_policies=True)\ndefault = vault.identity.EntityPolicies(\"default\",\n policies=[\n \"default\",\n \"test\",\n ],\n exclusive=False,\n entity_id=entity.id)\nothers = vault.identity.EntityPolicies(\"others\",\n policies=[\"others\"],\n exclusive=False,\n entity_id=entity.id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var entity = new Vault.Identity.Entity(\"entity\", new()\n {\n Name = \"entity\",\n ExternalPolicies = true,\n });\n\n var @default = new Vault.Identity.EntityPolicies(\"default\", new()\n {\n Policies = new[]\n {\n \"default\",\n \"test\",\n },\n Exclusive = false,\n EntityId = entity.Id,\n });\n\n var others = new Vault.Identity.EntityPolicies(\"others\", new()\n {\n Policies = new[]\n {\n \"others\",\n },\n Exclusive = false,\n EntityId = entity.Id,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tentity, err := identity.NewEntity(ctx, \"entity\", \u0026identity.EntityArgs{\n\t\t\tName: pulumi.String(\"entity\"),\n\t\t\tExternalPolicies: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewEntityPolicies(ctx, \"default\", \u0026identity.EntityPoliciesArgs{\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tExclusive: pulumi.Bool(false),\n\t\t\tEntityId: entity.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewEntityPolicies(ctx, \"others\", \u0026identity.EntityPoliciesArgs{\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"others\"),\n\t\t\t},\n\t\t\tExclusive: pulumi.Bool(false),\n\t\t\tEntityId: entity.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_entity\" \"entity\" {\n name = \"entity\"\n external_policies = true\n}\nresource \"vault_identity_entitypolicies\" \"default\" {\n policies = [\"default\", \"test\"]\n exclusive = false\n entity_id = vault_identity_entity.entity.id\n}\nresource \"vault_identity_entitypolicies\" \"others\" {\n policies = [\"others\"]\n exclusive = false\n entity_id = vault_identity_entity.entity.id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Entity;\nimport com.pulumi.vault.identity.EntityArgs;\nimport com.pulumi.vault.identity.EntityPolicies;\nimport com.pulumi.vault.identity.EntityPoliciesArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var entity = new Entity(\"entity\", EntityArgs.builder()\n .name(\"entity\")\n .externalPolicies(true)\n .build());\n\n var default_ = new EntityPolicies(\"default\", EntityPoliciesArgs.builder()\n .policies( \n \"default\",\n \"test\")\n .exclusive(false)\n .entityId(entity.id())\n .build());\n\n var others = new EntityPolicies(\"others\", EntityPoliciesArgs.builder()\n .policies(\"others\")\n .exclusive(false)\n .entityId(entity.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n entity:\n type: vault:identity:Entity\n properties:\n name: entity\n externalPolicies: true\n default:\n type: vault:identity:EntityPolicies\n properties:\n policies:\n - default\n - test\n exclusive: false\n entityId: ${entity.id}\n others:\n type: vault:identity:EntityPolicies\n properties:\n policies:\n - others\n exclusive: false\n entityId: ${entity.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "entityId": { "type": "string", "description": "Entity ID to assign policies to.\n" }, "entityName": { "type": "string", "description": "The name of the entity that are assigned the policies.\n" }, "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the policies assigned to the entity and will set it equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the policies specified in the resource are present in the entity. When destroying the resource, the resource will ensure that the policies specified in the resource are removed.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies to assign to the entity\n" } }, "required": [ "entityId", "entityName", "policies" ], "inputProperties": { "entityId": { "type": "string", "description": "Entity ID to assign policies to.\n" }, "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the policies assigned to the entity and will set it equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the policies specified in the resource are present in the entity. When destroying the resource, the resource will ensure that the policies specified in the resource are removed.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies to assign to the entity\n" } }, "requiredInputs": [ "entityId", "policies" ], "stateInputs": { "description": "Input properties used for looking up and filtering EntityPolicies resources.\n", "properties": { "entityId": { "type": "string", "description": "Entity ID to assign policies to.\n" }, "entityName": { "type": "string", "description": "The name of the entity that are assigned the policies.\n" }, "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the policies assigned to the entity and will set it equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the policies specified in the resource are present in the entity. When destroying the resource, the resource will ensure that the policies specified in the resource are removed.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies to assign to the entity\n" } }, "type": "object" } }, "vault:identity/group:Group": { "description": "Creates an Identity Group for Vault. The [Identity secrets engine](https://www.vaultproject.io/docs/secrets/identity/index.html) is the identity management solution for Vault.\n\nA group can contain multiple entities as its members. A group can also have subgroups. Policies set on the group is granted to all members of the group. During request time, when the token's entity ID is being evaluated for the policies that it has access to; along with the policies on the entity itself, policies that are inherited due to group memberships are also granted.\n\n## Example Usage\n\n### Internal Group\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst internal = new vault.identity.Group(\"internal\", {\n name: \"internal\",\n type: \"internal\",\n policies: [\n \"dev\",\n \"test\",\n ],\n metadata: {\n version: \"2\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ninternal = vault.identity.Group(\"internal\",\n name=\"internal\",\n type=\"internal\",\n policies=[\n \"dev\",\n \"test\",\n ],\n metadata={\n \"version\": \"2\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @internal = new Vault.Identity.Group(\"internal\", new()\n {\n Name = \"internal\",\n Type = \"internal\",\n Policies = new[]\n {\n \"dev\",\n \"test\",\n },\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewGroup(ctx, \"internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"internal\" {\n name = \"internal\"\n type = \"internal\"\n policies = [\"dev\", \"test\"]\n metadata = {\n \"version\" = \"2\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var internal = new Group(\"internal\", GroupArgs.builder()\n .name(\"internal\")\n .type(\"internal\")\n .policies( \n \"dev\",\n \"test\")\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n internal:\n type: vault:identity:Group\n properties:\n name: internal\n type: internal\n policies:\n - dev\n - test\n metadata:\n version: '2'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### External Group\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst group = new vault.identity.Group(\"group\", {\n name: \"external\",\n type: \"external\",\n policies: [\"test\"],\n metadata: {\n version: \"1\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ngroup = vault.identity.Group(\"group\",\n name=\"external\",\n type=\"external\",\n policies=[\"test\"],\n metadata={\n \"version\": \"1\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @group = new Vault.Identity.Group(\"group\", new()\n {\n Name = \"external\",\n Type = \"external\",\n Policies = new[]\n {\n \"test\",\n },\n Metadata = \n {\n { \"version\", \"1\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewGroup(ctx, \"group\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"external\"),\n\t\t\tType: pulumi.String(\"external\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"1\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"group\" {\n name = \"external\"\n type = \"external\"\n policies = [\"test\"]\n metadata = {\n \"version\" = \"1\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var group = new Group(\"group\", GroupArgs.builder()\n .name(\"external\")\n .type(\"external\")\n .policies(\"test\")\n .metadata(Map.of(\"version\", \"1\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n group:\n type: vault:identity:Group\n properties:\n name: external\n type: external\n policies:\n - test\n metadata:\n version: '1'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Caveats\n\nIt's important to note that Vault identity groups names are *case-insensitive*. For example the following resources would be equivalent.\nApplying this configuration would result in the provider failing to create one of the identity groups, since the resources share the same \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e.\n\nThis sort of pattern should be avoided:\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst internal = new vault.identity.Group(\"internal\", {\n name: \"internal\",\n type: \"internal\",\n policies: [\n \"dev\",\n \"test\",\n ],\n metadata: {\n version: \"2\",\n },\n});\nconst internalGroup = new vault.identity.Group(\"Internal\", {\n name: \"Internal\",\n type: \"internal\",\n policies: [\n \"dev\",\n \"test\",\n ],\n metadata: {\n version: \"2\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ninternal = vault.identity.Group(\"internal\",\n name=\"internal\",\n type=\"internal\",\n policies=[\n \"dev\",\n \"test\",\n ],\n metadata={\n \"version\": \"2\",\n })\ninternal_group = vault.identity.Group(\"Internal\",\n name=\"Internal\",\n type=\"internal\",\n policies=[\n \"dev\",\n \"test\",\n ],\n metadata={\n \"version\": \"2\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @internal = new Vault.Identity.Group(\"internal\", new()\n {\n Name = \"internal\",\n Type = \"internal\",\n Policies = new[]\n {\n \"dev\",\n \"test\",\n },\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n var internalGroup = new Vault.Identity.Group(\"Internal\", new()\n {\n Name = \"Internal\",\n Type = \"internal\",\n Policies = new[]\n {\n \"dev\",\n \"test\",\n },\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewGroup(ctx, \"internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroup(ctx, \"Internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"Internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"internal\" {\n name = \"internal\"\n type = \"internal\"\n policies = [\"dev\", \"test\"]\n metadata = {\n \"version\" = \"2\"\n }\n}\nresource \"vault_identity_group\" \"Internal\" {\n name = \"Internal\"\n type = \"internal\"\n policies = [\"dev\", \"test\"]\n metadata = {\n \"version\" = \"2\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var internal = new Group(\"internal\", GroupArgs.builder()\n .name(\"internal\")\n .type(\"internal\")\n .policies( \n \"dev\",\n \"test\")\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n var internalGroup = new Group(\"internalGroup\", GroupArgs.builder()\n .name(\"Internal\")\n .type(\"internal\")\n .policies( \n \"dev\",\n \"test\")\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n internal:\n type: vault:identity:Group\n properties:\n name: internal\n type: internal\n policies:\n - dev\n - test\n metadata:\n version: '2'\n internalGroup:\n type: vault:identity:Group\n name: Internal\n properties:\n name: Internal\n type: internal\n policies:\n - dev\n - test\n metadata:\n version: '2'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nIdentity group can be imported using the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:identity/group:Group test 'fcbf1efb-2b69-4209-bed8-811e3475dad3'\n```\n\n", "properties": { "externalMemberEntityIds": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any Entity IDs\nreturned from Vault or specified in the resource. You can use\n\u003cspan pulumi-lang-nodejs=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-dotnet=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-go=\"`identity.GroupMemberEntityIds`\" pulumi-lang-python=\"`identity.GroupMemberEntityIds`\" pulumi-lang-yaml=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-java=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-hcl=\"`vault_identity_group_member_entity_ids`\"\u003e`vault.identity.GroupMemberEntityIds`\u003c/span\u003e to manage Entity IDs for this group in a\ndecoupled manner.\n" }, "externalMemberGroupIds": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any Group IDs\nreturned from Vault or specified in the resource. You can use\n\u003cspan pulumi-lang-nodejs=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-dotnet=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-go=\"`identity.GroupMemberGroupIds`\" pulumi-lang-python=\"`identity.GroupMemberGroupIds`\" pulumi-lang-yaml=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-java=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-hcl=\"`vault_identity_group_member_group_ids`\"\u003e`vault.identity.GroupMemberGroupIds`\u003c/span\u003e to manage Group IDs for this group in a\ndecoupled manner.\n" }, "externalPolicies": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any policies returned from\nVault or specified in the resource. You can use \u003cspan pulumi-lang-nodejs=\"`vault.identity.GroupPolicies`\" pulumi-lang-dotnet=\"`vault.identity.GroupPolicies`\" pulumi-lang-go=\"`identity.GroupPolicies`\" pulumi-lang-python=\"`identity.GroupPolicies`\" pulumi-lang-yaml=\"`vault.identity.GroupPolicies`\" pulumi-lang-java=\"`vault.identity.GroupPolicies`\" pulumi-lang-hcl=\"`vault_identity_group_policies`\"\u003e`vault.identity.GroupPolicies`\u003c/span\u003e to manage\npolicies for this group in a decoupled manner.\n" }, "memberEntityIds": { "type": "array", "items": { "type": "string" }, "description": "A list of Entity IDs to be assigned as group members. Not allowed on \u003cspan pulumi-lang-nodejs=\"`external`\" pulumi-lang-dotnet=\"`External`\" pulumi-lang-go=\"`external`\" pulumi-lang-python=\"`external`\" pulumi-lang-yaml=\"`external`\" pulumi-lang-java=\"`external`\" pulumi-lang-hcl=\"`external`\"\u003e`external`\u003c/span\u003e groups.\n" }, "memberGroupIds": { "type": "array", "items": { "type": "string" }, "description": "A list of Group IDs to be assigned as group members. Not allowed on \u003cspan pulumi-lang-nodejs=\"`external`\" pulumi-lang-dotnet=\"`External`\" pulumi-lang-go=\"`external`\" pulumi-lang-python=\"`external`\" pulumi-lang-yaml=\"`external`\" pulumi-lang-java=\"`external`\" pulumi-lang-hcl=\"`external`\"\u003e`external`\u003c/span\u003e groups.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A Map of additional metadata to associate with the group.\n" }, "name": { "type": "string", "description": "Name of the identity group to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A list of policies to apply to the group.\n" }, "type": { "type": "string", "description": "Type of the group, internal or external. Defaults to \u003cspan pulumi-lang-nodejs=\"`internal`\" pulumi-lang-dotnet=\"`Internal`\" pulumi-lang-go=\"`internal`\" pulumi-lang-python=\"`internal`\" pulumi-lang-yaml=\"`internal`\" pulumi-lang-java=\"`internal`\" pulumi-lang-hcl=\"`internal`\"\u003e`internal`\u003c/span\u003e.\n" } }, "required": [ "name" ], "inputProperties": { "externalMemberEntityIds": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any Entity IDs\nreturned from Vault or specified in the resource. You can use\n\u003cspan pulumi-lang-nodejs=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-dotnet=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-go=\"`identity.GroupMemberEntityIds`\" pulumi-lang-python=\"`identity.GroupMemberEntityIds`\" pulumi-lang-yaml=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-java=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-hcl=\"`vault_identity_group_member_entity_ids`\"\u003e`vault.identity.GroupMemberEntityIds`\u003c/span\u003e to manage Entity IDs for this group in a\ndecoupled manner.\n" }, "externalMemberGroupIds": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any Group IDs\nreturned from Vault or specified in the resource. You can use\n\u003cspan pulumi-lang-nodejs=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-dotnet=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-go=\"`identity.GroupMemberGroupIds`\" pulumi-lang-python=\"`identity.GroupMemberGroupIds`\" pulumi-lang-yaml=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-java=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-hcl=\"`vault_identity_group_member_group_ids`\"\u003e`vault.identity.GroupMemberGroupIds`\u003c/span\u003e to manage Group IDs for this group in a\ndecoupled manner.\n" }, "externalPolicies": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any policies returned from\nVault or specified in the resource. You can use \u003cspan pulumi-lang-nodejs=\"`vault.identity.GroupPolicies`\" pulumi-lang-dotnet=\"`vault.identity.GroupPolicies`\" pulumi-lang-go=\"`identity.GroupPolicies`\" pulumi-lang-python=\"`identity.GroupPolicies`\" pulumi-lang-yaml=\"`vault.identity.GroupPolicies`\" pulumi-lang-java=\"`vault.identity.GroupPolicies`\" pulumi-lang-hcl=\"`vault_identity_group_policies`\"\u003e`vault.identity.GroupPolicies`\u003c/span\u003e to manage\npolicies for this group in a decoupled manner.\n" }, "memberEntityIds": { "type": "array", "items": { "type": "string" }, "description": "A list of Entity IDs to be assigned as group members. Not allowed on \u003cspan pulumi-lang-nodejs=\"`external`\" pulumi-lang-dotnet=\"`External`\" pulumi-lang-go=\"`external`\" pulumi-lang-python=\"`external`\" pulumi-lang-yaml=\"`external`\" pulumi-lang-java=\"`external`\" pulumi-lang-hcl=\"`external`\"\u003e`external`\u003c/span\u003e groups.\n" }, "memberGroupIds": { "type": "array", "items": { "type": "string" }, "description": "A list of Group IDs to be assigned as group members. Not allowed on \u003cspan pulumi-lang-nodejs=\"`external`\" pulumi-lang-dotnet=\"`External`\" pulumi-lang-go=\"`external`\" pulumi-lang-python=\"`external`\" pulumi-lang-yaml=\"`external`\" pulumi-lang-java=\"`external`\" pulumi-lang-hcl=\"`external`\"\u003e`external`\u003c/span\u003e groups.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A Map of additional metadata to associate with the group.\n" }, "name": { "type": "string", "description": "Name of the identity group to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A list of policies to apply to the group.\n" }, "type": { "type": "string", "description": "Type of the group, internal or external. Defaults to \u003cspan pulumi-lang-nodejs=\"`internal`\" pulumi-lang-dotnet=\"`Internal`\" pulumi-lang-go=\"`internal`\" pulumi-lang-python=\"`internal`\" pulumi-lang-yaml=\"`internal`\" pulumi-lang-java=\"`internal`\" pulumi-lang-hcl=\"`internal`\"\u003e`internal`\u003c/span\u003e.\n", "willReplaceOnChanges": true } }, "stateInputs": { "description": "Input properties used for looking up and filtering Group resources.\n", "properties": { "externalMemberEntityIds": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any Entity IDs\nreturned from Vault or specified in the resource. You can use\n\u003cspan pulumi-lang-nodejs=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-dotnet=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-go=\"`identity.GroupMemberEntityIds`\" pulumi-lang-python=\"`identity.GroupMemberEntityIds`\" pulumi-lang-yaml=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-java=\"`vault.identity.GroupMemberEntityIds`\" pulumi-lang-hcl=\"`vault_identity_group_member_entity_ids`\"\u003e`vault.identity.GroupMemberEntityIds`\u003c/span\u003e to manage Entity IDs for this group in a\ndecoupled manner.\n" }, "externalMemberGroupIds": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any Group IDs\nreturned from Vault or specified in the resource. You can use\n\u003cspan pulumi-lang-nodejs=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-dotnet=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-go=\"`identity.GroupMemberGroupIds`\" pulumi-lang-python=\"`identity.GroupMemberGroupIds`\" pulumi-lang-yaml=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-java=\"`vault.identity.GroupMemberGroupIds`\" pulumi-lang-hcl=\"`vault_identity_group_member_group_ids`\"\u003e`vault.identity.GroupMemberGroupIds`\u003c/span\u003e to manage Group IDs for this group in a\ndecoupled manner.\n" }, "externalPolicies": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e by default. If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will ignore any policies returned from\nVault or specified in the resource. You can use \u003cspan pulumi-lang-nodejs=\"`vault.identity.GroupPolicies`\" pulumi-lang-dotnet=\"`vault.identity.GroupPolicies`\" pulumi-lang-go=\"`identity.GroupPolicies`\" pulumi-lang-python=\"`identity.GroupPolicies`\" pulumi-lang-yaml=\"`vault.identity.GroupPolicies`\" pulumi-lang-java=\"`vault.identity.GroupPolicies`\" pulumi-lang-hcl=\"`vault_identity_group_policies`\"\u003e`vault.identity.GroupPolicies`\u003c/span\u003e to manage\npolicies for this group in a decoupled manner.\n" }, "memberEntityIds": { "type": "array", "items": { "type": "string" }, "description": "A list of Entity IDs to be assigned as group members. Not allowed on \u003cspan pulumi-lang-nodejs=\"`external`\" pulumi-lang-dotnet=\"`External`\" pulumi-lang-go=\"`external`\" pulumi-lang-python=\"`external`\" pulumi-lang-yaml=\"`external`\" pulumi-lang-java=\"`external`\" pulumi-lang-hcl=\"`external`\"\u003e`external`\u003c/span\u003e groups.\n" }, "memberGroupIds": { "type": "array", "items": { "type": "string" }, "description": "A list of Group IDs to be assigned as group members. Not allowed on \u003cspan pulumi-lang-nodejs=\"`external`\" pulumi-lang-dotnet=\"`External`\" pulumi-lang-go=\"`external`\" pulumi-lang-python=\"`external`\" pulumi-lang-yaml=\"`external`\" pulumi-lang-java=\"`external`\" pulumi-lang-hcl=\"`external`\"\u003e`external`\u003c/span\u003e groups.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A Map of additional metadata to associate with the group.\n" }, "name": { "type": "string", "description": "Name of the identity group to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A list of policies to apply to the group.\n" }, "type": { "type": "string", "description": "Type of the group, internal or external. Defaults to \u003cspan pulumi-lang-nodejs=\"`internal`\" pulumi-lang-dotnet=\"`Internal`\" pulumi-lang-go=\"`internal`\" pulumi-lang-python=\"`internal`\" pulumi-lang-yaml=\"`internal`\" pulumi-lang-java=\"`internal`\" pulumi-lang-hcl=\"`internal`\"\u003e`internal`\u003c/span\u003e.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/groupAlias:GroupAlias": { "description": "Creates an Identity Group Alias for Vault. The [Identity secrets engine](https://www.vaultproject.io/docs/secrets/identity/index.html) is the identity management solution for Vault.\n\nGroup aliases allows entity membership in external groups to be managed semi-automatically. External group serves as a mapping to a group that is outside of the identity store. External groups can have one (and only one) alias. This alias should map to a notion of group that is outside of the identity store. For example, groups in LDAP, and teams in GitHub. A username in LDAP, belonging to a group in LDAP, can get its entity ID added as a member of a group in Vault automatically during logins and token renewals. This works only if the group in Vault is an external group and has an alias that maps to the group in LDAP. If the user is removed from the group in LDAP, that change gets reflected in Vault only upon the subsequent login or renewal operation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst group = new vault.identity.Group(\"group\", {\n name: \"test\",\n type: \"external\",\n policies: [\"test\"],\n});\nconst github = new vault.AuthBackend(\"github\", {\n type: \"github\",\n path: \"github\",\n});\nconst group_alias = new vault.identity.GroupAlias(\"group-alias\", {\n name: \"Github_Team_Slug\",\n mountAccessor: github.accessor,\n canonicalId: group.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ngroup = vault.identity.Group(\"group\",\n name=\"test\",\n type=\"external\",\n policies=[\"test\"])\ngithub = vault.AuthBackend(\"github\",\n type=\"github\",\n path=\"github\")\ngroup_alias = vault.identity.GroupAlias(\"group-alias\",\n name=\"Github_Team_Slug\",\n mount_accessor=github.accessor,\n canonical_id=group.id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @group = new Vault.Identity.Group(\"group\", new()\n {\n Name = \"test\",\n Type = \"external\",\n Policies = new[]\n {\n \"test\",\n },\n });\n\n var github = new Vault.AuthBackend(\"github\", new()\n {\n Type = \"github\",\n Path = \"github\",\n });\n\n var group_alias = new Vault.Identity.GroupAlias(\"group-alias\", new()\n {\n Name = \"Github_Team_Slug\",\n MountAccessor = github.Accessor,\n CanonicalId = @group.Id,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tgroup, err := identity.NewGroup(ctx, \"group\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"test\"),\n\t\t\tType: pulumi.String(\"external\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tgithub, err := vault.NewAuthBackend(ctx, \"github\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"github\"),\n\t\t\tPath: pulumi.String(\"github\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroupAlias(ctx, \"group-alias\", \u0026identity.GroupAliasArgs{\n\t\t\tName: pulumi.String(\"Github_Team_Slug\"),\n\t\t\tMountAccessor: github.Accessor,\n\t\t\tCanonicalId: group.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"group\" {\n name = \"test\"\n type = \"external\"\n policies = [\"test\"]\n}\nresource \"vault_authbackend\" \"github\" {\n type = \"github\"\n path = \"github\"\n}\nresource \"vault_identity_groupalias\" \"group-alias\" {\n name = \"Github_Team_Slug\"\n mount_accessor = vault_authbackend.github.accessor\n canonical_id = vault_identity_group.group.id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.identity.GroupAlias;\nimport com.pulumi.vault.identity.GroupAliasArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var group = new Group(\"group\", GroupArgs.builder()\n .name(\"test\")\n .type(\"external\")\n .policies(\"test\")\n .build());\n\n var github = new AuthBackend(\"github\", AuthBackendArgs.builder()\n .type(\"github\")\n .path(\"github\")\n .build());\n\n var group_alias = new GroupAlias(\"group-alias\", GroupAliasArgs.builder()\n .name(\"Github_Team_Slug\")\n .mountAccessor(github.accessor())\n .canonicalId(group.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n group:\n type: vault:identity:Group\n properties:\n name: test\n type: external\n policies:\n - test\n github:\n type: vault:AuthBackend\n properties:\n type: github\n path: github\n group-alias:\n type: vault:identity:GroupAlias\n properties:\n name: Github_Team_Slug\n mountAccessor: ${github.accessor}\n canonicalId: ${group.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe group alias can be imported with the group alias \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e, for example:\n\n```sh\n$ pulumi import vault:identity/groupAlias:GroupAlias group-alias id\n```\n\nGroup aliases can also be imported using the UUID of the alias record, e.g.\n\n```sh\n$ pulumi import vault:identity/groupAlias:GroupAlias alias_name 63104e20-88e4-11eb-8d04-cf7ac9d60157\n```\n\n", "properties": { "canonicalId": { "type": "string", "description": "ID of the group to which this is an alias.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor of the authentication backend to which this alias belongs to.\n" }, "name": { "type": "string", "description": "Name of the group alias to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "canonicalId", "mountAccessor", "name" ], "inputProperties": { "canonicalId": { "type": "string", "description": "ID of the group to which this is an alias.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor of the authentication backend to which this alias belongs to.\n" }, "name": { "type": "string", "description": "Name of the group alias to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "canonicalId", "mountAccessor", "name" ], "stateInputs": { "description": "Input properties used for looking up and filtering GroupAlias resources.\n", "properties": { "canonicalId": { "type": "string", "description": "ID of the group to which this is an alias.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor of the authentication backend to which this alias belongs to.\n" }, "name": { "type": "string", "description": "Name of the group alias to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/groupMemberEntityIds:GroupMemberEntityIds": { "description": "Manages member entities for an Identity Group for Vault. The [Identity secrets engine](https://www.vaultproject.io/docs/secrets/identity/index.html) is the identity management solution for Vault.\n\n## Example Usage\n\n### Exclusive Member Entities\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst internal = new vault.identity.Group(\"internal\", {\n name: \"internal\",\n type: \"internal\",\n externalMemberEntityIds: true,\n metadata: {\n version: \"2\",\n },\n});\nconst user = new vault.identity.Entity(\"user\", {name: \"user\"});\nconst members = new vault.identity.GroupMemberEntityIds(\"members\", {\n exclusive: true,\n memberEntityIds: [user.id],\n groupId: internal.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ninternal = vault.identity.Group(\"internal\",\n name=\"internal\",\n type=\"internal\",\n external_member_entity_ids=True,\n metadata={\n \"version\": \"2\",\n })\nuser = vault.identity.Entity(\"user\", name=\"user\")\nmembers = vault.identity.GroupMemberEntityIds(\"members\",\n exclusive=True,\n member_entity_ids=[user.id],\n group_id=internal.id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @internal = new Vault.Identity.Group(\"internal\", new()\n {\n Name = \"internal\",\n Type = \"internal\",\n ExternalMemberEntityIds = true,\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n var user = new Vault.Identity.Entity(\"user\", new()\n {\n Name = \"user\",\n });\n\n var members = new Vault.Identity.GroupMemberEntityIds(\"members\", new()\n {\n Exclusive = true,\n MemberEntityIds = new[]\n {\n user.Id,\n },\n GroupId = @internal.Id,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinternal, err := identity.NewGroup(ctx, \"internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tExternalMemberEntityIds: pulumi.Bool(true),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tuser, err := identity.NewEntity(ctx, \"user\", \u0026identity.EntityArgs{\n\t\t\tName: pulumi.String(\"user\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroupMemberEntityIds(ctx, \"members\", \u0026identity.GroupMemberEntityIdsArgs{\n\t\t\tExclusive: pulumi.Bool(true),\n\t\t\tMemberEntityIds: pulumi.StringArray{\n\t\t\t\tuser.ID().ToIDOutput().ToStringOutput(),\n\t\t\t},\n\t\t\tGroupId: internal.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"internal\" {\n name = \"internal\"\n type = \"internal\"\n external_member_entity_ids = true\n metadata = {\n \"version\" = \"2\"\n }\n}\nresource \"vault_identity_entity\" \"user\" {\n name = \"user\"\n}\nresource \"vault_identity_groupmemberentityids\" \"members\" {\n exclusive = true\n member_entity_ids = [vault_identity_entity.user.id]\n group_id = vault_identity_group.internal.id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport com.pulumi.vault.identity.Entity;\nimport com.pulumi.vault.identity.EntityArgs;\nimport com.pulumi.vault.identity.GroupMemberEntityIds;\nimport com.pulumi.vault.identity.GroupMemberEntityIdsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var internal = new Group(\"internal\", GroupArgs.builder()\n .name(\"internal\")\n .type(\"internal\")\n .externalMemberEntityIds(true)\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n var user = new Entity(\"user\", EntityArgs.builder()\n .name(\"user\")\n .build());\n\n var members = new GroupMemberEntityIds(\"members\", GroupMemberEntityIdsArgs.builder()\n .exclusive(true)\n .memberEntityIds(user.id())\n .groupId(internal.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n internal:\n type: vault:identity:Group\n properties:\n name: internal\n type: internal\n externalMemberEntityIds: true\n metadata:\n version: '2'\n user:\n type: vault:identity:Entity\n properties:\n name: user\n members:\n type: vault:identity:GroupMemberEntityIds\n properties:\n exclusive: true\n memberEntityIds:\n - ${user.id}\n groupId: ${internal.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Non-exclusive Member Entities\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst internal = new vault.identity.Group(\"internal\", {\n name: \"internal\",\n type: \"internal\",\n externalMemberEntityIds: true,\n metadata: {\n version: \"2\",\n },\n});\nconst testUser = new vault.identity.Entity(\"test_user\", {name: \"test\"});\nconst secondTestUser = new vault.identity.Entity(\"second_test_user\", {name: \"second_test\"});\nconst devUser = new vault.identity.Entity(\"dev_user\", {name: \"dev\"});\nconst test = new vault.identity.GroupMemberEntityIds(\"test\", {\n memberEntityIds: [\n testUser.id,\n secondTestUser.id,\n ],\n exclusive: false,\n groupId: internal.id,\n});\nconst others = new vault.identity.GroupMemberEntityIds(\"others\", {\n memberEntityIds: [devUser.id],\n exclusive: false,\n groupId: internal.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ninternal = vault.identity.Group(\"internal\",\n name=\"internal\",\n type=\"internal\",\n external_member_entity_ids=True,\n metadata={\n \"version\": \"2\",\n })\ntest_user = vault.identity.Entity(\"test_user\", name=\"test\")\nsecond_test_user = vault.identity.Entity(\"second_test_user\", name=\"second_test\")\ndev_user = vault.identity.Entity(\"dev_user\", name=\"dev\")\ntest = vault.identity.GroupMemberEntityIds(\"test\",\n member_entity_ids=[\n test_user.id,\n second_test_user.id,\n ],\n exclusive=False,\n group_id=internal.id)\nothers = vault.identity.GroupMemberEntityIds(\"others\",\n member_entity_ids=[dev_user.id],\n exclusive=False,\n group_id=internal.id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @internal = new Vault.Identity.Group(\"internal\", new()\n {\n Name = \"internal\",\n Type = \"internal\",\n ExternalMemberEntityIds = true,\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n var testUser = new Vault.Identity.Entity(\"test_user\", new()\n {\n Name = \"test\",\n });\n\n var secondTestUser = new Vault.Identity.Entity(\"second_test_user\", new()\n {\n Name = \"second_test\",\n });\n\n var devUser = new Vault.Identity.Entity(\"dev_user\", new()\n {\n Name = \"dev\",\n });\n\n var test = new Vault.Identity.GroupMemberEntityIds(\"test\", new()\n {\n MemberEntityIds = new[]\n {\n testUser.Id,\n secondTestUser.Id,\n },\n Exclusive = false,\n GroupId = @internal.Id,\n });\n\n var others = new Vault.Identity.GroupMemberEntityIds(\"others\", new()\n {\n MemberEntityIds = new[]\n {\n devUser.Id,\n },\n Exclusive = false,\n GroupId = @internal.Id,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinternal, err := identity.NewGroup(ctx, \"internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tExternalMemberEntityIds: pulumi.Bool(true),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttestUser, err := identity.NewEntity(ctx, \"test_user\", \u0026identity.EntityArgs{\n\t\t\tName: pulumi.String(\"test\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tsecondTestUser, err := identity.NewEntity(ctx, \"second_test_user\", \u0026identity.EntityArgs{\n\t\t\tName: pulumi.String(\"second_test\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdevUser, err := identity.NewEntity(ctx, \"dev_user\", \u0026identity.EntityArgs{\n\t\t\tName: pulumi.String(\"dev\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroupMemberEntityIds(ctx, \"test\", \u0026identity.GroupMemberEntityIdsArgs{\n\t\t\tMemberEntityIds: pulumi.StringArray{\n\t\t\t\ttestUser.ID().ToIDOutput().ToStringOutput(),\n\t\t\t\tsecondTestUser.ID().ToIDOutput().ToStringOutput(),\n\t\t\t},\n\t\t\tExclusive: pulumi.Bool(false),\n\t\t\tGroupId: internal.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroupMemberEntityIds(ctx, \"others\", \u0026identity.GroupMemberEntityIdsArgs{\n\t\t\tMemberEntityIds: pulumi.StringArray{\n\t\t\t\tdevUser.ID().ToIDOutput().ToStringOutput(),\n\t\t\t},\n\t\t\tExclusive: pulumi.Bool(false),\n\t\t\tGroupId: internal.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"internal\" {\n name = \"internal\"\n type = \"internal\"\n external_member_entity_ids = true\n metadata = {\n \"version\" = \"2\"\n }\n}\nresource \"vault_identity_entity\" \"test_user\" {\n name = \"test\"\n}\nresource \"vault_identity_entity\" \"second_test_user\" {\n name = \"second_test\"\n}\nresource \"vault_identity_entity\" \"dev_user\" {\n name = \"dev\"\n}\nresource \"vault_identity_groupmemberentityids\" \"test\" {\n member_entity_ids = [vault_identity_entity.test_user.id, vault_identity_entity.second_test_user.id]\n exclusive = false\n group_id = vault_identity_group.internal.id\n}\nresource \"vault_identity_groupmemberentityids\" \"others\" {\n member_entity_ids = [vault_identity_entity.dev_user.id]\n exclusive = false\n group_id = vault_identity_group.internal.id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport com.pulumi.vault.identity.Entity;\nimport com.pulumi.vault.identity.EntityArgs;\nimport com.pulumi.vault.identity.GroupMemberEntityIds;\nimport com.pulumi.vault.identity.GroupMemberEntityIdsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var internal = new Group(\"internal\", GroupArgs.builder()\n .name(\"internal\")\n .type(\"internal\")\n .externalMemberEntityIds(true)\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n var testUser = new Entity(\"testUser\", EntityArgs.builder()\n .name(\"test\")\n .build());\n\n var secondTestUser = new Entity(\"secondTestUser\", EntityArgs.builder()\n .name(\"second_test\")\n .build());\n\n var devUser = new Entity(\"devUser\", EntityArgs.builder()\n .name(\"dev\")\n .build());\n\n var test = new GroupMemberEntityIds(\"test\", GroupMemberEntityIdsArgs.builder()\n .memberEntityIds( \n testUser.id(),\n secondTestUser.id())\n .exclusive(false)\n .groupId(internal.id())\n .build());\n\n var others = new GroupMemberEntityIds(\"others\", GroupMemberEntityIdsArgs.builder()\n .memberEntityIds(devUser.id())\n .exclusive(false)\n .groupId(internal.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n internal:\n type: vault:identity:Group\n properties:\n name: internal\n type: internal\n externalMemberEntityIds: true\n metadata:\n version: '2'\n testUser:\n type: vault:identity:Entity\n name: test_user\n properties:\n name: test\n secondTestUser:\n type: vault:identity:Entity\n name: second_test_user\n properties:\n name: second_test\n devUser:\n type: vault:identity:Entity\n name: dev_user\n properties:\n name: dev\n test:\n type: vault:identity:GroupMemberEntityIds\n properties:\n memberEntityIds:\n - ${testUser.id}\n - ${secondTestUser.id}\n exclusive: false\n groupId: ${internal.id}\n others:\n type: vault:identity:GroupMemberEntityIds\n properties:\n memberEntityIds:\n - ${devUser.id}\n exclusive: false\n groupId: ${internal.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the member entities that belong to the group and will set it equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the member entities specified in the resource are present in the group. When destroying the resource, the resource will ensure that the member entities specified in the resource are removed.\n" }, "groupId": { "type": "string", "description": "Group ID to assign member entities to.\n" }, "memberEntityIds": { "type": "array", "items": { "type": "string" }, "description": "List of member entities that belong to the group\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "groupId" ], "inputProperties": { "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the member entities that belong to the group and will set it equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the member entities specified in the resource are present in the group. When destroying the resource, the resource will ensure that the member entities specified in the resource are removed.\n" }, "groupId": { "type": "string", "description": "Group ID to assign member entities to.\n", "willReplaceOnChanges": true }, "memberEntityIds": { "type": "array", "items": { "type": "string" }, "description": "List of member entities that belong to the group\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "groupId" ], "stateInputs": { "description": "Input properties used for looking up and filtering GroupMemberEntityIds resources.\n", "properties": { "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the member entities that belong to the group and will set it equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the member entities specified in the resource are present in the group. When destroying the resource, the resource will ensure that the member entities specified in the resource are removed.\n" }, "groupId": { "type": "string", "description": "Group ID to assign member entities to.\n", "willReplaceOnChanges": true }, "memberEntityIds": { "type": "array", "items": { "type": "string" }, "description": "List of member entities that belong to the group\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/groupMemberGroupIds:GroupMemberGroupIds": { "description": "Manages member groups for an Identity Group for Vault. The\n[Identity secrets engine](https://www.vaultproject.io/docs/secrets/identity/index.html)\nis the identity management solution for Vault.\n\n## Example Usage\n\n### Exclusive Member Groups\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst internal = new vault.identity.Group(\"internal\", {\n name: \"internal\",\n type: \"internal\",\n externalMemberGroupIds: true,\n metadata: {\n version: \"2\",\n },\n});\nconst users = new vault.identity.Group(\"users\", {\n name: \"users\",\n metadata: {\n version: \"2\",\n },\n});\nconst members = new vault.identity.GroupMemberGroupIds(\"members\", {\n exclusive: true,\n memberGroupIds: [users.id],\n groupId: internal.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ninternal = vault.identity.Group(\"internal\",\n name=\"internal\",\n type=\"internal\",\n external_member_group_ids=True,\n metadata={\n \"version\": \"2\",\n })\nusers = vault.identity.Group(\"users\",\n name=\"users\",\n metadata={\n \"version\": \"2\",\n })\nmembers = vault.identity.GroupMemberGroupIds(\"members\",\n exclusive=True,\n member_group_ids=[users.id],\n group_id=internal.id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @internal = new Vault.Identity.Group(\"internal\", new()\n {\n Name = \"internal\",\n Type = \"internal\",\n ExternalMemberGroupIds = true,\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n var users = new Vault.Identity.Group(\"users\", new()\n {\n Name = \"users\",\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n var members = new Vault.Identity.GroupMemberGroupIds(\"members\", new()\n {\n Exclusive = true,\n MemberGroupIds = new[]\n {\n users.Id,\n },\n GroupId = @internal.Id,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinternal, err := identity.NewGroup(ctx, \"internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tExternalMemberGroupIds: pulumi.Bool(true),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tusers, err := identity.NewGroup(ctx, \"users\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"users\"),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroupMemberGroupIds(ctx, \"members\", \u0026identity.GroupMemberGroupIdsArgs{\n\t\t\tExclusive: pulumi.Bool(true),\n\t\t\tMemberGroupIds: pulumi.StringArray{\n\t\t\t\tusers.ID().ToIDOutput().ToStringOutput(),\n\t\t\t},\n\t\t\tGroupId: internal.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"internal\" {\n name = \"internal\"\n type = \"internal\"\n external_member_group_ids = true\n metadata = {\n \"version\" = \"2\"\n }\n}\nresource \"vault_identity_group\" \"users\" {\n name = \"users\"\n metadata = {\n \"version\" = \"2\"\n }\n}\nresource \"vault_identity_groupmembergroupids\" \"members\" {\n exclusive = true\n member_group_ids = [vault_identity_group.users.id]\n group_id = vault_identity_group.internal.id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport com.pulumi.vault.identity.GroupMemberGroupIds;\nimport com.pulumi.vault.identity.GroupMemberGroupIdsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var internal = new Group(\"internal\", GroupArgs.builder()\n .name(\"internal\")\n .type(\"internal\")\n .externalMemberGroupIds(true)\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n var users = new Group(\"users\", GroupArgs.builder()\n .name(\"users\")\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n var members = new GroupMemberGroupIds(\"members\", GroupMemberGroupIdsArgs.builder()\n .exclusive(true)\n .memberGroupIds(users.id())\n .groupId(internal.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n internal:\n type: vault:identity:Group\n properties:\n name: internal\n type: internal\n externalMemberGroupIds: true\n metadata:\n version: '2'\n users:\n type: vault:identity:Group\n properties:\n name: users\n metadata:\n version: '2'\n members:\n type: vault:identity:GroupMemberGroupIds\n properties:\n exclusive: true\n memberGroupIds:\n - ${users.id}\n groupId: ${internal.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Non-Exclusive Member Groups\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst internal = new vault.identity.Group(\"internal\", {\n name: \"internal\",\n type: \"internal\",\n externalMemberGroupIds: true,\n metadata: {\n version: \"2\",\n },\n});\nconst users = new vault.identity.Group(\"users\", {\n name: \"users\",\n metadata: {\n version: \"2\",\n },\n});\nconst members = new vault.identity.GroupMemberGroupIds(\"members\", {\n exclusive: false,\n memberGroupIds: [users.id],\n groupId: internal.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ninternal = vault.identity.Group(\"internal\",\n name=\"internal\",\n type=\"internal\",\n external_member_group_ids=True,\n metadata={\n \"version\": \"2\",\n })\nusers = vault.identity.Group(\"users\",\n name=\"users\",\n metadata={\n \"version\": \"2\",\n })\nmembers = vault.identity.GroupMemberGroupIds(\"members\",\n exclusive=False,\n member_group_ids=[users.id],\n group_id=internal.id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @internal = new Vault.Identity.Group(\"internal\", new()\n {\n Name = \"internal\",\n Type = \"internal\",\n ExternalMemberGroupIds = true,\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n var users = new Vault.Identity.Group(\"users\", new()\n {\n Name = \"users\",\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n var members = new Vault.Identity.GroupMemberGroupIds(\"members\", new()\n {\n Exclusive = false,\n MemberGroupIds = new[]\n {\n users.Id,\n },\n GroupId = @internal.Id,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinternal, err := identity.NewGroup(ctx, \"internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tExternalMemberGroupIds: pulumi.Bool(true),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tusers, err := identity.NewGroup(ctx, \"users\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"users\"),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroupMemberGroupIds(ctx, \"members\", \u0026identity.GroupMemberGroupIdsArgs{\n\t\t\tExclusive: pulumi.Bool(false),\n\t\t\tMemberGroupIds: pulumi.StringArray{\n\t\t\t\tusers.ID().ToIDOutput().ToStringOutput(),\n\t\t\t},\n\t\t\tGroupId: internal.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"internal\" {\n name = \"internal\"\n type = \"internal\"\n external_member_group_ids = true\n metadata = {\n \"version\" = \"2\"\n }\n}\nresource \"vault_identity_group\" \"users\" {\n name = \"users\"\n metadata = {\n \"version\" = \"2\"\n }\n}\nresource \"vault_identity_groupmembergroupids\" \"members\" {\n exclusive = false\n member_group_ids = [vault_identity_group.users.id]\n group_id = vault_identity_group.internal.id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport com.pulumi.vault.identity.GroupMemberGroupIds;\nimport com.pulumi.vault.identity.GroupMemberGroupIdsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var internal = new Group(\"internal\", GroupArgs.builder()\n .name(\"internal\")\n .type(\"internal\")\n .externalMemberGroupIds(true)\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n var users = new Group(\"users\", GroupArgs.builder()\n .name(\"users\")\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n var members = new GroupMemberGroupIds(\"members\", GroupMemberGroupIdsArgs.builder()\n .exclusive(false)\n .memberGroupIds(users.id())\n .groupId(internal.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n internal:\n type: vault:identity:Group\n properties:\n name: internal\n type: internal\n externalMemberGroupIds: true\n metadata:\n version: '2'\n users:\n type: vault:identity:Group\n properties:\n name: users\n metadata:\n version: '2'\n members:\n type: vault:identity:GroupMemberGroupIds\n properties:\n exclusive: false\n memberGroupIds:\n - ${users.id}\n groupId: ${internal.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the member groups that belong to the group and will set\nit equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the member groups specified in the resource are present\nin the group. When destroying the resource, the resource will ensure that the member groups specified in the resource\nare removed.\n" }, "groupId": { "type": "string", "description": "Group ID to assign member entities to.\n" }, "memberGroupIds": { "type": "array", "items": { "type": "string" }, "description": "List of member groups that belong to the group\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "groupId" ], "inputProperties": { "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the member groups that belong to the group and will set\nit equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the member groups specified in the resource are present\nin the group. When destroying the resource, the resource will ensure that the member groups specified in the resource\nare removed.\n" }, "groupId": { "type": "string", "description": "Group ID to assign member entities to.\n", "willReplaceOnChanges": true }, "memberGroupIds": { "type": "array", "items": { "type": "string" }, "description": "List of member groups that belong to the group\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "groupId" ], "stateInputs": { "description": "Input properties used for looking up and filtering GroupMemberGroupIds resources.\n", "properties": { "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the member groups that belong to the group and will set\nit equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the member groups specified in the resource are present\nin the group. When destroying the resource, the resource will ensure that the member groups specified in the resource\nare removed.\n" }, "groupId": { "type": "string", "description": "Group ID to assign member entities to.\n", "willReplaceOnChanges": true }, "memberGroupIds": { "type": "array", "items": { "type": "string" }, "description": "List of member groups that belong to the group\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/groupPolicies:GroupPolicies": { "description": "Manages policies for an Identity Group for Vault. The [Identity secrets engine](https://www.vaultproject.io/docs/secrets/identity/index.html) is the identity management solution for Vault.\n\n## Example Usage\n\n### Exclusive Policies\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst internal = new vault.identity.Group(\"internal\", {\n name: \"internal\",\n type: \"internal\",\n externalPolicies: true,\n metadata: {\n version: \"2\",\n },\n});\nconst policies = new vault.identity.GroupPolicies(\"policies\", {\n policies: [\n \"default\",\n \"test\",\n ],\n exclusive: true,\n groupId: internal.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ninternal = vault.identity.Group(\"internal\",\n name=\"internal\",\n type=\"internal\",\n external_policies=True,\n metadata={\n \"version\": \"2\",\n })\npolicies = vault.identity.GroupPolicies(\"policies\",\n policies=[\n \"default\",\n \"test\",\n ],\n exclusive=True,\n group_id=internal.id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @internal = new Vault.Identity.Group(\"internal\", new()\n {\n Name = \"internal\",\n Type = \"internal\",\n ExternalPolicies = true,\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n var policies = new Vault.Identity.GroupPolicies(\"policies\", new()\n {\n Policies = new[]\n {\n \"default\",\n \"test\",\n },\n Exclusive = true,\n GroupId = @internal.Id,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinternal, err := identity.NewGroup(ctx, \"internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tExternalPolicies: pulumi.Bool(true),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroupPolicies(ctx, \"policies\", \u0026identity.GroupPoliciesArgs{\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tExclusive: pulumi.Bool(true),\n\t\t\tGroupId: internal.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"internal\" {\n name = \"internal\"\n type = \"internal\"\n external_policies = true\n metadata = {\n \"version\" = \"2\"\n }\n}\nresource \"vault_identity_grouppolicies\" \"policies\" {\n policies = [\"default\", \"test\"]\n exclusive = true\n group_id = vault_identity_group.internal.id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport com.pulumi.vault.identity.GroupPolicies;\nimport com.pulumi.vault.identity.GroupPoliciesArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var internal = new Group(\"internal\", GroupArgs.builder()\n .name(\"internal\")\n .type(\"internal\")\n .externalPolicies(true)\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n var policies = new GroupPolicies(\"policies\", GroupPoliciesArgs.builder()\n .policies( \n \"default\",\n \"test\")\n .exclusive(true)\n .groupId(internal.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n internal:\n type: vault:identity:Group\n properties:\n name: internal\n type: internal\n externalPolicies: true\n metadata:\n version: '2'\n policies:\n type: vault:identity:GroupPolicies\n properties:\n policies:\n - default\n - test\n exclusive: true\n groupId: ${internal.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Non-exclusive Policies\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst internal = new vault.identity.Group(\"internal\", {\n name: \"internal\",\n type: \"internal\",\n externalPolicies: true,\n metadata: {\n version: \"2\",\n },\n});\nconst _default = new vault.identity.GroupPolicies(\"default\", {\n policies: [\n \"default\",\n \"test\",\n ],\n exclusive: false,\n groupId: internal.id,\n});\nconst others = new vault.identity.GroupPolicies(\"others\", {\n policies: [\"others\"],\n exclusive: false,\n groupId: internal.id,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ninternal = vault.identity.Group(\"internal\",\n name=\"internal\",\n type=\"internal\",\n external_policies=True,\n metadata={\n \"version\": \"2\",\n })\ndefault = vault.identity.GroupPolicies(\"default\",\n policies=[\n \"default\",\n \"test\",\n ],\n exclusive=False,\n group_id=internal.id)\nothers = vault.identity.GroupPolicies(\"others\",\n policies=[\"others\"],\n exclusive=False,\n group_id=internal.id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @internal = new Vault.Identity.Group(\"internal\", new()\n {\n Name = \"internal\",\n Type = \"internal\",\n ExternalPolicies = true,\n Metadata = \n {\n { \"version\", \"2\" },\n },\n });\n\n var @default = new Vault.Identity.GroupPolicies(\"default\", new()\n {\n Policies = new[]\n {\n \"default\",\n \"test\",\n },\n Exclusive = false,\n GroupId = @internal.Id,\n });\n\n var others = new Vault.Identity.GroupPolicies(\"others\", new()\n {\n Policies = new[]\n {\n \"others\",\n },\n Exclusive = false,\n GroupId = @internal.Id,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinternal, err := identity.NewGroup(ctx, \"internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tExternalPolicies: pulumi.Bool(true),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroupPolicies(ctx, \"default\", \u0026identity.GroupPoliciesArgs{\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t\tExclusive: pulumi.Bool(false),\n\t\t\tGroupId: internal.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewGroupPolicies(ctx, \"others\", \u0026identity.GroupPoliciesArgs{\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"others\"),\n\t\t\t},\n\t\t\tExclusive: pulumi.Bool(false),\n\t\t\tGroupId: internal.ID().ToIDOutput().ToStringOutput(),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"internal\" {\n name = \"internal\"\n type = \"internal\"\n external_policies = true\n metadata = {\n \"version\" = \"2\"\n }\n}\nresource \"vault_identity_grouppolicies\" \"default\" {\n policies = [\"default\", \"test\"]\n exclusive = false\n group_id = vault_identity_group.internal.id\n}\nresource \"vault_identity_grouppolicies\" \"others\" {\n policies = [\"others\"]\n exclusive = false\n group_id = vault_identity_group.internal.id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport com.pulumi.vault.identity.GroupPolicies;\nimport com.pulumi.vault.identity.GroupPoliciesArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var internal = new Group(\"internal\", GroupArgs.builder()\n .name(\"internal\")\n .type(\"internal\")\n .externalPolicies(true)\n .metadata(Map.of(\"version\", \"2\"))\n .build());\n\n var default_ = new GroupPolicies(\"default\", GroupPoliciesArgs.builder()\n .policies( \n \"default\",\n \"test\")\n .exclusive(false)\n .groupId(internal.id())\n .build());\n\n var others = new GroupPolicies(\"others\", GroupPoliciesArgs.builder()\n .policies(\"others\")\n .exclusive(false)\n .groupId(internal.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n internal:\n type: vault:identity:Group\n properties:\n name: internal\n type: internal\n externalPolicies: true\n metadata:\n version: '2'\n default:\n type: vault:identity:GroupPolicies\n properties:\n policies:\n - default\n - test\n exclusive: false\n groupId: ${internal.id}\n others:\n type: vault:identity:GroupPolicies\n properties:\n policies:\n - others\n exclusive: false\n groupId: ${internal.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the policies assigned to the group and will set it equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the policies specified in the resource are present in the group. When destroying the resource, the resource will ensure that the policies specified in the resource are removed.\n" }, "groupId": { "type": "string", "description": "Group ID to assign policies to.\n" }, "groupName": { "type": "string", "description": "The name of the group that are assigned the policies.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies to assign to the group\n" } }, "required": [ "groupId", "groupName", "policies" ], "inputProperties": { "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the policies assigned to the group and will set it equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the policies specified in the resource are present in the group. When destroying the resource, the resource will ensure that the policies specified in the resource are removed.\n" }, "groupId": { "type": "string", "description": "Group ID to assign policies to.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies to assign to the group\n" } }, "requiredInputs": [ "groupId", "policies" ], "stateInputs": { "description": "Input properties used for looking up and filtering GroupPolicies resources.\n", "properties": { "exclusive": { "type": "boolean", "description": "Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n\nIf \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, this resource will take exclusive control of the policies assigned to the group and will set it equal to what is specified in the resource.\n\nIf set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, this resource will simply ensure that the policies specified in the resource are present in the group. When destroying the resource, the resource will ensure that the policies specified in the resource are removed.\n" }, "groupId": { "type": "string", "description": "Group ID to assign policies to.\n" }, "groupName": { "type": "string", "description": "The name of the group that are assigned the policies.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies to assign to the group\n" } }, "type": "object" } }, "vault:identity/mfaDuo:MfaDuo": { "description": "Resource for configuring the duo MFA method.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.identity.MfaDuo(\"example\", {\n apiHostname: \"api-xxxxxxxx.duosecurity.com\",\n secretKey: \"secret-key\",\n integrationKey: \"secret-int-key\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.identity.MfaDuo(\"example\",\n api_hostname=\"api-xxxxxxxx.duosecurity.com\",\n secret_key=\"secret-key\",\n integration_key=\"secret-int-key\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Identity.MfaDuo(\"example\", new()\n {\n ApiHostname = \"api-xxxxxxxx.duosecurity.com\",\n SecretKey = \"secret-key\",\n IntegrationKey = \"secret-int-key\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewMfaDuo(ctx, \"example\", \u0026identity.MfaDuoArgs{\n\t\t\tApiHostname: pulumi.String(\"api-xxxxxxxx.duosecurity.com\"),\n\t\t\tSecretKey: pulumi.String(\"secret-key\"),\n\t\t\tIntegrationKey: pulumi.String(\"secret-int-key\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_mfaduo\" \"example\" {\n api_hostname = \"api-xxxxxxxx.duosecurity.com\"\n secret_key = \"secret-key\"\n integration_key = \"secret-int-key\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.MfaDuo;\nimport com.pulumi.vault.identity.MfaDuoArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new MfaDuo(\"example\", MfaDuoArgs.builder()\n .apiHostname(\"api-xxxxxxxx.duosecurity.com\")\n .secretKey(\"secret-key\")\n .integrationKey(\"secret-int-key\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:identity:MfaDuo\n properties:\n apiHostname: api-xxxxxxxx.duosecurity.com\n secretKey: secret-key\n integrationKey: secret-int-key\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nResource can be imported using its \u003cspan pulumi-lang-nodejs=\"`uuid`\" pulumi-lang-dotnet=\"`Uuid`\" pulumi-lang-go=\"`uuid`\" pulumi-lang-python=\"`uuid`\" pulumi-lang-yaml=\"`uuid`\" pulumi-lang-java=\"`uuid`\" pulumi-lang-hcl=\"`uuid`\"\u003e`uuid`\u003c/span\u003e field, e.g.\n\n```sh\n$ pulumi import vault:identity/mfaDuo:MfaDuo example 0d89c36a-4ff5-4d70-8749-bb6a5598aeec\n```\n\n", "properties": { "apiHostname": { "type": "string", "description": "API hostname for Duo\n" }, "integrationKey": { "type": "string", "description": "Integration key for Duo\n", "secret": true }, "methodId": { "type": "string", "description": "Method ID.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor.\n" }, "name": { "type": "string", "description": "Method name." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n" }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "pushInfo": { "type": "string", "description": "Push information for Duo.\n" }, "secretKey": { "type": "string", "description": "Secret key for Duo\n", "secret": true }, "type": { "type": "string", "description": "MFA type.\n" }, "usePasscode": { "type": "boolean", "description": "Require passcode upon MFA validation.\n" }, "usernameFormat": { "type": "string", "description": "A template string for mapping Identity names to MFA methods.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n" } }, "required": [ "apiHostname", "integrationKey", "methodId", "mountAccessor", "name", "namespaceId", "namespacePath", "secretKey", "type", "uuid" ], "inputProperties": { "apiHostname": { "type": "string", "description": "API hostname for Duo\n" }, "integrationKey": { "type": "string", "description": "Integration key for Duo\n", "secret": true }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true }, "pushInfo": { "type": "string", "description": "Push information for Duo.\n" }, "secretKey": { "type": "string", "description": "Secret key for Duo\n", "secret": true }, "usePasscode": { "type": "boolean", "description": "Require passcode upon MFA validation.\n" }, "usernameFormat": { "type": "string", "description": "A template string for mapping Identity names to MFA methods.\n" } }, "requiredInputs": [ "apiHostname", "integrationKey", "secretKey" ], "stateInputs": { "description": "Input properties used for looking up and filtering MfaDuo resources.\n", "properties": { "apiHostname": { "type": "string", "description": "API hostname for Duo\n" }, "integrationKey": { "type": "string", "description": "Integration key for Duo\n", "secret": true }, "methodId": { "type": "string", "description": "Method ID.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor.\n" }, "name": { "type": "string", "description": "Method name." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "pushInfo": { "type": "string", "description": "Push information for Duo.\n" }, "secretKey": { "type": "string", "description": "Secret key for Duo\n", "secret": true }, "type": { "type": "string", "description": "MFA type.\n" }, "usePasscode": { "type": "boolean", "description": "Require passcode upon MFA validation.\n" }, "usernameFormat": { "type": "string", "description": "A template string for mapping Identity names to MFA methods.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n" } }, "type": "object" } }, "vault:identity/mfaLoginEnforcement:MfaLoginEnforcement": { "description": "Resource for configuring MFA login-enforcement\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.identity.MfaDuo(\"example\", {\n secretKey: \"secret-key\",\n integrationKey: \"int-key\",\n apiHostname: \"foo.baz\",\n pushInfo: \"push-info\",\n});\nconst exampleMfaLoginEnforcement = new vault.identity.MfaLoginEnforcement(\"example\", {\n name: \"default\",\n mfaMethodIds: [example.methodId],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.identity.MfaDuo(\"example\",\n secret_key=\"secret-key\",\n integration_key=\"int-key\",\n api_hostname=\"foo.baz\",\n push_info=\"push-info\")\nexample_mfa_login_enforcement = vault.identity.MfaLoginEnforcement(\"example\",\n name=\"default\",\n mfa_method_ids=[example.method_id])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Identity.MfaDuo(\"example\", new()\n {\n SecretKey = \"secret-key\",\n IntegrationKey = \"int-key\",\n ApiHostname = \"foo.baz\",\n PushInfo = \"push-info\",\n });\n\n var exampleMfaLoginEnforcement = new Vault.Identity.MfaLoginEnforcement(\"example\", new()\n {\n Name = \"default\",\n MfaMethodIds = new[]\n {\n example.MethodId,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := identity.NewMfaDuo(ctx, \"example\", \u0026identity.MfaDuoArgs{\n\t\t\tSecretKey: pulumi.String(\"secret-key\"),\n\t\t\tIntegrationKey: pulumi.String(\"int-key\"),\n\t\t\tApiHostname: pulumi.String(\"foo.baz\"),\n\t\t\tPushInfo: pulumi.String(\"push-info\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewMfaLoginEnforcement(ctx, \"example\", \u0026identity.MfaLoginEnforcementArgs{\n\t\t\tName: pulumi.String(\"default\"),\n\t\t\tMfaMethodIds: pulumi.StringArray{\n\t\t\t\texample.MethodId,\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_mfaduo\" \"example\" {\n secret_key = \"secret-key\"\n integration_key = \"int-key\"\n api_hostname = \"foo.baz\"\n push_info = \"push-info\"\n}\nresource \"vault_identity_mfaloginenforcement\" \"example\" {\n name = \"default\"\n mfa_method_ids = [vault_identity_mfaduo.example.method_id]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.MfaDuo;\nimport com.pulumi.vault.identity.MfaDuoArgs;\nimport com.pulumi.vault.identity.MfaLoginEnforcement;\nimport com.pulumi.vault.identity.MfaLoginEnforcementArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new MfaDuo(\"example\", MfaDuoArgs.builder()\n .secretKey(\"secret-key\")\n .integrationKey(\"int-key\")\n .apiHostname(\"foo.baz\")\n .pushInfo(\"push-info\")\n .build());\n\n var exampleMfaLoginEnforcement = new MfaLoginEnforcement(\"exampleMfaLoginEnforcement\", MfaLoginEnforcementArgs.builder()\n .name(\"default\")\n .mfaMethodIds(example.methodId())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:identity:MfaDuo\n properties:\n secretKey: secret-key\n integrationKey: int-key\n apiHostname: foo.baz\n pushInfo: push-info\n exampleMfaLoginEnforcement:\n type: vault:identity:MfaLoginEnforcement\n name: example\n properties:\n name: default\n mfaMethodIds:\n - ${example.methodId}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nResource can be imported using its \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e field, e.g.\n\n```sh\n$ pulumi import vault:identity/mfaLoginEnforcement:MfaLoginEnforcement example default\n```\n\n", "properties": { "authMethodAccessors": { "type": "array", "items": { "type": "string" }, "description": "Set of auth method accessor IDs.\n" }, "authMethodTypes": { "type": "array", "items": { "type": "string" }, "description": "Set of auth method types.\n" }, "identityEntityIds": { "type": "array", "items": { "type": "string" }, "description": "Set of identity entity IDs.\n" }, "identityGroupIds": { "type": "array", "items": { "type": "string" }, "description": "Set of identity group IDs.\n" }, "mfaMethodIds": { "type": "array", "items": { "type": "string" }, "description": "Set of MFA method UUIDs.\n" }, "name": { "type": "string", "description": "Login enforcement name.\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n" }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n" } }, "required": [ "mfaMethodIds", "name", "namespaceId", "namespacePath", "uuid" ], "inputProperties": { "authMethodAccessors": { "type": "array", "items": { "type": "string" }, "description": "Set of auth method accessor IDs.\n" }, "authMethodTypes": { "type": "array", "items": { "type": "string" }, "description": "Set of auth method types.\n" }, "identityEntityIds": { "type": "array", "items": { "type": "string" }, "description": "Set of identity entity IDs.\n" }, "identityGroupIds": { "type": "array", "items": { "type": "string" }, "description": "Set of identity group IDs.\n" }, "mfaMethodIds": { "type": "array", "items": { "type": "string" }, "description": "Set of MFA method UUIDs.\n" }, "name": { "type": "string", "description": "Login enforcement name.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "mfaMethodIds" ], "stateInputs": { "description": "Input properties used for looking up and filtering MfaLoginEnforcement resources.\n", "properties": { "authMethodAccessors": { "type": "array", "items": { "type": "string" }, "description": "Set of auth method accessor IDs.\n" }, "authMethodTypes": { "type": "array", "items": { "type": "string" }, "description": "Set of auth method types.\n" }, "identityEntityIds": { "type": "array", "items": { "type": "string" }, "description": "Set of identity entity IDs.\n" }, "identityGroupIds": { "type": "array", "items": { "type": "string" }, "description": "Set of identity group IDs.\n" }, "mfaMethodIds": { "type": "array", "items": { "type": "string" }, "description": "Set of MFA method UUIDs.\n" }, "name": { "type": "string", "description": "Login enforcement name.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/mfaOkta:MfaOkta": { "description": "Resource for configuring the okta MFA method.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.identity.MfaOkta(\"example\", {\n orgName: \"org1\",\n apiToken: \"token1\",\n baseUrl: \"qux.baz.com\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.identity.MfaOkta(\"example\",\n org_name=\"org1\",\n api_token=\"token1\",\n base_url=\"qux.baz.com\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Identity.MfaOkta(\"example\", new()\n {\n OrgName = \"org1\",\n ApiToken = \"token1\",\n BaseUrl = \"qux.baz.com\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewMfaOkta(ctx, \"example\", \u0026identity.MfaOktaArgs{\n\t\t\tOrgName: pulumi.String(\"org1\"),\n\t\t\tApiToken: pulumi.String(\"token1\"),\n\t\t\tBaseUrl: pulumi.String(\"qux.baz.com\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_mfaokta\" \"example\" {\n org_name = \"org1\"\n api_token = \"token1\"\n base_url = \"qux.baz.com\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.MfaOkta;\nimport com.pulumi.vault.identity.MfaOktaArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new MfaOkta(\"example\", MfaOktaArgs.builder()\n .orgName(\"org1\")\n .apiToken(\"token1\")\n .baseUrl(\"qux.baz.com\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:identity:MfaOkta\n properties:\n orgName: org1\n apiToken: token1\n baseUrl: qux.baz.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nResource can be imported using its \u003cspan pulumi-lang-nodejs=\"`uuid`\" pulumi-lang-dotnet=\"`Uuid`\" pulumi-lang-go=\"`uuid`\" pulumi-lang-python=\"`uuid`\" pulumi-lang-yaml=\"`uuid`\" pulumi-lang-java=\"`uuid`\" pulumi-lang-hcl=\"`uuid`\"\u003e`uuid`\u003c/span\u003e field, e.g.\n\n```sh\n$ pulumi import vault:identity/mfaOkta:MfaOkta example 0d89c36a-4ff5-4d70-8749-bb6a5598aeec\n```\n\n", "properties": { "apiToken": { "type": "string", "description": "Okta API token.\n", "secret": true }, "baseUrl": { "type": "string", "description": "The base domain to use for API requests.\n" }, "methodId": { "type": "string", "description": "Method ID.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor.\n" }, "name": { "type": "string", "description": "Method name." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n" }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "orgName": { "type": "string", "description": "Name of the organization to be used in the Okta API.\n" }, "primaryEmail": { "type": "boolean", "description": "Only match the primary email for the account.\n" }, "type": { "type": "string", "description": "MFA type.\n" }, "usernameFormat": { "type": "string", "description": "A template string for mapping Identity names to MFA methods.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n" } }, "required": [ "apiToken", "methodId", "mountAccessor", "name", "namespaceId", "namespacePath", "orgName", "type", "uuid" ], "inputProperties": { "apiToken": { "type": "string", "description": "Okta API token.\n", "secret": true }, "baseUrl": { "type": "string", "description": "The base domain to use for API requests.\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true }, "orgName": { "type": "string", "description": "Name of the organization to be used in the Okta API.\n" }, "primaryEmail": { "type": "boolean", "description": "Only match the primary email for the account.\n" }, "usernameFormat": { "type": "string", "description": "A template string for mapping Identity names to MFA methods.\n" } }, "requiredInputs": [ "apiToken", "orgName" ], "stateInputs": { "description": "Input properties used for looking up and filtering MfaOkta resources.\n", "properties": { "apiToken": { "type": "string", "description": "Okta API token.\n", "secret": true }, "baseUrl": { "type": "string", "description": "The base domain to use for API requests.\n" }, "methodId": { "type": "string", "description": "Method ID.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor.\n" }, "name": { "type": "string", "description": "Method name." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "orgName": { "type": "string", "description": "Name of the organization to be used in the Okta API.\n" }, "primaryEmail": { "type": "boolean", "description": "Only match the primary email for the account.\n" }, "type": { "type": "string", "description": "MFA type.\n" }, "usernameFormat": { "type": "string", "description": "A template string for mapping Identity names to MFA methods.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n" } }, "type": "object" } }, "vault:identity/mfaPingid:MfaPingid": { "description": "Resource for configuring the pingid MFA method.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.identity.MfaPingid(\"example\", {settingsFileBase64: \"CnVzZV9iYXNlNjR[...]HBtCg==\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.identity.MfaPingid(\"example\", settings_file_base64=\"CnVzZV9iYXNlNjR[...]HBtCg==\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Identity.MfaPingid(\"example\", new()\n {\n SettingsFileBase64 = \"CnVzZV9iYXNlNjR[...]HBtCg==\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewMfaPingid(ctx, \"example\", \u0026identity.MfaPingidArgs{\n\t\t\tSettingsFileBase64: pulumi.String(\"CnVzZV9iYXNlNjR[...]HBtCg==\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_mfapingid\" \"example\" {\n settings_file_base64 = \"CnVzZV9iYXNlNjR[...]HBtCg==\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.MfaPingid;\nimport com.pulumi.vault.identity.MfaPingidArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new MfaPingid(\"example\", MfaPingidArgs.builder()\n .settingsFileBase64(\"CnVzZV9iYXNlNjR[...]HBtCg==\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:identity:MfaPingid\n properties:\n settingsFileBase64: CnVzZV9iYXNlNjR[...]HBtCg==\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nResource can be imported using its \u003cspan pulumi-lang-nodejs=\"`uuid`\" pulumi-lang-dotnet=\"`Uuid`\" pulumi-lang-go=\"`uuid`\" pulumi-lang-python=\"`uuid`\" pulumi-lang-yaml=\"`uuid`\" pulumi-lang-java=\"`uuid`\" pulumi-lang-hcl=\"`uuid`\"\u003e`uuid`\u003c/span\u003e field, e.g.\n\n```sh\n$ pulumi import vault:identity/mfaPingid:MfaPingid example 0d89c36a-4ff5-4d70-8749-bb6a5598aeec\n```\n\n", "properties": { "adminUrl": { "type": "string", "description": "The admin URL, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n" }, "authenticatorUrl": { "type": "string", "description": "A unique identifier of the organization, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n" }, "idpUrl": { "type": "string", "description": "The IDP URL, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n" }, "methodId": { "type": "string", "description": "Method ID.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor.\n" }, "name": { "type": "string", "description": "Method name." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n" }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "orgAlias": { "type": "string", "description": "The name of the PingID client organization, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n" }, "settingsFileBase64": { "type": "string", "description": "A base64-encoded third-party settings contents as retrieved from PingID's configuration page.\n" }, "type": { "type": "string", "description": "MFA type.\n" }, "useSignature": { "type": "boolean", "description": "Use signature value, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n" }, "usernameFormat": { "type": "string", "description": "A template string for mapping Identity names to MFA methods.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n" } }, "required": [ "adminUrl", "authenticatorUrl", "idpUrl", "methodId", "mountAccessor", "name", "namespaceId", "namespacePath", "orgAlias", "settingsFileBase64", "type", "useSignature", "uuid" ], "inputProperties": { "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true }, "settingsFileBase64": { "type": "string", "description": "A base64-encoded third-party settings contents as retrieved from PingID's configuration page.\n" }, "usernameFormat": { "type": "string", "description": "A template string for mapping Identity names to MFA methods.\n" } }, "requiredInputs": [ "settingsFileBase64" ], "stateInputs": { "description": "Input properties used for looking up and filtering MfaPingid resources.\n", "properties": { "adminUrl": { "type": "string", "description": "The admin URL, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n", "willReplaceOnChanges": true }, "authenticatorUrl": { "type": "string", "description": "A unique identifier of the organization, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n", "willReplaceOnChanges": true }, "idpUrl": { "type": "string", "description": "The IDP URL, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n", "willReplaceOnChanges": true }, "methodId": { "type": "string", "description": "Method ID.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor.\n" }, "name": { "type": "string", "description": "Method name." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "orgAlias": { "type": "string", "description": "The name of the PingID client organization, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n", "willReplaceOnChanges": true }, "settingsFileBase64": { "type": "string", "description": "A base64-encoded third-party settings contents as retrieved from PingID's configuration page.\n" }, "type": { "type": "string", "description": "MFA type.\n" }, "useSignature": { "type": "boolean", "description": "Use signature value, derived from \u003cspan pulumi-lang-nodejs=\"\"settingsFileBase64\"\" pulumi-lang-dotnet=\"\"SettingsFileBase64\"\" pulumi-lang-go=\"\"settingsFileBase64\"\" pulumi-lang-python=\"\"settings_file_base64\"\" pulumi-lang-yaml=\"\"settingsFileBase64\"\" pulumi-lang-java=\"\"settingsFileBase64\"\" pulumi-lang-hcl=\"\"settings_file_base64\"\"\u003e\"settingsFileBase64\"\u003c/span\u003e\n", "willReplaceOnChanges": true }, "usernameFormat": { "type": "string", "description": "A template string for mapping Identity names to MFA methods.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n" } }, "type": "object" } }, "vault:identity/mfaTotp:MfaTotp": { "description": "Resource for configuring the totp MFA method.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.identity.MfaTotp(\"example\", {issuer: \"issuer1\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.identity.MfaTotp(\"example\", issuer=\"issuer1\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Identity.MfaTotp(\"example\", new()\n {\n Issuer = \"issuer1\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewMfaTotp(ctx, \"example\", \u0026identity.MfaTotpArgs{\n\t\t\tIssuer: pulumi.String(\"issuer1\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_mfatotp\" \"example\" {\n issuer = \"issuer1\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.MfaTotp;\nimport com.pulumi.vault.identity.MfaTotpArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new MfaTotp(\"example\", MfaTotpArgs.builder()\n .issuer(\"issuer1\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:identity:MfaTotp\n properties:\n issuer: issuer1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nResource can be imported using its \u003cspan pulumi-lang-nodejs=\"`uuid`\" pulumi-lang-dotnet=\"`Uuid`\" pulumi-lang-go=\"`uuid`\" pulumi-lang-python=\"`uuid`\" pulumi-lang-yaml=\"`uuid`\" pulumi-lang-java=\"`uuid`\" pulumi-lang-hcl=\"`uuid`\"\u003e`uuid`\u003c/span\u003e field, e.g.\n\n```sh\n$ pulumi import vault:identity/mfaTotp:MfaTotp example 0d89c36a-4ff5-4d70-8749-bb6a5598aeec\n```\n\n", "properties": { "algorithm": { "type": "string", "description": "Specifies the hashing algorithm used to generate the TOTP code. Options include SHA1, SHA256, SHA512.\n" }, "digits": { "type": "integer", "description": "The number of digits in the generated TOTP token. This value can either be 6 or 8\n" }, "issuer": { "type": "string", "description": "The name of the key's issuing organization.\n" }, "keySize": { "type": "integer", "description": "Specifies the size in bytes of the generated key.\n" }, "maxValidationAttempts": { "type": "integer", "description": "The maximum number of consecutive failed validation attempts allowed.\n" }, "methodId": { "type": "string", "description": "Method ID.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor.\n" }, "name": { "type": "string", "description": "Method name." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n" }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "period": { "type": "integer", "description": "The length of time in seconds used to generate a counter for the TOTP token calculation.\n" }, "qrSize": { "type": "integer", "description": "The pixel size of the generated square QR code.\n" }, "skew": { "type": "integer", "description": "The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.\n" }, "type": { "type": "string", "description": "MFA type.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n" } }, "required": [ "issuer", "methodId", "mountAccessor", "name", "namespaceId", "namespacePath", "qrSize", "type", "uuid" ], "inputProperties": { "algorithm": { "type": "string", "description": "Specifies the hashing algorithm used to generate the TOTP code. Options include SHA1, SHA256, SHA512.\n" }, "digits": { "type": "integer", "description": "The number of digits in the generated TOTP token. This value can either be 6 or 8\n" }, "issuer": { "type": "string", "description": "The name of the key's issuing organization.\n" }, "keySize": { "type": "integer", "description": "Specifies the size in bytes of the generated key.\n" }, "maxValidationAttempts": { "type": "integer", "description": "The maximum number of consecutive failed validation attempts allowed.\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true }, "period": { "type": "integer", "description": "The length of time in seconds used to generate a counter for the TOTP token calculation.\n" }, "qrSize": { "type": "integer", "description": "The pixel size of the generated square QR code.\n" }, "skew": { "type": "integer", "description": "The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.\n" } }, "requiredInputs": [ "issuer" ], "stateInputs": { "description": "Input properties used for looking up and filtering MfaTotp resources.\n", "properties": { "algorithm": { "type": "string", "description": "Specifies the hashing algorithm used to generate the TOTP code. Options include SHA1, SHA256, SHA512.\n" }, "digits": { "type": "integer", "description": "The number of digits in the generated TOTP token. This value can either be 6 or 8\n" }, "issuer": { "type": "string", "description": "The name of the key's issuing organization.\n" }, "keySize": { "type": "integer", "description": "Specifies the size in bytes of the generated key.\n" }, "maxValidationAttempts": { "type": "integer", "description": "The maximum number of consecutive failed validation attempts allowed.\n" }, "methodId": { "type": "string", "description": "Method ID.\n" }, "mountAccessor": { "type": "string", "description": "Mount accessor.\n" }, "name": { "type": "string", "description": "Method name." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)\n", "willReplaceOnChanges": true }, "namespaceId": { "type": "string", "description": "Method's namespace ID.\n" }, "namespacePath": { "type": "string", "description": "Method's namespace path.\n" }, "period": { "type": "integer", "description": "The length of time in seconds used to generate a counter for the TOTP token calculation.\n" }, "qrSize": { "type": "integer", "description": "The pixel size of the generated square QR code.\n" }, "skew": { "type": "integer", "description": "The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.\n" }, "type": { "type": "string", "description": "MFA type.\n" }, "uuid": { "type": "string", "description": "Resource UUID.\n" } }, "type": "object" } }, "vault:identity/oidc:Oidc": { "description": "Configure the [Identity Tokens Backend](https://www.vaultproject.io/docs/secrets/identity/index.html#identity-tokens).\n\nThe Identity secrets engine is the identity management solution for Vault. It internally maintains\nthe clients who are recognized by Vault.\n\n\u003e **NOTE:** Each Vault server may only have one Identity Tokens Backend configuration. Multiple configurations of the resource against the same Vault server will cause a perpetual difference.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst server = new vault.identity.Oidc(\"server\", {issuer: \"https://www.acme.com\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nserver = vault.identity.Oidc(\"server\", issuer=\"https://www.acme.com\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var server = new Vault.Identity.Oidc(\"server\", new()\n {\n Issuer = \"https://www.acme.com\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewOidc(ctx, \"server\", \u0026identity.OidcArgs{\n\t\t\tIssuer: pulumi.String(\"https://www.acme.com\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_oidc\" \"server\" {\n issuer = \"https://www.acme.com\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Oidc;\nimport com.pulumi.vault.identity.OidcArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var server = new Oidc(\"server\", OidcArgs.builder()\n .issuer(\"https://www.acme.com\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n server:\n type: vault:identity:Oidc\n properties:\n issuer: https://www.acme.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "issuer": { "type": "string", "description": "Issuer URL to be used in the iss claim of the token. If not set, Vault's\n\u003cspan pulumi-lang-nodejs=\"`apiAddr`\" pulumi-lang-dotnet=\"`ApiAddr`\" pulumi-lang-go=\"`apiAddr`\" pulumi-lang-python=\"`api_addr`\" pulumi-lang-yaml=\"`apiAddr`\" pulumi-lang-java=\"`apiAddr`\" pulumi-lang-hcl=\"`api_addr`\"\u003e`apiAddr`\u003c/span\u003e will be used. The issuer is a case sensitive URL using the https scheme that contains\nscheme, host, and optionally, port number and path components, but no query or fragment\ncomponents.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "issuer" ], "inputProperties": { "issuer": { "type": "string", "description": "Issuer URL to be used in the iss claim of the token. If not set, Vault's\n\u003cspan pulumi-lang-nodejs=\"`apiAddr`\" pulumi-lang-dotnet=\"`ApiAddr`\" pulumi-lang-go=\"`apiAddr`\" pulumi-lang-python=\"`api_addr`\" pulumi-lang-yaml=\"`apiAddr`\" pulumi-lang-java=\"`apiAddr`\" pulumi-lang-hcl=\"`api_addr`\"\u003e`apiAddr`\u003c/span\u003e will be used. The issuer is a case sensitive URL using the https scheme that contains\nscheme, host, and optionally, port number and path components, but no query or fragment\ncomponents.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "stateInputs": { "description": "Input properties used for looking up and filtering Oidc resources.\n", "properties": { "issuer": { "type": "string", "description": "Issuer URL to be used in the iss claim of the token. If not set, Vault's\n\u003cspan pulumi-lang-nodejs=\"`apiAddr`\" pulumi-lang-dotnet=\"`ApiAddr`\" pulumi-lang-go=\"`apiAddr`\" pulumi-lang-python=\"`api_addr`\" pulumi-lang-yaml=\"`apiAddr`\" pulumi-lang-java=\"`apiAddr`\" pulumi-lang-hcl=\"`api_addr`\"\u003e`apiAddr`\u003c/span\u003e will be used. The issuer is a case sensitive URL using the https scheme that contains\nscheme, host, and optionally, port number and path components, but no query or fragment\ncomponents.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/oidcAssignment:OidcAssignment": { "description": "Manages OIDC Assignments in a Vault server. See the [Vault documentation](https://www.vaultproject.io/api-docs/secret/identity/oidc-provider#create-or-update-an-assignment)\nfor more information.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst internal = new vault.identity.Group(\"internal\", {\n name: \"internal\",\n type: \"internal\",\n policies: [\n \"dev\",\n \"test\",\n ],\n});\nconst test = new vault.identity.Entity(\"test\", {\n name: \"test\",\n policies: [\"test\"],\n});\nconst _default = new vault.identity.OidcAssignment(\"default\", {\n name: \"assignment\",\n entityIds: [test.id],\n groupIds: [internal.id],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ninternal = vault.identity.Group(\"internal\",\n name=\"internal\",\n type=\"internal\",\n policies=[\n \"dev\",\n \"test\",\n ])\ntest = vault.identity.Entity(\"test\",\n name=\"test\",\n policies=[\"test\"])\ndefault = vault.identity.OidcAssignment(\"default\",\n name=\"assignment\",\n entity_ids=[test.id],\n group_ids=[internal.id])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @internal = new Vault.Identity.Group(\"internal\", new()\n {\n Name = \"internal\",\n Type = \"internal\",\n Policies = new[]\n {\n \"dev\",\n \"test\",\n },\n });\n\n var test = new Vault.Identity.Entity(\"test\", new()\n {\n Name = \"test\",\n Policies = new[]\n {\n \"test\",\n },\n });\n\n var @default = new Vault.Identity.OidcAssignment(\"default\", new()\n {\n Name = \"assignment\",\n EntityIds = new[]\n {\n test.Id,\n },\n GroupIds = new[]\n {\n @internal.Id,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinternal, err := identity.NewGroup(ctx, \"internal\", \u0026identity.GroupArgs{\n\t\t\tName: pulumi.String(\"internal\"),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttest, err := identity.NewEntity(ctx, \"test\", \u0026identity.EntityArgs{\n\t\t\tName: pulumi.String(\"test\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"test\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewOidcAssignment(ctx, \"default\", \u0026identity.OidcAssignmentArgs{\n\t\t\tName: pulumi.String(\"assignment\"),\n\t\t\tEntityIds: pulumi.StringArray{\n\t\t\t\ttest.ID().ToIDOutput().ToStringOutput(),\n\t\t\t},\n\t\t\tGroupIds: pulumi.StringArray{\n\t\t\t\tinternal.ID().ToIDOutput().ToStringOutput(),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_group\" \"internal\" {\n name = \"internal\"\n type = \"internal\"\n policies = [\"dev\", \"test\"]\n}\nresource \"vault_identity_entity\" \"test\" {\n name = \"test\"\n policies = [\"test\"]\n}\nresource \"vault_identity_oidcassignment\" \"default\" {\n name = \"assignment\"\n entity_ids = [vault_identity_entity.test.id]\n group_ids = [vault_identity_group.internal.id]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.Group;\nimport com.pulumi.vault.identity.GroupArgs;\nimport com.pulumi.vault.identity.Entity;\nimport com.pulumi.vault.identity.EntityArgs;\nimport com.pulumi.vault.identity.OidcAssignment;\nimport com.pulumi.vault.identity.OidcAssignmentArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var internal = new Group(\"internal\", GroupArgs.builder()\n .name(\"internal\")\n .type(\"internal\")\n .policies( \n \"dev\",\n \"test\")\n .build());\n\n var test = new Entity(\"test\", EntityArgs.builder()\n .name(\"test\")\n .policies(\"test\")\n .build());\n\n var default_ = new OidcAssignment(\"default\", OidcAssignmentArgs.builder()\n .name(\"assignment\")\n .entityIds(test.id())\n .groupIds(internal.id())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n internal:\n type: vault:identity:Group\n properties:\n name: internal\n type: internal\n policies:\n - dev\n - test\n test:\n type: vault:identity:Entity\n properties:\n name: test\n policies:\n - test\n default:\n type: vault:identity:OidcAssignment\n properties:\n name: assignment\n entityIds:\n - ${test.id}\n groupIds:\n - ${internal.id}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nOIDC Assignments can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:identity/oidcAssignment:OidcAssignment default assignment\n```\n\n", "properties": { "entityIds": { "type": "array", "items": { "type": "string" }, "description": "A set of Vault entity IDs.\n" }, "groupIds": { "type": "array", "items": { "type": "string" }, "description": "A set of Vault group IDs.\n" }, "name": { "type": "string", "description": "The name of the assignment.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "name" ], "inputProperties": { "entityIds": { "type": "array", "items": { "type": "string" }, "description": "A set of Vault entity IDs.\n" }, "groupIds": { "type": "array", "items": { "type": "string" }, "description": "A set of Vault group IDs.\n" }, "name": { "type": "string", "description": "The name of the assignment.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "stateInputs": { "description": "Input properties used for looking up and filtering OidcAssignment resources.\n", "properties": { "entityIds": { "type": "array", "items": { "type": "string" }, "description": "A set of Vault entity IDs.\n" }, "groupIds": { "type": "array", "items": { "type": "string" }, "description": "A set of Vault group IDs.\n" }, "name": { "type": "string", "description": "The name of the assignment.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/oidcClient:OidcClient": { "description": "Manages OIDC Clients in a Vault server. See the [Vault documentation](https://www.vaultproject.io/api-docs/secret/identity/oidc-provider#create-or-update-an-assignment)\nfor more information.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.identity.OidcAssignment(\"test\", {\n name: \"my-assignment\",\n entityIds: [\"ascbascas-2231a-sdfaa\"],\n groupIds: [\"sajkdsad-32414-sfsada\"],\n});\nconst testOidcClient = new vault.identity.OidcClient(\"test\", {\n name: \"my-app\",\n redirectUris: [\n \"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\",\n \"http://127.0.0.1:8251/callback\",\n \"http://127.0.0.1:8080/callback\",\n ],\n assignments: [test.name],\n idTokenTtl: 2400,\n accessTokenTtl: 7200,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.identity.OidcAssignment(\"test\",\n name=\"my-assignment\",\n entity_ids=[\"ascbascas-2231a-sdfaa\"],\n group_ids=[\"sajkdsad-32414-sfsada\"])\ntest_oidc_client = vault.identity.OidcClient(\"test\",\n name=\"my-app\",\n redirect_uris=[\n \"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\",\n \"http://127.0.0.1:8251/callback\",\n \"http://127.0.0.1:8080/callback\",\n ],\n assignments=[test.name],\n id_token_ttl=2400,\n access_token_ttl=7200)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Identity.OidcAssignment(\"test\", new()\n {\n Name = \"my-assignment\",\n EntityIds = new[]\n {\n \"ascbascas-2231a-sdfaa\",\n },\n GroupIds = new[]\n {\n \"sajkdsad-32414-sfsada\",\n },\n });\n\n var testOidcClient = new Vault.Identity.OidcClient(\"test\", new()\n {\n Name = \"my-app\",\n RedirectUris = new[]\n {\n \"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\",\n \"http://127.0.0.1:8251/callback\",\n \"http://127.0.0.1:8080/callback\",\n },\n Assignments = new[]\n {\n test.Name,\n },\n IdTokenTtl = 2400,\n AccessTokenTtl = 7200,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttest, err := identity.NewOidcAssignment(ctx, \"test\", \u0026identity.OidcAssignmentArgs{\n\t\t\tName: pulumi.String(\"my-assignment\"),\n\t\t\tEntityIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"ascbascas-2231a-sdfaa\"),\n\t\t\t},\n\t\t\tGroupIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"sajkdsad-32414-sfsada\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewOidcClient(ctx, \"test\", \u0026identity.OidcClientArgs{\n\t\t\tName: pulumi.String(\"my-app\"),\n\t\t\tRedirectUris: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\"),\n\t\t\t\tpulumi.String(\"http://127.0.0.1:8251/callback\"),\n\t\t\t\tpulumi.String(\"http://127.0.0.1:8080/callback\"),\n\t\t\t},\n\t\t\tAssignments: pulumi.StringArray{\n\t\t\t\ttest.Name,\n\t\t\t},\n\t\t\tIdTokenTtl: pulumi.Int(2400),\n\t\t\tAccessTokenTtl: pulumi.Int(7200),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_oidcassignment\" \"test\" {\n name = \"my-assignment\"\n entity_ids = [\"ascbascas-2231a-sdfaa\"]\n group_ids = [\"sajkdsad-32414-sfsada\"]\n}\nresource \"vault_identity_oidcclient\" \"test\" {\n name = \"my-app\"\n redirect_uris = [\"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\", \"http://127.0.0.1:8251/callback\", \"http://127.0.0.1:8080/callback\"]\n assignments = [vault_identity_oidcassignment.test.name]\n id_token_ttl = 2400\n access_token_ttl = 7200\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.OidcAssignment;\nimport com.pulumi.vault.identity.OidcAssignmentArgs;\nimport com.pulumi.vault.identity.OidcClient;\nimport com.pulumi.vault.identity.OidcClientArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new OidcAssignment(\"test\", OidcAssignmentArgs.builder()\n .name(\"my-assignment\")\n .entityIds(\"ascbascas-2231a-sdfaa\")\n .groupIds(\"sajkdsad-32414-sfsada\")\n .build());\n\n var testOidcClient = new OidcClient(\"testOidcClient\", OidcClientArgs.builder()\n .name(\"my-app\")\n .redirectUris( \n \"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\",\n \"http://127.0.0.1:8251/callback\",\n \"http://127.0.0.1:8080/callback\")\n .assignments(test.name())\n .idTokenTtl(2400)\n .accessTokenTtl(7200)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:identity:OidcAssignment\n properties:\n name: my-assignment\n entityIds:\n - ascbascas-2231a-sdfaa\n groupIds:\n - sajkdsad-32414-sfsada\n testOidcClient:\n type: vault:identity:OidcClient\n name: test\n properties:\n name: my-app\n redirectUris:\n - http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\n - http://127.0.0.1:8251/callback\n - http://127.0.0.1:8080/callback\n assignments:\n - ${test.name}\n idTokenTtl: 2400\n accessTokenTtl: 7200\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nOIDC Clients can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:identity/oidcClient:OidcClient test my-app\n```\n\n", "properties": { "accessTokenTtl": { "type": "integer", "description": "The time-to-live for access tokens obtained by the client.\n" }, "assignments": { "type": "array", "items": { "type": "string" }, "description": "A list of assignment resources associated with the client.\n" }, "clientId": { "type": "string", "description": "The Client ID returned by Vault.\n" }, "clientSecret": { "type": "string", "description": "The Client Secret Key returned by Vault.\nFor public OpenID Clients \u003cspan pulumi-lang-nodejs=\"`clientSecret`\" pulumi-lang-dotnet=\"`ClientSecret`\" pulumi-lang-go=\"`clientSecret`\" pulumi-lang-python=\"`client_secret`\" pulumi-lang-yaml=\"`clientSecret`\" pulumi-lang-java=\"`clientSecret`\" pulumi-lang-hcl=\"`client_secret`\"\u003e`clientSecret`\u003c/span\u003e is set to an empty string `\"\"`\n", "secret": true }, "clientType": { "type": "string", "description": "The client type based on its ability to maintain confidentiality of credentials.\nThe following client types are supported: \u003cspan pulumi-lang-nodejs=\"`confidential`\" pulumi-lang-dotnet=\"`Confidential`\" pulumi-lang-go=\"`confidential`\" pulumi-lang-python=\"`confidential`\" pulumi-lang-yaml=\"`confidential`\" pulumi-lang-java=\"`confidential`\" pulumi-lang-hcl=\"`confidential`\"\u003e`confidential`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`public`\" pulumi-lang-dotnet=\"`Public`\" pulumi-lang-go=\"`public`\" pulumi-lang-python=\"`public`\" pulumi-lang-yaml=\"`public`\" pulumi-lang-java=\"`public`\" pulumi-lang-hcl=\"`public`\"\u003e`public`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`confidential`\" pulumi-lang-dotnet=\"`Confidential`\" pulumi-lang-go=\"`confidential`\" pulumi-lang-python=\"`confidential`\" pulumi-lang-yaml=\"`confidential`\" pulumi-lang-java=\"`confidential`\" pulumi-lang-hcl=\"`confidential`\"\u003e`confidential`\u003c/span\u003e.\n" }, "idTokenTtl": { "type": "integer", "description": "The time-to-live for ID tokens obtained by the client. \nThe value should be less than the \u003cspan pulumi-lang-nodejs=\"`verificationTtl`\" pulumi-lang-dotnet=\"`VerificationTtl`\" pulumi-lang-go=\"`verificationTtl`\" pulumi-lang-python=\"`verification_ttl`\" pulumi-lang-yaml=\"`verificationTtl`\" pulumi-lang-java=\"`verificationTtl`\" pulumi-lang-hcl=\"`verification_ttl`\"\u003e`verificationTtl`\u003c/span\u003e on the key.\n" }, "key": { "type": "string", "description": "A reference to a named key resource in Vault.\nThis cannot be modified after creation. If not provided, the \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e\nkey is used.\n" }, "name": { "type": "string", "description": "The name of the client.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "redirectUris": { "type": "array", "items": { "type": "string" }, "description": "Redirection URI values used by the client. \nOne of these values must exactly match the \u003cspan pulumi-lang-nodejs=\"`redirectUri`\" pulumi-lang-dotnet=\"`RedirectUri`\" pulumi-lang-go=\"`redirectUri`\" pulumi-lang-python=\"`redirect_uri`\" pulumi-lang-yaml=\"`redirectUri`\" pulumi-lang-java=\"`redirectUri`\" pulumi-lang-hcl=\"`redirect_uri`\"\u003e`redirectUri`\u003c/span\u003e parameter value\nused in each authentication request.\n" } }, "required": [ "accessTokenTtl", "clientId", "clientSecret", "clientType", "idTokenTtl", "key", "name" ], "inputProperties": { "accessTokenTtl": { "type": "integer", "description": "The time-to-live for access tokens obtained by the client.\n" }, "assignments": { "type": "array", "items": { "type": "string" }, "description": "A list of assignment resources associated with the client.\n" }, "clientType": { "type": "string", "description": "The client type based on its ability to maintain confidentiality of credentials.\nThe following client types are supported: \u003cspan pulumi-lang-nodejs=\"`confidential`\" pulumi-lang-dotnet=\"`Confidential`\" pulumi-lang-go=\"`confidential`\" pulumi-lang-python=\"`confidential`\" pulumi-lang-yaml=\"`confidential`\" pulumi-lang-java=\"`confidential`\" pulumi-lang-hcl=\"`confidential`\"\u003e`confidential`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`public`\" pulumi-lang-dotnet=\"`Public`\" pulumi-lang-go=\"`public`\" pulumi-lang-python=\"`public`\" pulumi-lang-yaml=\"`public`\" pulumi-lang-java=\"`public`\" pulumi-lang-hcl=\"`public`\"\u003e`public`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`confidential`\" pulumi-lang-dotnet=\"`Confidential`\" pulumi-lang-go=\"`confidential`\" pulumi-lang-python=\"`confidential`\" pulumi-lang-yaml=\"`confidential`\" pulumi-lang-java=\"`confidential`\" pulumi-lang-hcl=\"`confidential`\"\u003e`confidential`\u003c/span\u003e.\n" }, "idTokenTtl": { "type": "integer", "description": "The time-to-live for ID tokens obtained by the client. \nThe value should be less than the \u003cspan pulumi-lang-nodejs=\"`verificationTtl`\" pulumi-lang-dotnet=\"`VerificationTtl`\" pulumi-lang-go=\"`verificationTtl`\" pulumi-lang-python=\"`verification_ttl`\" pulumi-lang-yaml=\"`verificationTtl`\" pulumi-lang-java=\"`verificationTtl`\" pulumi-lang-hcl=\"`verification_ttl`\"\u003e`verificationTtl`\u003c/span\u003e on the key.\n" }, "key": { "type": "string", "description": "A reference to a named key resource in Vault.\nThis cannot be modified after creation. If not provided, the \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e\nkey is used.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "The name of the client.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "redirectUris": { "type": "array", "items": { "type": "string" }, "description": "Redirection URI values used by the client. \nOne of these values must exactly match the \u003cspan pulumi-lang-nodejs=\"`redirectUri`\" pulumi-lang-dotnet=\"`RedirectUri`\" pulumi-lang-go=\"`redirectUri`\" pulumi-lang-python=\"`redirect_uri`\" pulumi-lang-yaml=\"`redirectUri`\" pulumi-lang-java=\"`redirectUri`\" pulumi-lang-hcl=\"`redirect_uri`\"\u003e`redirectUri`\u003c/span\u003e parameter value\nused in each authentication request.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering OidcClient resources.\n", "properties": { "accessTokenTtl": { "type": "integer", "description": "The time-to-live for access tokens obtained by the client.\n" }, "assignments": { "type": "array", "items": { "type": "string" }, "description": "A list of assignment resources associated with the client.\n" }, "clientId": { "type": "string", "description": "The Client ID returned by Vault.\n" }, "clientSecret": { "type": "string", "description": "The Client Secret Key returned by Vault.\nFor public OpenID Clients \u003cspan pulumi-lang-nodejs=\"`clientSecret`\" pulumi-lang-dotnet=\"`ClientSecret`\" pulumi-lang-go=\"`clientSecret`\" pulumi-lang-python=\"`client_secret`\" pulumi-lang-yaml=\"`clientSecret`\" pulumi-lang-java=\"`clientSecret`\" pulumi-lang-hcl=\"`client_secret`\"\u003e`clientSecret`\u003c/span\u003e is set to an empty string `\"\"`\n", "secret": true }, "clientType": { "type": "string", "description": "The client type based on its ability to maintain confidentiality of credentials.\nThe following client types are supported: \u003cspan pulumi-lang-nodejs=\"`confidential`\" pulumi-lang-dotnet=\"`Confidential`\" pulumi-lang-go=\"`confidential`\" pulumi-lang-python=\"`confidential`\" pulumi-lang-yaml=\"`confidential`\" pulumi-lang-java=\"`confidential`\" pulumi-lang-hcl=\"`confidential`\"\u003e`confidential`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`public`\" pulumi-lang-dotnet=\"`Public`\" pulumi-lang-go=\"`public`\" pulumi-lang-python=\"`public`\" pulumi-lang-yaml=\"`public`\" pulumi-lang-java=\"`public`\" pulumi-lang-hcl=\"`public`\"\u003e`public`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`confidential`\" pulumi-lang-dotnet=\"`Confidential`\" pulumi-lang-go=\"`confidential`\" pulumi-lang-python=\"`confidential`\" pulumi-lang-yaml=\"`confidential`\" pulumi-lang-java=\"`confidential`\" pulumi-lang-hcl=\"`confidential`\"\u003e`confidential`\u003c/span\u003e.\n" }, "idTokenTtl": { "type": "integer", "description": "The time-to-live for ID tokens obtained by the client. \nThe value should be less than the \u003cspan pulumi-lang-nodejs=\"`verificationTtl`\" pulumi-lang-dotnet=\"`VerificationTtl`\" pulumi-lang-go=\"`verificationTtl`\" pulumi-lang-python=\"`verification_ttl`\" pulumi-lang-yaml=\"`verificationTtl`\" pulumi-lang-java=\"`verificationTtl`\" pulumi-lang-hcl=\"`verification_ttl`\"\u003e`verificationTtl`\u003c/span\u003e on the key.\n" }, "key": { "type": "string", "description": "A reference to a named key resource in Vault.\nThis cannot be modified after creation. If not provided, the \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e\nkey is used.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "The name of the client.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "redirectUris": { "type": "array", "items": { "type": "string" }, "description": "Redirection URI values used by the client. \nOne of these values must exactly match the \u003cspan pulumi-lang-nodejs=\"`redirectUri`\" pulumi-lang-dotnet=\"`RedirectUri`\" pulumi-lang-go=\"`redirectUri`\" pulumi-lang-python=\"`redirect_uri`\" pulumi-lang-yaml=\"`redirectUri`\" pulumi-lang-java=\"`redirectUri`\" pulumi-lang-hcl=\"`redirect_uri`\"\u003e`redirectUri`\u003c/span\u003e parameter value\nused in each authentication request.\n" } }, "type": "object" } }, "vault:identity/oidcKey:OidcKey": { "description": "Creates an Identity OIDC Named Key for Vault Identity secrets engine which is used by a role\nto sign\n[identity tokens](https://www.vaultproject.io/docs/secrets/identity/index.html#identity-tokens).\n\nThe Identity secrets engine is the identity management solution for Vault. It internally\nmaintains the clients who are recognized by Vault.\n\nUse this with \u003cspan pulumi-lang-nodejs=\"`vault.identity.OidcKey`\" pulumi-lang-dotnet=\"`vault.identity.OidcKey`\" pulumi-lang-go=\"`identity.OidcKey`\" pulumi-lang-python=\"`identity.OidcKey`\" pulumi-lang-yaml=\"`vault.identity.OidcKey`\" pulumi-lang-java=\"`vault.identity.OidcKey`\" pulumi-lang-hcl=\"`vault_identity_oidc_key`\"\u003e`vault.identity.OidcKey`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-dotnet=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-go=\"`identity.OidcKeyAllowedClientID`\" pulumi-lang-python=\"`identity.OidcKeyAllowedClientID`\" pulumi-lang-yaml=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-java=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-hcl=\"`vault_identity_oidc_key_allowed_client_id`\"\u003e`vault.identity.OidcKeyAllowedClientID`\u003c/span\u003e\nto configure a Role to generate Identity Tokens.\n\n\u003e **NOTE on \u003cspan pulumi-lang-nodejs=\"`allowedClientIds`\" pulumi-lang-dotnet=\"`AllowedClientIds`\" pulumi-lang-go=\"`allowedClientIds`\" pulumi-lang-python=\"`allowed_client_ids`\" pulumi-lang-yaml=\"`allowedClientIds`\" pulumi-lang-java=\"`allowedClientIds`\" pulumi-lang-hcl=\"`allowed_client_ids`\"\u003e`allowedClientIds`\u003c/span\u003e:** Terraform currently\nprovides both a standalone Allowed Client ID (a single\nClient ID), and a OIDC Named Key with a inline list of Allowed Client IDs.\nAt this time you cannot use an OIDC Named Key inline list of Allowed Client IDs\nin conjunction with any Allowed Client ID resources. Doing so will cause\na conflict of the list of Allowed Client IDs for the named Key.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst key = new vault.identity.OidcKey(\"key\", {\n name: \"key\",\n algorithm: \"RS256\",\n});\nconst role = new vault.identity.OidcRole(\"role\", {\n name: \"role\",\n key: key.name,\n});\nconst roleOidcKeyAllowedClientID = new vault.identity.OidcKeyAllowedClientID(\"role\", {\n keyName: key.name,\n allowedClientId: role.clientId,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkey = vault.identity.OidcKey(\"key\",\n name=\"key\",\n algorithm=\"RS256\")\nrole = vault.identity.OidcRole(\"role\",\n name=\"role\",\n key=key.name)\nrole_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID(\"role\",\n key_name=key.name,\n allowed_client_id=role.client_id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var key = new Vault.Identity.OidcKey(\"key\", new()\n {\n Name = \"key\",\n Algorithm = \"RS256\",\n });\n\n var role = new Vault.Identity.OidcRole(\"role\", new()\n {\n Name = \"role\",\n Key = key.Name,\n });\n\n var roleOidcKeyAllowedClientID = new Vault.Identity.OidcKeyAllowedClientID(\"role\", new()\n {\n KeyName = key.Name,\n AllowedClientId = role.ClientId,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkey, err := identity.NewOidcKey(ctx, \"key\", \u0026identity.OidcKeyArgs{\n\t\t\tName: pulumi.String(\"key\"),\n\t\t\tAlgorithm: pulumi.String(\"RS256\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\trole, err := identity.NewOidcRole(ctx, \"role\", \u0026identity.OidcRoleArgs{\n\t\t\tName: pulumi.String(\"role\"),\n\t\t\tKey: key.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewOidcKeyAllowedClientID(ctx, \"role\", \u0026identity.OidcKeyAllowedClientIDArgs{\n\t\t\tKeyName: key.Name,\n\t\t\tAllowedClientId: role.ClientId,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_oidckey\" \"key\" {\n name = \"key\"\n algorithm = \"RS256\"\n}\nresource \"vault_identity_oidcrole\" \"role\" {\n name = \"role\"\n key = vault_identity_oidckey.key.name\n}\nresource \"vault_identity_oidckeyallowedclientid\" \"role\" {\n key_name = vault_identity_oidckey.key.name\n allowed_client_id = vault_identity_oidcrole.role.client_id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.OidcKey;\nimport com.pulumi.vault.identity.OidcKeyArgs;\nimport com.pulumi.vault.identity.OidcRole;\nimport com.pulumi.vault.identity.OidcRoleArgs;\nimport com.pulumi.vault.identity.OidcKeyAllowedClientID;\nimport com.pulumi.vault.identity.OidcKeyAllowedClientIDArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var key = new OidcKey(\"key\", OidcKeyArgs.builder()\n .name(\"key\")\n .algorithm(\"RS256\")\n .build());\n\n var role = new OidcRole(\"role\", OidcRoleArgs.builder()\n .name(\"role\")\n .key(key.name())\n .build());\n\n var roleOidcKeyAllowedClientID = new OidcKeyAllowedClientID(\"roleOidcKeyAllowedClientID\", OidcKeyAllowedClientIDArgs.builder()\n .keyName(key.name())\n .allowedClientId(role.clientId())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n key:\n type: vault:identity:OidcKey\n properties:\n name: key\n algorithm: RS256\n role:\n type: vault:identity:OidcRole\n properties:\n name: role\n key: ${key.name}\n roleOidcKeyAllowedClientID:\n type: vault:identity:OidcKeyAllowedClientID\n name: role\n properties:\n keyName: ${key.name}\n allowedClientId: ${role.clientId}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe key can be imported with the key name, for example:\n\n```sh\n$ pulumi import vault:identity/oidcKey:OidcKey key key\n```\n\n", "properties": { "algorithm": { "type": "string", "description": "Signing algorithm to use. Signing algorithm to use.\nAllowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512, EdDSA.\n" }, "allowedClientIds": { "type": "array", "items": { "type": "string" }, "description": "Array of role client ID allowed to use this key for signing. If\nempty, no roles are allowed. If `[\"*\"]`, all roles are allowed.\n" }, "name": { "type": "string", "description": "Name of the OIDC Key to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "rotationPeriod": { "type": "integer", "description": "How often to generate a new signing key in number of seconds\n" }, "verificationTtl": { "type": "integer", "description": "\"Controls how long the public portion of a signing key will be\navailable for verification after being rotated in seconds.\n" } }, "required": [ "allowedClientIds", "name" ], "inputProperties": { "algorithm": { "type": "string", "description": "Signing algorithm to use. Signing algorithm to use.\nAllowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512, EdDSA.\n" }, "allowedClientIds": { "type": "array", "items": { "type": "string" }, "description": "Array of role client ID allowed to use this key for signing. If\nempty, no roles are allowed. If `[\"*\"]`, all roles are allowed.\n" }, "name": { "type": "string", "description": "Name of the OIDC Key to create.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "rotationPeriod": { "type": "integer", "description": "How often to generate a new signing key in number of seconds\n" }, "verificationTtl": { "type": "integer", "description": "\"Controls how long the public portion of a signing key will be\navailable for verification after being rotated in seconds.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering OidcKey resources.\n", "properties": { "algorithm": { "type": "string", "description": "Signing algorithm to use. Signing algorithm to use.\nAllowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512, EdDSA.\n" }, "allowedClientIds": { "type": "array", "items": { "type": "string" }, "description": "Array of role client ID allowed to use this key for signing. If\nempty, no roles are allowed. If `[\"*\"]`, all roles are allowed.\n" }, "name": { "type": "string", "description": "Name of the OIDC Key to create.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "rotationPeriod": { "type": "integer", "description": "How often to generate a new signing key in number of seconds\n" }, "verificationTtl": { "type": "integer", "description": "\"Controls how long the public portion of a signing key will be\navailable for verification after being rotated in seconds.\n" } }, "type": "object" } }, "vault:identity/oidcKeyAllowedClientID:OidcKeyAllowedClientID": { "description": "Allows an Identity OIDC Role to use an OIDC Named key to generate\n[identity tokens](https://www.vaultproject.io/docs/secrets/identity/index.html#identity-tokens).\n\nThe Identity secrets engine is the identity management solution for Vault. It internally\nmaintains the clients who are recognized by Vault.\n\nUse this with \u003cspan pulumi-lang-nodejs=\"`vault.identity.OidcKey`\" pulumi-lang-dotnet=\"`vault.identity.OidcKey`\" pulumi-lang-go=\"`identity.OidcKey`\" pulumi-lang-python=\"`identity.OidcKey`\" pulumi-lang-yaml=\"`vault.identity.OidcKey`\" pulumi-lang-java=\"`vault.identity.OidcKey`\" pulumi-lang-hcl=\"`vault_identity_oidc_key`\"\u003e`vault.identity.OidcKey`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-dotnet=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-go=\"`identity.OidcKeyAllowedClientID`\" pulumi-lang-python=\"`identity.OidcKeyAllowedClientID`\" pulumi-lang-yaml=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-java=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-hcl=\"`vault_identity_oidc_key_allowed_client_id`\"\u003e`vault.identity.OidcKeyAllowedClientID`\u003c/span\u003e\nto configure a Role to generate Identity Tokens.\n\n\u003e **NOTE on \u003cspan pulumi-lang-nodejs=\"`allowedClientIds`\" pulumi-lang-dotnet=\"`AllowedClientIds`\" pulumi-lang-go=\"`allowedClientIds`\" pulumi-lang-python=\"`allowed_client_ids`\" pulumi-lang-yaml=\"`allowedClientIds`\" pulumi-lang-java=\"`allowedClientIds`\" pulumi-lang-hcl=\"`allowed_client_ids`\"\u003e`allowedClientIds`\u003c/span\u003e:** Terraform currently\nprovides both a standalone Allowed Client ID (a single\nClient ID), and a OIDC Named Key with a inline list of Allowed Client IDs.\nAt this time you cannot use an OIDC Named Key inline list of Allowed Client IDs\nin conjunction with any Allowed Client ID resources. Doing so will cause\na conflict of the list of Allowed Client IDs for the named Key.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst key = new vault.identity.OidcKey(\"key\", {\n name: \"key\",\n algorithm: \"RS256\",\n});\nconst role = new vault.identity.OidcRole(\"role\", {\n name: \"role\",\n key: key.name,\n});\nconst roleOidcKeyAllowedClientID = new vault.identity.OidcKeyAllowedClientID(\"role\", {\n keyName: key.name,\n allowedClientId: role.clientId,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkey = vault.identity.OidcKey(\"key\",\n name=\"key\",\n algorithm=\"RS256\")\nrole = vault.identity.OidcRole(\"role\",\n name=\"role\",\n key=key.name)\nrole_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID(\"role\",\n key_name=key.name,\n allowed_client_id=role.client_id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var key = new Vault.Identity.OidcKey(\"key\", new()\n {\n Name = \"key\",\n Algorithm = \"RS256\",\n });\n\n var role = new Vault.Identity.OidcRole(\"role\", new()\n {\n Name = \"role\",\n Key = key.Name,\n });\n\n var roleOidcKeyAllowedClientID = new Vault.Identity.OidcKeyAllowedClientID(\"role\", new()\n {\n KeyName = key.Name,\n AllowedClientId = role.ClientId,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkey, err := identity.NewOidcKey(ctx, \"key\", \u0026identity.OidcKeyArgs{\n\t\t\tName: pulumi.String(\"key\"),\n\t\t\tAlgorithm: pulumi.String(\"RS256\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\trole, err := identity.NewOidcRole(ctx, \"role\", \u0026identity.OidcRoleArgs{\n\t\t\tName: pulumi.String(\"role\"),\n\t\t\tKey: key.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewOidcKeyAllowedClientID(ctx, \"role\", \u0026identity.OidcKeyAllowedClientIDArgs{\n\t\t\tKeyName: key.Name,\n\t\t\tAllowedClientId: role.ClientId,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_oidckey\" \"key\" {\n name = \"key\"\n algorithm = \"RS256\"\n}\nresource \"vault_identity_oidcrole\" \"role\" {\n name = \"role\"\n key = vault_identity_oidckey.key.name\n}\nresource \"vault_identity_oidckeyallowedclientid\" \"role\" {\n key_name = vault_identity_oidckey.key.name\n allowed_client_id = vault_identity_oidcrole.role.client_id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.OidcKey;\nimport com.pulumi.vault.identity.OidcKeyArgs;\nimport com.pulumi.vault.identity.OidcRole;\nimport com.pulumi.vault.identity.OidcRoleArgs;\nimport com.pulumi.vault.identity.OidcKeyAllowedClientID;\nimport com.pulumi.vault.identity.OidcKeyAllowedClientIDArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var key = new OidcKey(\"key\", OidcKeyArgs.builder()\n .name(\"key\")\n .algorithm(\"RS256\")\n .build());\n\n var role = new OidcRole(\"role\", OidcRoleArgs.builder()\n .name(\"role\")\n .key(key.name())\n .build());\n\n var roleOidcKeyAllowedClientID = new OidcKeyAllowedClientID(\"roleOidcKeyAllowedClientID\", OidcKeyAllowedClientIDArgs.builder()\n .keyName(key.name())\n .allowedClientId(role.clientId())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n key:\n type: vault:identity:OidcKey\n properties:\n name: key\n algorithm: RS256\n role:\n type: vault:identity:OidcRole\n properties:\n name: role\n key: ${key.name}\n roleOidcKeyAllowedClientID:\n type: vault:identity:OidcKeyAllowedClientID\n name: role\n properties:\n keyName: ${key.name}\n allowedClientId: ${role.clientId}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "allowedClientId": { "type": "string", "description": "Client ID to allow usage with the OIDC named key\n" }, "keyName": { "type": "string", "description": "Name of the OIDC Key allow the Client ID.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "allowedClientId", "keyName" ], "inputProperties": { "allowedClientId": { "type": "string", "description": "Client ID to allow usage with the OIDC named key\n", "willReplaceOnChanges": true }, "keyName": { "type": "string", "description": "Name of the OIDC Key allow the Client ID.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "allowedClientId", "keyName" ], "stateInputs": { "description": "Input properties used for looking up and filtering OidcKeyAllowedClientID resources.\n", "properties": { "allowedClientId": { "type": "string", "description": "Client ID to allow usage with the OIDC named key\n", "willReplaceOnChanges": true }, "keyName": { "type": "string", "description": "Name of the OIDC Key allow the Client ID.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:identity/oidcProvider:OidcProvider": { "description": "Manages OIDC Providers in a Vault server. See the [Vault documentation](https://www.vaultproject.io/api-docs/secret/identity/oidc-provider#create-or-update-an-assignment)\nfor more information.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.identity.OidcKey(\"test\", {\n name: \"my-key\",\n allowedClientIds: [\"*\"],\n rotationPeriod: 3600,\n verificationTtl: 3600,\n});\nconst testOidcAssignment = new vault.identity.OidcAssignment(\"test\", {\n name: \"my-assignment\",\n entityIds: [\"fake-ascbascas-2231a-sdfaa\"],\n groupIds: [\"fake-sajkdsad-32414-sfsada\"],\n});\nconst testOidcClient = new vault.identity.OidcClient(\"test\", {\n name: \"application\",\n key: test.name,\n redirectUris: [\n \"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\",\n \"http://127.0.0.1:8251/callback\",\n \"http://127.0.0.1:8080/callback\",\n ],\n assignments: [testOidcAssignment.name],\n idTokenTtl: 2400,\n accessTokenTtl: 7200,\n});\nconst testOidcScope = new vault.identity.OidcScope(\"test\", {\n name: \"groups\",\n template: JSON.stringify({\n groups: \"{{identity.entity.groups.names}}\",\n }),\n description: \"Groups scope.\",\n});\nconst testOidcProvider = new vault.identity.OidcProvider(\"test\", {\n name: \"my-provider\",\n httpsEnabled: false,\n issuerHost: \"127.0.0.1:8200\",\n allowedClientIds: [testOidcClient.clientId],\n scopesSupporteds: [testOidcScope.name],\n});\n```\n```python\nimport pulumi\nimport json\nimport pulumi_vault as vault\n\ntest = vault.identity.OidcKey(\"test\",\n name=\"my-key\",\n allowed_client_ids=[\"*\"],\n rotation_period=3600,\n verification_ttl=3600)\ntest_oidc_assignment = vault.identity.OidcAssignment(\"test\",\n name=\"my-assignment\",\n entity_ids=[\"fake-ascbascas-2231a-sdfaa\"],\n group_ids=[\"fake-sajkdsad-32414-sfsada\"])\ntest_oidc_client = vault.identity.OidcClient(\"test\",\n name=\"application\",\n key=test.name,\n redirect_uris=[\n \"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\",\n \"http://127.0.0.1:8251/callback\",\n \"http://127.0.0.1:8080/callback\",\n ],\n assignments=[test_oidc_assignment.name],\n id_token_ttl=2400,\n access_token_ttl=7200)\ntest_oidc_scope = vault.identity.OidcScope(\"test\",\n name=\"groups\",\n template=json.dumps({\n \"groups\": \"{{identity.entity.groups.names}}\",\n }),\n description=\"Groups scope.\")\ntest_oidc_provider = vault.identity.OidcProvider(\"test\",\n name=\"my-provider\",\n https_enabled=False,\n issuer_host=\"127.0.0.1:8200\",\n allowed_client_ids=[test_oidc_client.client_id],\n scopes_supporteds=[test_oidc_scope.name])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text.Json;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Identity.OidcKey(\"test\", new()\n {\n Name = \"my-key\",\n AllowedClientIds = new[]\n {\n \"*\",\n },\n RotationPeriod = 3600,\n VerificationTtl = 3600,\n });\n\n var testOidcAssignment = new Vault.Identity.OidcAssignment(\"test\", new()\n {\n Name = \"my-assignment\",\n EntityIds = new[]\n {\n \"fake-ascbascas-2231a-sdfaa\",\n },\n GroupIds = new[]\n {\n \"fake-sajkdsad-32414-sfsada\",\n },\n });\n\n var testOidcClient = new Vault.Identity.OidcClient(\"test\", new()\n {\n Name = \"application\",\n Key = test.Name,\n RedirectUris = new[]\n {\n \"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\",\n \"http://127.0.0.1:8251/callback\",\n \"http://127.0.0.1:8080/callback\",\n },\n Assignments = new[]\n {\n testOidcAssignment.Name,\n },\n IdTokenTtl = 2400,\n AccessTokenTtl = 7200,\n });\n\n var testOidcScope = new Vault.Identity.OidcScope(\"test\", new()\n {\n Name = \"groups\",\n Template = JsonSerializer.Serialize(new Dictionary\u003cstring, object?\u003e\n {\n [\"groups\"] = \"{{identity.entity.groups.names}}\",\n }),\n Description = \"Groups scope.\",\n });\n\n var testOidcProvider = new Vault.Identity.OidcProvider(\"test\", new()\n {\n Name = \"my-provider\",\n HttpsEnabled = false,\n IssuerHost = \"127.0.0.1:8200\",\n AllowedClientIds = new[]\n {\n testOidcClient.ClientId,\n },\n ScopesSupporteds = new[]\n {\n testOidcScope.Name,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttest, err := identity.NewOidcKey(ctx, \"test\", \u0026identity.OidcKeyArgs{\n\t\t\tName: pulumi.String(\"my-key\"),\n\t\t\tAllowedClientIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*\"),\n\t\t\t},\n\t\t\tRotationPeriod: pulumi.Int(3600),\n\t\t\tVerificationTtl: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttestOidcAssignment, err := identity.NewOidcAssignment(ctx, \"test\", \u0026identity.OidcAssignmentArgs{\n\t\t\tName: pulumi.String(\"my-assignment\"),\n\t\t\tEntityIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"fake-ascbascas-2231a-sdfaa\"),\n\t\t\t},\n\t\t\tGroupIds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"fake-sajkdsad-32414-sfsada\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttestOidcClient, err := identity.NewOidcClient(ctx, \"test\", \u0026identity.OidcClientArgs{\n\t\t\tName: pulumi.String(\"application\"),\n\t\t\tKey: test.Name,\n\t\t\tRedirectUris: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\"),\n\t\t\t\tpulumi.String(\"http://127.0.0.1:8251/callback\"),\n\t\t\t\tpulumi.String(\"http://127.0.0.1:8080/callback\"),\n\t\t\t},\n\t\t\tAssignments: pulumi.StringArray{\n\t\t\t\ttestOidcAssignment.Name,\n\t\t\t},\n\t\t\tIdTokenTtl: pulumi.Int(2400),\n\t\t\tAccessTokenTtl: pulumi.Int(7200),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttmpJSON0, err := json.Marshal(map[string]string{\n\t\t\t\"groups\": \"{{identity.entity.groups.names}}\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjson0 := string(tmpJSON0)\n\t\ttestOidcScope, err := identity.NewOidcScope(ctx, \"test\", \u0026identity.OidcScopeArgs{\n\t\t\tName: pulumi.String(\"groups\"),\n\t\t\tTemplate: pulumi.String(json0),\n\t\t\tDescription: pulumi.String(\"Groups scope.\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewOidcProvider(ctx, \"test\", \u0026identity.OidcProviderArgs{\n\t\t\tName: pulumi.String(\"my-provider\"),\n\t\t\tHttpsEnabled: pulumi.Bool(false),\n\t\t\tIssuerHost: pulumi.String(\"127.0.0.1:8200\"),\n\t\t\tAllowedClientIds: pulumi.StringArray{\n\t\t\t\ttestOidcClient.ClientId,\n\t\t\t},\n\t\t\tScopesSupporteds: pulumi.StringArray{\n\t\t\t\ttestOidcScope.Name,\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_oidckey\" \"test\" {\n name = \"my-key\"\n allowed_client_ids = [\"*\"]\n rotation_period = 3600\n verification_ttl = 3600\n}\nresource \"vault_identity_oidcassignment\" \"test\" {\n name = \"my-assignment\"\n entity_ids = [\"fake-ascbascas-2231a-sdfaa\"]\n group_ids = [\"fake-sajkdsad-32414-sfsada\"]\n}\nresource \"vault_identity_oidcclient\" \"test\" {\n name = \"application\"\n key = vault_identity_oidckey.test.name\n redirect_uris = [\"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\", \"http://127.0.0.1:8251/callback\", \"http://127.0.0.1:8080/callback\"]\n assignments = [vault_identity_oidcassignment.test.name]\n id_token_ttl = 2400\n access_token_ttl = 7200\n}\nresource \"vault_identity_oidcscope\" \"test\" {\n name = \"groups\"\n template = jsonencode({\n \"groups\" = \"{{identity.entity.groups.names}}\"\n })\n description = \"Groups scope.\"\n}\nresource \"vault_identity_oidcprovider\" \"test\" {\n name = \"my-provider\"\n https_enabled = false\n issuer_host = \"127.0.0.1:8200\"\n allowed_client_ids = [vault_identity_oidcclient.test.client_id]\n scopes_supporteds = [vault_identity_oidcscope.test.name]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.OidcKey;\nimport com.pulumi.vault.identity.OidcKeyArgs;\nimport com.pulumi.vault.identity.OidcAssignment;\nimport com.pulumi.vault.identity.OidcAssignmentArgs;\nimport com.pulumi.vault.identity.OidcClient;\nimport com.pulumi.vault.identity.OidcClientArgs;\nimport com.pulumi.vault.identity.OidcScope;\nimport com.pulumi.vault.identity.OidcScopeArgs;\nimport com.pulumi.vault.identity.OidcProvider;\nimport com.pulumi.vault.identity.OidcProviderArgs;\nimport static com.pulumi.codegen.internal.Serialization.*;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new OidcKey(\"test\", OidcKeyArgs.builder()\n .name(\"my-key\")\n .allowedClientIds(\"*\")\n .rotationPeriod(3600)\n .verificationTtl(3600)\n .build());\n\n var testOidcAssignment = new OidcAssignment(\"testOidcAssignment\", OidcAssignmentArgs.builder()\n .name(\"my-assignment\")\n .entityIds(\"fake-ascbascas-2231a-sdfaa\")\n .groupIds(\"fake-sajkdsad-32414-sfsada\")\n .build());\n\n var testOidcClient = new OidcClient(\"testOidcClient\", OidcClientArgs.builder()\n .name(\"application\")\n .key(test.name())\n .redirectUris( \n \"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\",\n \"http://127.0.0.1:8251/callback\",\n \"http://127.0.0.1:8080/callback\")\n .assignments(testOidcAssignment.name())\n .idTokenTtl(2400)\n .accessTokenTtl(7200)\n .build());\n\n var testOidcScope = new OidcScope(\"testOidcScope\", OidcScopeArgs.builder()\n .name(\"groups\")\n .template(serializeJson(\n jsonObject(\n jsonProperty(\"groups\", \"{{identity.entity.groups.names}}\")\n )))\n .description(\"Groups scope.\")\n .build());\n\n var testOidcProvider = new OidcProvider(\"testOidcProvider\", OidcProviderArgs.builder()\n .name(\"my-provider\")\n .httpsEnabled(false)\n .issuerHost(\"127.0.0.1:8200\")\n .allowedClientIds(testOidcClient.clientId())\n .scopesSupporteds(testOidcScope.name())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:identity:OidcKey\n properties:\n name: my-key\n allowedClientIds:\n - '*'\n rotationPeriod: 3600\n verificationTtl: 3600\n testOidcAssignment:\n type: vault:identity:OidcAssignment\n name: test\n properties:\n name: my-assignment\n entityIds:\n - fake-ascbascas-2231a-sdfaa\n groupIds:\n - fake-sajkdsad-32414-sfsada\n testOidcClient:\n type: vault:identity:OidcClient\n name: test\n properties:\n name: application\n key: ${test.name}\n redirectUris:\n - http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback\n - http://127.0.0.1:8251/callback\n - http://127.0.0.1:8080/callback\n assignments:\n - ${testOidcAssignment.name}\n idTokenTtl: 2400\n accessTokenTtl: 7200\n testOidcScope:\n type: vault:identity:OidcScope\n name: test\n properties:\n name: groups\n template:\n fn::toJSON:\n groups: '{{identity.entity.groups.names}}'\n description: Groups scope.\n testOidcProvider:\n type: vault:identity:OidcProvider\n name: test\n properties:\n name: my-provider\n httpsEnabled: false\n issuerHost: 127.0.0.1:8200\n allowedClientIds:\n - ${testOidcClient.clientId}\n scopesSupporteds:\n - ${testOidcScope.name}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nOIDC Providers can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:identity/oidcProvider:OidcProvider test my-provider\n```\n\n", "properties": { "allowedClientIds": { "type": "array", "items": { "type": "string" }, "description": "The client IDs that are permitted to use the provider. \nIf empty, no clients are allowed. If `*`, all clients are allowed.\n" }, "httpsEnabled": { "type": "boolean", "description": "Set to true if the issuer endpoint uses HTTPS.\n" }, "issuer": { "type": "string", "description": "Specifies what will be used as the `scheme://host:port`\ncomponent for the \u003cspan pulumi-lang-nodejs=\"`iss`\" pulumi-lang-dotnet=\"`Iss`\" pulumi-lang-go=\"`iss`\" pulumi-lang-python=\"`iss`\" pulumi-lang-yaml=\"`iss`\" pulumi-lang-java=\"`iss`\" pulumi-lang-hcl=\"`iss`\"\u003e`iss`\u003c/span\u003e claim of ID tokens. This value is computed using the\n\u003cspan pulumi-lang-nodejs=\"`issuerHost`\" pulumi-lang-dotnet=\"`IssuerHost`\" pulumi-lang-go=\"`issuerHost`\" pulumi-lang-python=\"`issuer_host`\" pulumi-lang-yaml=\"`issuerHost`\" pulumi-lang-java=\"`issuerHost`\" pulumi-lang-hcl=\"`issuer_host`\"\u003e`issuerHost`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`httpsEnabled`\" pulumi-lang-dotnet=\"`HttpsEnabled`\" pulumi-lang-go=\"`httpsEnabled`\" pulumi-lang-python=\"`https_enabled`\" pulumi-lang-yaml=\"`httpsEnabled`\" pulumi-lang-java=\"`httpsEnabled`\" pulumi-lang-hcl=\"`https_enabled`\"\u003e`httpsEnabled`\u003c/span\u003e fields.\n" }, "issuerHost": { "type": "string", "description": "The host for the issuer. Can be either host or host:port.\n" }, "name": { "type": "string", "description": "The name of the provider.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "scopesSupporteds": { "type": "array", "items": { "type": "string" }, "description": "The scopes available for requesting on the provider.\n" } }, "required": [ "issuer", "name" ], "inputProperties": { "allowedClientIds": { "type": "array", "items": { "type": "string" }, "description": "The client IDs that are permitted to use the provider. \nIf empty, no clients are allowed. If `*`, all clients are allowed.\n" }, "httpsEnabled": { "type": "boolean", "description": "Set to true if the issuer endpoint uses HTTPS.\n" }, "issuerHost": { "type": "string", "description": "The host for the issuer. Can be either host or host:port.\n" }, "name": { "type": "string", "description": "The name of the provider.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "scopesSupporteds": { "type": "array", "items": { "type": "string" }, "description": "The scopes available for requesting on the provider.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering OidcProvider resources.\n", "properties": { "allowedClientIds": { "type": "array", "items": { "type": "string" }, "description": "The client IDs that are permitted to use the provider. \nIf empty, no clients are allowed. If `*`, all clients are allowed.\n" }, "httpsEnabled": { "type": "boolean", "description": "Set to true if the issuer endpoint uses HTTPS.\n" }, "issuer": { "type": "string", "description": "Specifies what will be used as the `scheme://host:port`\ncomponent for the \u003cspan pulumi-lang-nodejs=\"`iss`\" pulumi-lang-dotnet=\"`Iss`\" pulumi-lang-go=\"`iss`\" pulumi-lang-python=\"`iss`\" pulumi-lang-yaml=\"`iss`\" pulumi-lang-java=\"`iss`\" pulumi-lang-hcl=\"`iss`\"\u003e`iss`\u003c/span\u003e claim of ID tokens. This value is computed using the\n\u003cspan pulumi-lang-nodejs=\"`issuerHost`\" pulumi-lang-dotnet=\"`IssuerHost`\" pulumi-lang-go=\"`issuerHost`\" pulumi-lang-python=\"`issuer_host`\" pulumi-lang-yaml=\"`issuerHost`\" pulumi-lang-java=\"`issuerHost`\" pulumi-lang-hcl=\"`issuer_host`\"\u003e`issuerHost`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`httpsEnabled`\" pulumi-lang-dotnet=\"`HttpsEnabled`\" pulumi-lang-go=\"`httpsEnabled`\" pulumi-lang-python=\"`https_enabled`\" pulumi-lang-yaml=\"`httpsEnabled`\" pulumi-lang-java=\"`httpsEnabled`\" pulumi-lang-hcl=\"`https_enabled`\"\u003e`httpsEnabled`\u003c/span\u003e fields.\n" }, "issuerHost": { "type": "string", "description": "The host for the issuer. Can be either host or host:port.\n" }, "name": { "type": "string", "description": "The name of the provider.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "scopesSupporteds": { "type": "array", "items": { "type": "string" }, "description": "The scopes available for requesting on the provider.\n" } }, "type": "object" } }, "vault:identity/oidcRole:OidcRole": { "description": "Creates an Identity OIDC Role for Vault Identity secrets engine to issue\n[identity tokens](https://www.vaultproject.io/docs/secrets/identity/index.html#identity-tokens).\n\nThe Identity secrets engine is the identity management solution for Vault. It internally maintains\nthe clients who are recognized by Vault.\n\nUse this with \u003cspan pulumi-lang-nodejs=\"`vault.identity.OidcKey`\" pulumi-lang-dotnet=\"`vault.identity.OidcKey`\" pulumi-lang-go=\"`identity.OidcKey`\" pulumi-lang-python=\"`identity.OidcKey`\" pulumi-lang-yaml=\"`vault.identity.OidcKey`\" pulumi-lang-java=\"`vault.identity.OidcKey`\" pulumi-lang-hcl=\"`vault_identity_oidc_key`\"\u003e`vault.identity.OidcKey`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-dotnet=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-go=\"`identity.OidcKeyAllowedClientID`\" pulumi-lang-python=\"`identity.OidcKeyAllowedClientID`\" pulumi-lang-yaml=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-java=\"`vault.identity.OidcKeyAllowedClientID`\" pulumi-lang-hcl=\"`vault_identity_oidc_key_allowed_client_id`\"\u003e`vault.identity.OidcKeyAllowedClientID`\u003c/span\u003e\nto configure a Role to generate Identity Tokens.\n\n\u003e **NOTE on \u003cspan pulumi-lang-nodejs=\"`allowedClientIds`\" pulumi-lang-dotnet=\"`AllowedClientIds`\" pulumi-lang-go=\"`allowedClientIds`\" pulumi-lang-python=\"`allowed_client_ids`\" pulumi-lang-yaml=\"`allowedClientIds`\" pulumi-lang-java=\"`allowedClientIds`\" pulumi-lang-hcl=\"`allowed_client_ids`\"\u003e`allowedClientIds`\u003c/span\u003e:** Terraform currently\nprovides both a standalone Allowed Client ID (a single\nClient ID), and a OIDC Named Key with a inline list of Allowed Client IDs.\nAt this time you cannot use an OIDC Named Key inline list of Allowed Client IDs\nin conjunction with any Allowed Client ID resources. Doing so will cause\na conflict of the list of Allowed Client IDs for the named Key.\n\n## Example Usage\n\nYou need to create a role with a named key.\nAt creation time, the key can be created independently of the role. However, the key must\nexist before the role can be used to issue tokens. You must also configure the key with the\nrole's Client ID to allow the role to use the key.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new pulumi.Config();\n// Name of the OIDC Key\nconst key = config.get(\"key\") || \"key\";\nconst role = new vault.identity.OidcRole(\"role\", {\n name: \"role\",\n key: key,\n});\nconst keyOidcKey = new vault.identity.OidcKey(\"key\", {\n name: key,\n algorithm: \"RS256\",\n allowedClientIds: [role.clientId],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = pulumi.Config()\n# Name of the OIDC Key\nkey = config.get(\"key\")\nif key is None:\n key = \"key\"\nrole = vault.identity.OidcRole(\"role\",\n name=\"role\",\n key=key)\nkey_oidc_key = vault.identity.OidcKey(\"key\",\n name=key,\n algorithm=\"RS256\",\n allowed_client_ids=[role.client_id])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Config();\n // Name of the OIDC Key\n var key = config.Get(\"key\") ?? \"key\";\n var role = new Vault.Identity.OidcRole(\"role\", new()\n {\n Name = \"role\",\n Key = key,\n });\n\n var keyOidcKey = new Vault.Identity.OidcKey(\"key\", new()\n {\n Name = key,\n Algorithm = \"RS256\",\n AllowedClientIds = new[]\n {\n role.ClientId,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tcfg := config.New(ctx, \"\")\n\t\t// Name of the OIDC Key\n\t\tkey := \"key\"\n\t\tif param := cfg.Get(\"key\"); param != \"\" {\n\t\t\tkey = param\n\t\t}\n\t\trole, err := identity.NewOidcRole(ctx, \"role\", \u0026identity.OidcRoleArgs{\n\t\t\tName: pulumi.String(\"role\"),\n\t\t\tKey: pulumi.String(key),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewOidcKey(ctx, \"key\", \u0026identity.OidcKeyArgs{\n\t\t\tName: pulumi.String(key),\n\t\t\tAlgorithm: pulumi.String(\"RS256\"),\n\t\t\tAllowedClientIds: pulumi.StringArray{\n\t\t\t\trole.ClientId,\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_oidckey\" \"key\" {\n name = var.key\n algorithm = \"RS256\"\n allowed_client_ids = [vault_identity_oidcrole.role.client_id]\n}\nresource \"vault_identity_oidcrole\" \"role\" {\n name = \"role\"\n key = var.key\n}\nvariable \"key\" {\n type = string\n default = \"key\"\n description = \"Name of the OIDC Key\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.OidcRole;\nimport com.pulumi.vault.identity.OidcRoleArgs;\nimport com.pulumi.vault.identity.OidcKey;\nimport com.pulumi.vault.identity.OidcKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n final var config = ctx.config();\n final var key = config.get(\"key\").orElse(\"key\");\n var role = new OidcRole(\"role\", OidcRoleArgs.builder()\n .name(\"role\")\n .key(key)\n .build());\n\n var keyOidcKey = new OidcKey(\"keyOidcKey\", OidcKeyArgs.builder()\n .name(key)\n .algorithm(\"RS256\")\n .allowedClientIds(role.clientId())\n .build());\n\n }\n}\n```\n```yaml\nconfiguration:\n key:\n type: string\n default: key\nresources:\n keyOidcKey:\n type: vault:identity:OidcKey\n name: key\n properties:\n name: ${key}\n algorithm: RS256\n allowedClientIds:\n - ${role.clientId}\n role:\n type: vault:identity:OidcRole\n properties:\n name: role\n key: ${key}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nIf you want to create the key first before creating the role, you can use a separate\nresource to configure the allowed Client ID on\nthe key.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst key = new vault.identity.OidcKey(\"key\", {\n name: \"key\",\n algorithm: \"RS256\",\n});\nconst role = new vault.identity.OidcRole(\"role\", {\n name: \"role\",\n key: key.name,\n});\nconst roleOidcKeyAllowedClientID = new vault.identity.OidcKeyAllowedClientID(\"role\", {\n keyName: key.name,\n allowedClientId: role.clientId,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkey = vault.identity.OidcKey(\"key\",\n name=\"key\",\n algorithm=\"RS256\")\nrole = vault.identity.OidcRole(\"role\",\n name=\"role\",\n key=key.name)\nrole_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID(\"role\",\n key_name=key.name,\n allowed_client_id=role.client_id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var key = new Vault.Identity.OidcKey(\"key\", new()\n {\n Name = \"key\",\n Algorithm = \"RS256\",\n });\n\n var role = new Vault.Identity.OidcRole(\"role\", new()\n {\n Name = \"role\",\n Key = key.Name,\n });\n\n var roleOidcKeyAllowedClientID = new Vault.Identity.OidcKeyAllowedClientID(\"role\", new()\n {\n KeyName = key.Name,\n AllowedClientId = role.ClientId,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkey, err := identity.NewOidcKey(ctx, \"key\", \u0026identity.OidcKeyArgs{\n\t\t\tName: pulumi.String(\"key\"),\n\t\t\tAlgorithm: pulumi.String(\"RS256\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\trole, err := identity.NewOidcRole(ctx, \"role\", \u0026identity.OidcRoleArgs{\n\t\t\tName: pulumi.String(\"role\"),\n\t\t\tKey: key.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = identity.NewOidcKeyAllowedClientID(ctx, \"role\", \u0026identity.OidcKeyAllowedClientIDArgs{\n\t\t\tKeyName: key.Name,\n\t\t\tAllowedClientId: role.ClientId,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_oidckey\" \"key\" {\n name = \"key\"\n algorithm = \"RS256\"\n}\nresource \"vault_identity_oidcrole\" \"role\" {\n name = \"role\"\n key = vault_identity_oidckey.key.name\n}\nresource \"vault_identity_oidckeyallowedclientid\" \"role\" {\n key_name = vault_identity_oidckey.key.name\n allowed_client_id = vault_identity_oidcrole.role.client_id\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.OidcKey;\nimport com.pulumi.vault.identity.OidcKeyArgs;\nimport com.pulumi.vault.identity.OidcRole;\nimport com.pulumi.vault.identity.OidcRoleArgs;\nimport com.pulumi.vault.identity.OidcKeyAllowedClientID;\nimport com.pulumi.vault.identity.OidcKeyAllowedClientIDArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var key = new OidcKey(\"key\", OidcKeyArgs.builder()\n .name(\"key\")\n .algorithm(\"RS256\")\n .build());\n\n var role = new OidcRole(\"role\", OidcRoleArgs.builder()\n .name(\"role\")\n .key(key.name())\n .build());\n\n var roleOidcKeyAllowedClientID = new OidcKeyAllowedClientID(\"roleOidcKeyAllowedClientID\", OidcKeyAllowedClientIDArgs.builder()\n .keyName(key.name())\n .allowedClientId(role.clientId())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n key:\n type: vault:identity:OidcKey\n properties:\n name: key\n algorithm: RS256\n role:\n type: vault:identity:OidcRole\n properties:\n name: role\n key: ${key.name}\n roleOidcKeyAllowedClientID:\n type: vault:identity:OidcKeyAllowedClientID\n name: role\n properties:\n keyName: ${key.name}\n allowedClientId: ${role.clientId}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe key can be imported with the role name, for example:\n\n```sh\n$ pulumi import vault:identity/oidcRole:OidcRole role role\n```\n\n", "properties": { "clientId": { "type": "string", "description": "The value that will be included in the \u003cspan pulumi-lang-nodejs=\"`aud`\" pulumi-lang-dotnet=\"`Aud`\" pulumi-lang-go=\"`aud`\" pulumi-lang-python=\"`aud`\" pulumi-lang-yaml=\"`aud`\" pulumi-lang-java=\"`aud`\" pulumi-lang-hcl=\"`aud`\"\u003e`aud`\u003c/span\u003e field of all the OIDC identity\ntokens issued by this role\n" }, "key": { "type": "string", "description": "A configured named key, the key must already exist\nbefore tokens can be issued.\n" }, "name": { "type": "string", "description": "Name of the OIDC Role to create.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "template": { "type": "string", "description": "The template string to use for generating tokens. This may be in\nstring-ified JSON or base64 format. See the\n[documentation](https://www.vaultproject.io/docs/secrets/identity/index.html#token-contents-and-templates)\nfor the template format.\n" }, "ttl": { "type": "integer", "description": "TTL of the tokens generated against the role in number of seconds.\n" } }, "required": [ "clientId", "key", "name" ], "inputProperties": { "clientId": { "type": "string", "description": "The value that will be included in the \u003cspan pulumi-lang-nodejs=\"`aud`\" pulumi-lang-dotnet=\"`Aud`\" pulumi-lang-go=\"`aud`\" pulumi-lang-python=\"`aud`\" pulumi-lang-yaml=\"`aud`\" pulumi-lang-java=\"`aud`\" pulumi-lang-hcl=\"`aud`\"\u003e`aud`\u003c/span\u003e field of all the OIDC identity\ntokens issued by this role\n" }, "key": { "type": "string", "description": "A configured named key, the key must already exist\nbefore tokens can be issued.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "Name of the OIDC Role to create.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "template": { "type": "string", "description": "The template string to use for generating tokens. This may be in\nstring-ified JSON or base64 format. See the\n[documentation](https://www.vaultproject.io/docs/secrets/identity/index.html#token-contents-and-templates)\nfor the template format.\n" }, "ttl": { "type": "integer", "description": "TTL of the tokens generated against the role in number of seconds.\n" } }, "requiredInputs": [ "key" ], "stateInputs": { "description": "Input properties used for looking up and filtering OidcRole resources.\n", "properties": { "clientId": { "type": "string", "description": "The value that will be included in the \u003cspan pulumi-lang-nodejs=\"`aud`\" pulumi-lang-dotnet=\"`Aud`\" pulumi-lang-go=\"`aud`\" pulumi-lang-python=\"`aud`\" pulumi-lang-yaml=\"`aud`\" pulumi-lang-java=\"`aud`\" pulumi-lang-hcl=\"`aud`\"\u003e`aud`\u003c/span\u003e field of all the OIDC identity\ntokens issued by this role\n" }, "key": { "type": "string", "description": "A configured named key, the key must already exist\nbefore tokens can be issued.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "Name of the OIDC Role to create.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "template": { "type": "string", "description": "The template string to use for generating tokens. This may be in\nstring-ified JSON or base64 format. See the\n[documentation](https://www.vaultproject.io/docs/secrets/identity/index.html#token-contents-and-templates)\nfor the template format.\n" }, "ttl": { "type": "integer", "description": "TTL of the tokens generated against the role in number of seconds.\n" } }, "type": "object" } }, "vault:identity/oidcScope:OidcScope": { "description": "Manages OIDC Scopes in a Vault server. See the [Vault documentation](https://www.vaultproject.io/api-docs/secret/identity/oidc-provider#create-or-update-a-scope)\nfor more information.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst groups = new vault.identity.OidcScope(\"groups\", {\n name: \"groups\",\n template: \"{\\\"groups\\\":{{identity.entity.groups.names}}}\",\n description: \"Vault OIDC Groups Scope\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ngroups = vault.identity.OidcScope(\"groups\",\n name=\"groups\",\n template=\"{\\\"groups\\\":{{identity.entity.groups.names}}}\",\n description=\"Vault OIDC Groups Scope\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var groups = new Vault.Identity.OidcScope(\"groups\", new()\n {\n Name = \"groups\",\n Template = \"{\\\"groups\\\":{{identity.entity.groups.names}}}\",\n Description = \"Vault OIDC Groups Scope\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := identity.NewOidcScope(ctx, \"groups\", \u0026identity.OidcScopeArgs{\n\t\t\tName: pulumi.String(\"groups\"),\n\t\t\tTemplate: pulumi.String(\"{\\\"groups\\\":{{identity.entity.groups.names}}}\"),\n\t\t\tDescription: pulumi.String(\"Vault OIDC Groups Scope\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_identity_oidcscope\" \"groups\" {\n name = \"groups\"\n template = \"{\\\"groups\\\":{{identity.entity.groups.names}}}\"\n description = \"Vault OIDC Groups Scope\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.identity.OidcScope;\nimport com.pulumi.vault.identity.OidcScopeArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var groups = new OidcScope(\"groups\", OidcScopeArgs.builder()\n .name(\"groups\")\n .template(\"{\\\"groups\\\":{{identity.entity.groups.names}}}\")\n .description(\"Vault OIDC Groups Scope\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n groups:\n type: vault:identity:OidcScope\n properties:\n name: groups\n template: '{\"groups\":{{identity.entity.groups.names}}}'\n description: Vault OIDC Groups Scope\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nOIDC Scopes can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:identity/oidcScope:OidcScope groups groups\n```\n\n", "properties": { "description": { "type": "string", "description": "A description of the scope.\n" }, "name": { "type": "string", "description": "The name of the scope. The \u003cspan pulumi-lang-nodejs=\"`openid`\" pulumi-lang-dotnet=\"`Openid`\" pulumi-lang-go=\"`openid`\" pulumi-lang-python=\"`openid`\" pulumi-lang-yaml=\"`openid`\" pulumi-lang-java=\"`openid`\" pulumi-lang-hcl=\"`openid`\"\u003e`openid`\u003c/span\u003e scope name is reserved.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "template": { "type": "string", "description": "The template string for the scope. This may be provided as escaped JSON or base64 encoded JSON.\n" } }, "required": [ "name" ], "inputProperties": { "description": { "type": "string", "description": "A description of the scope.\n" }, "name": { "type": "string", "description": "The name of the scope. The \u003cspan pulumi-lang-nodejs=\"`openid`\" pulumi-lang-dotnet=\"`Openid`\" pulumi-lang-go=\"`openid`\" pulumi-lang-python=\"`openid`\" pulumi-lang-yaml=\"`openid`\" pulumi-lang-java=\"`openid`\" pulumi-lang-hcl=\"`openid`\"\u003e`openid`\u003c/span\u003e scope name is reserved.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "template": { "type": "string", "description": "The template string for the scope. This may be provided as escaped JSON or base64 encoded JSON.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering OidcScope resources.\n", "properties": { "description": { "type": "string", "description": "A description of the scope.\n" }, "name": { "type": "string", "description": "The name of the scope. The \u003cspan pulumi-lang-nodejs=\"`openid`\" pulumi-lang-dotnet=\"`Openid`\" pulumi-lang-go=\"`openid`\" pulumi-lang-python=\"`openid`\" pulumi-lang-yaml=\"`openid`\" pulumi-lang-java=\"`openid`\" pulumi-lang-hcl=\"`openid`\"\u003e`openid`\u003c/span\u003e scope name is reserved.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "template": { "type": "string", "description": "The template string for the scope. This may be provided as escaped JSON or base64 encoded JSON.\n" } }, "type": "object" } }, "vault:index/activationFlags:ActivationFlags": { "description": "Activates a single activation flag in Vault.\n\n\u003e **Important** Activation flags require Vault 1.16 or later.\n\n\u003e **Important** Activation flags are available only in Vault Enterprise.\n\n\u003e **Important** The activation flags endpoint is root-namespace-only. This resource does not accept a \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e argument.\n\n\u003e **Important** Vault exposes activation for individual flags at `PUT /sys/activation-flags/:feature/activate`, but does not expose a public deactivation API.\n\n## Example Usage\n\n### Activate a Feature\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.ActivationFlags(\"example\", {feature: \"secrets-sync\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.ActivationFlags(\"example\", feature=\"secrets-sync\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.ActivationFlags(\"example\", new()\n {\n Feature = \"secrets-sync\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewActivationFlags(ctx, \"example\", \u0026vault.ActivationFlagsArgs{\n\t\t\tFeature: pulumi.String(\"secrets-sync\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_activationflags\" \"example\" {\n feature = \"secrets-sync\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ActivationFlags;\nimport com.pulumi.vault.ActivationFlagsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new ActivationFlags(\"example\", ActivationFlagsArgs.builder()\n .feature(\"secrets-sync\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:ActivationFlags\n properties:\n feature: secrets-sync\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Notes\n\n* Each \u003cspan pulumi-lang-nodejs=\"`vault.ActivationFlags`\" pulumi-lang-dotnet=\"`vault.ActivationFlags`\" pulumi-lang-go=\"`ActivationFlags`\" pulumi-lang-python=\"`ActivationFlags`\" pulumi-lang-yaml=\"`vault.ActivationFlags`\" pulumi-lang-java=\"`vault.ActivationFlags`\" pulumi-lang-hcl=\"`vault_activation_flags`\"\u003e`vault.ActivationFlags`\u003c/span\u003e resource activates exactly one feature by calling `PUT /sys/activation-flags/:feature/activate`.\n* Destroying this resource removes it from Terraform state only. It does not deactivate the flag in Vault.\n* Activation flag names must exactly match the feature keys returned by `GET /sys/activation-flags`.\n\n## Import\n\nThe activation flags resource can be imported using the feature key, e.g.\n\n```sh\n$ pulumi import vault:index/activationFlags:ActivationFlags example secret_sync\n```\n\n", "properties": { "feature": { "type": "string", "description": "Exact activation flag key to activate.\nThe value must match a feature name returned by `GET /sys/activation-flags`.\n" } }, "required": [ "feature" ], "inputProperties": { "feature": { "type": "string", "description": "Exact activation flag key to activate.\nThe value must match a feature name returned by `GET /sys/activation-flags`.\n" } }, "requiredInputs": [ "feature" ], "stateInputs": { "description": "Input properties used for looking up and filtering ActivationFlags resources.\n", "properties": { "feature": { "type": "string", "description": "Exact activation flag key to activate.\nThe value must match a feature name returned by `GET /sys/activation-flags`.\n" } }, "type": "object" } }, "vault:index/agentRegistration:AgentRegistration": { "description": "\u003e **Preview feature:** This feature is currently available as a preview and is possibly incomplete and subject to change. **We strongly discourage using preview or beta features with production workflows.**\n\nManages Agent Registry records in Vault Enterprise. An Agent Registry record allows you to register Vault agents with specific identity entities and configure ceiling policies that limit the maximum permissions an agent can obtain.\n\n\u003e **Important** This resource is available only in Vault Enterprise and requires Vault 2.0.1 or later.\n\n## Notes\n\n* **Mount:** The Agent Registry is mounted by default. There is no need to take action to enable it.\n\n* **Ceiling Policies**: Ceiling policies define the maximum permissions an agent can obtain. Even if the associated entity or token policies grant broader permissions, the agent will be limited to the intersection of all applicable policies and the ceiling policies.\n\n* **Default Ceiling Policy**: By default, Vault applies a default ceiling policy to Agent Registry records. This policy is automatically filtered out when reading the resource state, so only user-specified ceiling policies appear in the \u003cspan pulumi-lang-nodejs=\"`ceilingPolicies`\" pulumi-lang-dotnet=\"`CeilingPolicies`\" pulumi-lang-go=\"`ceilingPolicies`\" pulumi-lang-python=\"`ceiling_policies`\" pulumi-lang-yaml=\"`ceilingPolicies`\" pulumi-lang-java=\"`ceilingPolicies`\" pulumi-lang-hcl=\"`ceiling_policies`\"\u003e`ceilingPolicies`\u003c/span\u003e attribute.\n\n* **Entity Requirement**: The identity entity specified in \u003cspan pulumi-lang-nodejs=\"`entityId`\" pulumi-lang-dotnet=\"`EntityId`\" pulumi-lang-go=\"`entityId`\" pulumi-lang-python=\"`entity_id`\" pulumi-lang-yaml=\"`entityId`\" pulumi-lang-java=\"`entityId`\" pulumi-lang-hcl=\"`entity_id`\"\u003e`entityId`\u003c/span\u003e must exist before you create the Agent Registry record. The entity defines the base identity for the agent.\n\n* **Display Name Uniqueness**: The \u003cspan pulumi-lang-nodejs=\"`displayName`\" pulumi-lang-dotnet=\"`DisplayName`\" pulumi-lang-go=\"`displayName`\" pulumi-lang-python=\"`display_name`\" pulumi-lang-yaml=\"`displayName`\" pulumi-lang-java=\"`displayName`\" pulumi-lang-hcl=\"`display_name`\"\u003e`displayName`\u003c/span\u003e must be unique within the namespace. Attempting to create multiple Agent Registry records with the same display name will result in an error.\n\n* **Immutable Display Name**: Changing the \u003cspan pulumi-lang-nodejs=\"`displayName`\" pulumi-lang-dotnet=\"`DisplayName`\" pulumi-lang-go=\"`displayName`\" pulumi-lang-python=\"`display_name`\" pulumi-lang-yaml=\"`displayName`\" pulumi-lang-java=\"`displayName`\" pulumi-lang-hcl=\"`display_name`\"\u003e`displayName`\u003c/span\u003e requires destroying and recreating the Agent Registry record, as it serves as the unique identifier.\n\n* **Enterprise Feature**: Agent Registry records are only available in Vault Enterprise. Attempting to use this resource with Vault Community Edition will result in an error.\n\n* **Version Requirement**: This resource requires Vault 2.0.1 or later.\n\n## Import\n\nYou can import Agent Registry records using either their \u003cspan pulumi-lang-nodejs=\"`displayName`\" pulumi-lang-dotnet=\"`DisplayName`\" pulumi-lang-go=\"`displayName`\" pulumi-lang-python=\"`display_name`\" pulumi-lang-yaml=\"`displayName`\" pulumi-lang-java=\"`displayName`\" pulumi-lang-hcl=\"`display_name`\"\u003e`displayName`\u003c/span\u003e or their\n\u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e (UUID). The provider auto-detects which you supplied: if the import string\nparses as a UUID, the provider reads the record by \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e; otherwise it reads the\nrecord by \u003cspan pulumi-lang-nodejs=\"`displayName`\" pulumi-lang-dotnet=\"`DisplayName`\" pulumi-lang-go=\"`displayName`\" pulumi-lang-python=\"`display_name`\" pulumi-lang-yaml=\"`displayName`\" pulumi-lang-java=\"`displayName`\" pulumi-lang-hcl=\"`display_name`\"\u003e`displayName`\u003c/span\u003e.\n\n```sh\n$ pulumi import vault:index/agentRegistration:AgentRegistration example my-agent\n```\n\nTo import a record by \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e:\n\n```sh\n$ pulumi import vault:index/agentRegistration:AgentRegistration example 550e8400-e29b-41d4-a716-446655440000\n```\n\nThe import string does not encode the namespace. To import a record from a\nnamespace, set the `TERRAFORM_VAULT_NAMESPACE_IMPORT` environment variable:\n\n```sh\n$ TERRAFORM_VAULT_NAMESPACE_IMPORT=application terraform import vault_agent_registration.example my-agent\n```\n\n", "properties": { "ceilingPolicies": { "type": "array", "items": { "type": "string" }, "description": "A list of policy names that define the maximum permissions this agent can obtain. These policies act as a ceiling - the agent cannot obtain permissions beyond what these policies allow, even if the entity or token policies would grant more permissions. By default, Vault applies a default ceiling policy unless \u003cspan pulumi-lang-nodejs=\"`noDefaultCeilingPolicy`\" pulumi-lang-dotnet=\"`NoDefaultCeilingPolicy`\" pulumi-lang-go=\"`noDefaultCeilingPolicy`\" pulumi-lang-python=\"`no_default_ceiling_policy`\" pulumi-lang-yaml=\"`noDefaultCeilingPolicy`\" pulumi-lang-java=\"`noDefaultCeilingPolicy`\" pulumi-lang-hcl=\"`no_default_ceiling_policy`\"\u003e`noDefaultCeilingPolicy`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "creationTime": { "type": "string", "description": "The timestamp when the Agent Registry record was created, in RFC3339 format.\n" }, "description": { "type": "string", "description": "A human-readable description of the Agent Registry record. This field is for documentation purposes and does not affect the agent's behavior.\n" }, "displayName": { "type": "string", "description": "The display name for the Agent Registry record. This field must be unique per Vault namespace. Within Terraform, this is used as the unique identifier for the agent. Changing this on an existing resource will force the resource to be deleted from Vault and a new resource to be created in Vault.\n" }, "entityId": { "type": "string", "description": "The ID of the identity entity to associate with this Agent Registry record. The entity must exist before you create the Agent Registry record.\n" }, "lastUpdatedTime": { "type": "string", "description": "The timestamp when the Agent Registry record was last updated, in RFC3339 format.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "noDefaultCeilingPolicy": { "type": "boolean", "description": "When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, prevents Vault from applying the default ceiling policy to this agent. This allows you to have complete control over the agent's ceiling policies. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "optionalAuthorizationDetails": { "type": "boolean", "description": "When \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, RAR (Rich Authorization Requests) is mandatory and\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003emust be present in the token. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e,\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003ein the JWT token are optional for this agent. This setting works in conjunction with the OAuth Resource Server profile's\u003cspan pulumi-lang-nodejs=\" optionalAuthorizationDetails \" pulumi-lang-dotnet=\" OptionalAuthorizationDetails \" pulumi-lang-go=\" optionalAuthorizationDetails \" pulumi-lang-python=\" optional_authorization_details \" pulumi-lang-yaml=\" optionalAuthorizationDetails \" pulumi-lang-java=\" optionalAuthorizationDetails \" pulumi-lang-hcl=\" optional_authorization_details \"\u003e optionalAuthorizationDetails \u003c/span\u003esetting - RAR is optional if EITHER is \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 2.0.3 or later.\n" }, "owner": { "type": "string", "description": "Owner of the Agent Registry record.\n" } }, "required": [ "ceilingPolicies", "creationTime", "displayName", "entityId", "lastUpdatedTime", "noDefaultCeilingPolicy", "optionalAuthorizationDetails" ], "inputProperties": { "ceilingPolicies": { "type": "array", "items": { "type": "string" }, "description": "A list of policy names that define the maximum permissions this agent can obtain. These policies act as a ceiling - the agent cannot obtain permissions beyond what these policies allow, even if the entity or token policies would grant more permissions. By default, Vault applies a default ceiling policy unless \u003cspan pulumi-lang-nodejs=\"`noDefaultCeilingPolicy`\" pulumi-lang-dotnet=\"`NoDefaultCeilingPolicy`\" pulumi-lang-go=\"`noDefaultCeilingPolicy`\" pulumi-lang-python=\"`no_default_ceiling_policy`\" pulumi-lang-yaml=\"`noDefaultCeilingPolicy`\" pulumi-lang-java=\"`noDefaultCeilingPolicy`\" pulumi-lang-hcl=\"`no_default_ceiling_policy`\"\u003e`noDefaultCeilingPolicy`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "description": { "type": "string", "description": "A human-readable description of the Agent Registry record. This field is for documentation purposes and does not affect the agent's behavior.\n" }, "displayName": { "type": "string", "description": "The display name for the Agent Registry record. This field must be unique per Vault namespace. Within Terraform, this is used as the unique identifier for the agent. Changing this on an existing resource will force the resource to be deleted from Vault and a new resource to be created in Vault.\n" }, "entityId": { "type": "string", "description": "The ID of the identity entity to associate with this Agent Registry record. The entity must exist before you create the Agent Registry record.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "noDefaultCeilingPolicy": { "type": "boolean", "description": "When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, prevents Vault from applying the default ceiling policy to this agent. This allows you to have complete control over the agent's ceiling policies. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "optionalAuthorizationDetails": { "type": "boolean", "description": "When \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, RAR (Rich Authorization Requests) is mandatory and\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003emust be present in the token. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e,\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003ein the JWT token are optional for this agent. This setting works in conjunction with the OAuth Resource Server profile's\u003cspan pulumi-lang-nodejs=\" optionalAuthorizationDetails \" pulumi-lang-dotnet=\" OptionalAuthorizationDetails \" pulumi-lang-go=\" optionalAuthorizationDetails \" pulumi-lang-python=\" optional_authorization_details \" pulumi-lang-yaml=\" optionalAuthorizationDetails \" pulumi-lang-java=\" optionalAuthorizationDetails \" pulumi-lang-hcl=\" optional_authorization_details \"\u003e optionalAuthorizationDetails \u003c/span\u003esetting - RAR is optional if EITHER is \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 2.0.3 or later.\n" }, "owner": { "type": "string", "description": "Owner of the Agent Registry record.\n" } }, "requiredInputs": [ "displayName", "entityId" ], "stateInputs": { "description": "Input properties used for looking up and filtering AgentRegistration resources.\n", "properties": { "ceilingPolicies": { "type": "array", "items": { "type": "string" }, "description": "A list of policy names that define the maximum permissions this agent can obtain. These policies act as a ceiling - the agent cannot obtain permissions beyond what these policies allow, even if the entity or token policies would grant more permissions. By default, Vault applies a default ceiling policy unless \u003cspan pulumi-lang-nodejs=\"`noDefaultCeilingPolicy`\" pulumi-lang-dotnet=\"`NoDefaultCeilingPolicy`\" pulumi-lang-go=\"`noDefaultCeilingPolicy`\" pulumi-lang-python=\"`no_default_ceiling_policy`\" pulumi-lang-yaml=\"`noDefaultCeilingPolicy`\" pulumi-lang-java=\"`noDefaultCeilingPolicy`\" pulumi-lang-hcl=\"`no_default_ceiling_policy`\"\u003e`noDefaultCeilingPolicy`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "creationTime": { "type": "string", "description": "The timestamp when the Agent Registry record was created, in RFC3339 format.\n" }, "description": { "type": "string", "description": "A human-readable description of the Agent Registry record. This field is for documentation purposes and does not affect the agent's behavior.\n" }, "displayName": { "type": "string", "description": "The display name for the Agent Registry record. This field must be unique per Vault namespace. Within Terraform, this is used as the unique identifier for the agent. Changing this on an existing resource will force the resource to be deleted from Vault and a new resource to be created in Vault.\n" }, "entityId": { "type": "string", "description": "The ID of the identity entity to associate with this Agent Registry record. The entity must exist before you create the Agent Registry record.\n" }, "lastUpdatedTime": { "type": "string", "description": "The timestamp when the Agent Registry record was last updated, in RFC3339 format.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "noDefaultCeilingPolicy": { "type": "boolean", "description": "When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, prevents Vault from applying the default ceiling policy to this agent. This allows you to have complete control over the agent's ceiling policies. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "optionalAuthorizationDetails": { "type": "boolean", "description": "When \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, RAR (Rich Authorization Requests) is mandatory and\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003emust be present in the token. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e,\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003ein the JWT token are optional for this agent. This setting works in conjunction with the OAuth Resource Server profile's\u003cspan pulumi-lang-nodejs=\" optionalAuthorizationDetails \" pulumi-lang-dotnet=\" OptionalAuthorizationDetails \" pulumi-lang-go=\" optionalAuthorizationDetails \" pulumi-lang-python=\" optional_authorization_details \" pulumi-lang-yaml=\" optionalAuthorizationDetails \" pulumi-lang-java=\" optionalAuthorizationDetails \" pulumi-lang-hcl=\" optional_authorization_details \"\u003e optionalAuthorizationDetails \u003c/span\u003esetting - RAR is optional if EITHER is \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 2.0.3 or later.\n" }, "owner": { "type": "string", "description": "Owner of the Agent Registry record.\n" } }, "type": "object" } }, "vault:index/audit:Audit": { "description": "## Example Usage\n\n### File Audit Device)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.Audit(\"test\", {\n type: \"file\",\n options: {\n file_path: \"C:/temp/audit.txt\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.Audit(\"test\",\n type=\"file\",\n options={\n \"file_path\": \"C:/temp/audit.txt\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Audit(\"test\", new()\n {\n Type = \"file\",\n Options = \n {\n { \"file_path\", \"C:/temp/audit.txt\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewAudit(ctx, \"test\", \u0026vault.AuditArgs{\n\t\t\tType: pulumi.String(\"file\"),\n\t\t\tOptions: pulumi.StringMap{\n\t\t\t\t\"file_path\": pulumi.String(\"C:/temp/audit.txt\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_audit\" \"test\" {\n type = \"file\"\n options = {\n \"file_path\" = \"C:/temp/audit.txt\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Audit;\nimport com.pulumi.vault.AuditArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new Audit(\"test\", AuditArgs.builder()\n .type(\"file\")\n .options(Map.of(\"file_path\", \"C:/temp/audit.txt\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:Audit\n properties:\n type: file\n options:\n file_path: C:/temp/audit.txt\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\n### Socket Audit Device)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.Audit(\"test\", {\n type: \"socket\",\n path: \"app_socket\",\n local: false,\n options: {\n address: \"127.0.0.1:8000\",\n socket_type: \"tcp\",\n description: \"application x socket\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.Audit(\"test\",\n type=\"socket\",\n path=\"app_socket\",\n local=False,\n options={\n \"address\": \"127.0.0.1:8000\",\n \"socket_type\": \"tcp\",\n \"description\": \"application x socket\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Audit(\"test\", new()\n {\n Type = \"socket\",\n Path = \"app_socket\",\n Local = false,\n Options = \n {\n { \"address\", \"127.0.0.1:8000\" },\n { \"socket_type\", \"tcp\" },\n { \"description\", \"application x socket\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewAudit(ctx, \"test\", \u0026vault.AuditArgs{\n\t\t\tType: pulumi.String(\"socket\"),\n\t\t\tPath: pulumi.String(\"app_socket\"),\n\t\t\tLocal: pulumi.Bool(false),\n\t\t\tOptions: pulumi.StringMap{\n\t\t\t\t\"address\": pulumi.String(\"127.0.0.1:8000\"),\n\t\t\t\t\"socket_type\": pulumi.String(\"tcp\"),\n\t\t\t\t\"description\": pulumi.String(\"application x socket\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_audit\" \"test\" {\n type = \"socket\"\n path = \"app_socket\"\n local = false\n options = {\n \"address\" = \"127.0.0.1:8000\"\n \"socket_type\" = \"tcp\"\n \"description\" = \"application x socket\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Audit;\nimport com.pulumi.vault.AuditArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new Audit(\"test\", AuditArgs.builder()\n .type(\"socket\")\n .path(\"app_socket\")\n .local(false)\n .options(Map.ofEntries(\n Map.entry(\"address\", \"127.0.0.1:8000\"),\n Map.entry(\"socket_type\", \"tcp\"),\n Map.entry(\"description\", \"application x socket\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:Audit\n properties:\n type: socket\n path: app_socket\n local: false\n options:\n address: 127.0.0.1:8000\n socket_type: tcp\n description: application x socket\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAudit devices can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/audit:Audit test syslog\n```\n\n", "properties": { "description": { "type": "string", "description": "Human-friendly description of the audit device.\n" }, "local": { "type": "boolean", "description": "Specifies if the audit device is a local only. Local audit devices are not replicated nor (if a secondary) removed by replication.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Configuration options to pass to the audit device itself.\n\nFor a reference of the device types and their options, consult the [Vault documentation.](https://www.vaultproject.io/docs/audit/index.html)\n" }, "path": { "type": "string", "description": "The path to mount the audit device. This defaults to the type.\n" }, "type": { "type": "string", "description": "Type of the audit device, such as 'file'.\n" } }, "required": [ "options", "path", "type" ], "inputProperties": { "description": { "type": "string", "description": "Human-friendly description of the audit device.\n", "willReplaceOnChanges": true }, "local": { "type": "boolean", "description": "Specifies if the audit device is a local only. Local audit devices are not replicated nor (if a secondary) removed by replication.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Configuration options to pass to the audit device itself.\n\nFor a reference of the device types and their options, consult the [Vault documentation.](https://www.vaultproject.io/docs/audit/index.html)\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path to mount the audit device. This defaults to the type.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Type of the audit device, such as 'file'.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "options", "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering Audit resources.\n", "properties": { "description": { "type": "string", "description": "Human-friendly description of the audit device.\n", "willReplaceOnChanges": true }, "local": { "type": "boolean", "description": "Specifies if the audit device is a local only. Local audit devices are not replicated nor (if a secondary) removed by replication.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Configuration options to pass to the audit device itself.\n\nFor a reference of the device types and their options, consult the [Vault documentation.](https://www.vaultproject.io/docs/audit/index.html)\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path to mount the audit device. This defaults to the type.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Type of the audit device, such as 'file'.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:index/auditRequestHeader:AuditRequestHeader": { "description": "Manages additional request headers that appear in audited requests.\n\n\u003e **Note**\nBecause of the way the [sys/config/auditing/request-headers API](https://www.vaultproject.io/api-docs/system/config-auditing)\nis implemented in Vault, this resource will manage existing audited headers with\nmatching names without requiring import.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst xForwardedFor = new vault.AuditRequestHeader(\"x_forwarded_for\", {\n name: \"X-Forwarded-For\",\n hmac: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nx_forwarded_for = vault.AuditRequestHeader(\"x_forwarded_for\",\n name=\"X-Forwarded-For\",\n hmac=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var xForwardedFor = new Vault.AuditRequestHeader(\"x_forwarded_for\", new()\n {\n Name = \"X-Forwarded-For\",\n Hmac = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewAuditRequestHeader(ctx, \"x_forwarded_for\", \u0026vault.AuditRequestHeaderArgs{\n\t\t\tName: pulumi.String(\"X-Forwarded-For\"),\n\t\t\tHmac: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_auditrequestheader\" \"x_forwarded_for\" {\n name = \"X-Forwarded-For\"\n hmac = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuditRequestHeader;\nimport com.pulumi.vault.AuditRequestHeaderArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var xForwardedFor = new AuditRequestHeader(\"xForwardedFor\", AuditRequestHeaderArgs.builder()\n .name(\"X-Forwarded-For\")\n .hmac(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n xForwardedFor:\n type: vault:AuditRequestHeader\n name: x_forwarded_for\n properties:\n name: X-Forwarded-For\n hmac: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "hmac": { "type": "boolean", "description": "Whether this header's value should be HMAC'd in the audit logs.\n" }, "name": { "type": "string", "description": "The name of the request header to audit.\n" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" } }, "required": [ "name" ], "inputProperties": { "hmac": { "type": "boolean", "description": "Whether this header's value should be HMAC'd in the audit logs.\n" }, "name": { "type": "string", "description": "The name of the request header to audit.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true } }, "stateInputs": { "description": "Input properties used for looking up and filtering AuditRequestHeader resources.\n", "properties": { "hmac": { "type": "boolean", "description": "Whether this header's value should be HMAC'd in the audit logs.\n" }, "name": { "type": "string", "description": "The name of the request header to audit.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:index/authBackend:AuthBackend": { "description": "This resource enables a new auth method at the given path.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.AuthBackend(\"example\", {\n type: \"github\",\n tune: {\n maxLeaseTtl: \"90000s\",\n listingVisibility: \"unauth\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.AuthBackend(\"example\",\n type=\"github\",\n tune={\n \"max_lease_ttl\": \"90000s\",\n \"listing_visibility\": \"unauth\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.AuthBackend(\"example\", new()\n {\n Type = \"github\",\n Tune = new Vault.Inputs.AuthBackendTuneArgs\n {\n MaxLeaseTtl = \"90000s\",\n ListingVisibility = \"unauth\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewAuthBackend(ctx, \"example\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"github\"),\n\t\t\tTune: \u0026vault.AuthBackendTuneArgs{\n\t\t\t\tMaxLeaseTtl: pulumi.String(\"90000s\"),\n\t\t\t\tListingVisibility: pulumi.String(\"unauth\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"example\" {\n type = \"github\"\n tune = {\n max_lease_ttl = \"90000s\"\n listing_visibility = \"unauth\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.inputs.AuthBackendTuneArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .type(\"github\")\n .tune(AuthBackendTuneArgs.builder()\n .maxLeaseTtl(\"90000s\")\n .listingVisibility(\"unauth\")\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:AuthBackend\n properties:\n type: github\n tune:\n maxLeaseTtl: 90000s\n listingVisibility: unauth\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Tutorials \n\nRefer to the following tutorials for additional usage examples:\n\n- [Codify Management of Vault Enterprise Using Terraform](https://learn.hashicorp.com/tutorials/vault/codify-mgmt-enterprise)\n\n- [Codify Management of Vault Using Terraform](https://learn.hashicorp.com/tutorials/vault/codify-mgmt-oss)\n\n## Import\n\nAuth methods can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/authBackend:AuthBackend example github\n```\n\n", "properties": { "accessor": { "type": "string", "description": "The accessor for this auth method\n" }, "description": { "type": "string", "description": "A description of the auth method.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "The path to mount the auth method — this defaults to the name of the type.\n" }, "tune": { "$ref": "#/types/vault:index/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "type": { "type": "string", "description": "The name of the auth method type.\n" } }, "required": [ "accessor", "path", "tune", "type" ], "inputProperties": { "description": { "type": "string", "description": "A description of the auth method.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path to mount the auth method — this defaults to the name of the type.\n" }, "tune": { "$ref": "#/types/vault:index/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "type": { "type": "string", "description": "The name of the auth method type.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "The accessor for this auth method\n" }, "description": { "type": "string", "description": "A description of the auth method.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "identityTokenKey": { "type": "string", "description": "The key to use for signing identity tokens." }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path to mount the auth method — this defaults to the name of the type.\n" }, "tune": { "$ref": "#/types/vault:index/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "type": { "type": "string", "description": "The name of the auth method type.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:index/certAuthBackendRole:CertAuthBackendRole": { "description": "Provides a resource to create a role in an [Cert auth backend within Vault](https://www.vaultproject.io/docs/auth/cert.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst cert = new vault.AuthBackend(\"cert\", {\n path: \"cert\",\n type: \"cert\",\n});\nconst certCertAuthBackendRole = new vault.CertAuthBackendRole(\"cert\", {\n name: \"foo\",\n certificate: std.file({\n input: \"/path/to/certs/ca-cert.pem\",\n }).then(invoke =\u003e invoke.result),\n backend: cert.path,\n allowedNames: [\n \"foo.example.org\",\n \"baz.example.org\",\n ],\n tokenTtl: 300,\n tokenMaxTtl: 600,\n tokenPolicies: [\"foo\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ncert = vault.AuthBackend(\"cert\",\n path=\"cert\",\n type=\"cert\")\ncert_cert_auth_backend_role = vault.CertAuthBackendRole(\"cert\",\n name=\"foo\",\n certificate=std.file(input=\"/path/to/certs/ca-cert.pem\").result,\n backend=cert.path,\n allowed_names=[\n \"foo.example.org\",\n \"baz.example.org\",\n ],\n token_ttl=300,\n token_max_ttl=600,\n token_policies=[\"foo\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var cert = new Vault.AuthBackend(\"cert\", new()\n {\n Path = \"cert\",\n Type = \"cert\",\n });\n\n var certCertAuthBackendRole = new Vault.CertAuthBackendRole(\"cert\", new()\n {\n Name = \"foo\",\n Certificate = Std.File.Invoke(new()\n {\n Input = \"/path/to/certs/ca-cert.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n Backend = cert.Path,\n AllowedNames = new[]\n {\n \"foo.example.org\",\n \"baz.example.org\",\n },\n TokenTtl = 300,\n TokenMaxTtl = 600,\n TokenPolicies = new[]\n {\n \"foo\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tcert, err := vault.NewAuthBackend(ctx, \"cert\", \u0026vault.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"cert\"),\n\t\t\tType: pulumi.String(\"cert\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/certs/ca-cert.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewCertAuthBackendRole(ctx, \"cert\", \u0026vault.CertAuthBackendRoleArgs{\n\t\t\tName: pulumi.String(\"foo\"),\n\t\t\tCertificate: pulumi.String(invokeFile.Result),\n\t\t\tBackend: cert.Path,\n\t\t\tAllowedNames: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"foo.example.org\"),\n\t\t\t\tpulumi.String(\"baz.example.org\"),\n\t\t\t},\n\t\t\tTokenTtl: pulumi.Int(300),\n\t\t\tTokenMaxTtl: pulumi.Int(600),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"foo\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"cert\" {\n path = \"cert\"\n type = \"cert\"\n}\nresource \"vault_certauthbackendrole\" \"cert\" {\n name = \"foo\"\n certificate = file(\"/path/to/certs/ca-cert.pem\")\n backend = vault_authbackend.cert.path\n allowed_names = [\"foo.example.org\", \"baz.example.org\"]\n token_ttl = 300\n token_max_ttl = 600\n token_policies = [\"foo\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.CertAuthBackendRole;\nimport com.pulumi.vault.CertAuthBackendRoleArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var cert = new AuthBackend(\"cert\", AuthBackendArgs.builder()\n .path(\"cert\")\n .type(\"cert\")\n .build());\n\n var certCertAuthBackendRole = new CertAuthBackendRole(\"certCertAuthBackendRole\", CertAuthBackendRoleArgs.builder()\n .name(\"foo\")\n .certificate(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/certs/ca-cert.pem\")\n .build()).result())\n .backend(cert.path())\n .allowedNames( \n \"foo.example.org\",\n \"baz.example.org\")\n .tokenTtl(300)\n .tokenMaxTtl(600)\n .tokenPolicies(\"foo\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n cert:\n type: vault:AuthBackend\n properties:\n path: cert\n type: cert\n certCertAuthBackendRole:\n type: vault:CertAuthBackendRole\n name: cert\n properties:\n name: foo\n certificate:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/certs/ca-cert.pem\n return: result\n backend: ${cert.path}\n allowedNames:\n - foo.example.org\n - baz.example.org\n tokenTtl: 300\n tokenMaxTtl: 600\n tokenPolicies:\n - foo\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowedCommonNames": { "type": "array", "items": { "type": "string" }, "description": "Allowed the common names for authenticated client certificates\n" }, "allowedDnsSans": { "type": "array", "items": { "type": "string" }, "description": "Allowed alternative dns names for authenticated client certificates\n" }, "allowedEmailSans": { "type": "array", "items": { "type": "string" }, "description": "Allowed emails for authenticated client certificates\n" }, "allowedNames": { "type": "array", "items": { "type": "string" }, "description": "DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates\n" }, "allowedOrganizationalUnits": { "type": "array", "items": { "type": "string" }, "description": "Allowed organization units for authenticated client certificates.\n" }, "allowedUriSans": { "type": "array", "items": { "type": "string" }, "description": "Allowed URIs for authenticated client certificates\n" }, "backend": { "type": "string", "description": "Path to the mounted Cert auth backend\n" }, "certificate": { "type": "string", "description": "CA certificate used to validate client certificates\n" }, "displayName": { "type": "string", "description": "The name to display on tokens issued under this role.\n" }, "name": { "type": "string", "description": "Name of the role\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "ocspCaCertificates": { "type": "string", "description": "Any additional CA certificates\nneeded to verify OCSP responses. Provided as base64 encoded PEM data.\nRequires Vault version 1.13+.\n" }, "ocspEnabled": { "type": "boolean", "description": "If enabled, validate certificates'\nrevocation status using OCSP. Requires Vault version 1.13+.\n" }, "ocspFailOpen": { "type": "boolean", "description": "If true and an OCSP response cannot\nbe fetched or is of an unknown status, the login will proceed as if the\ncertificate has not been revoked.\nRequires Vault version 1.13+.\n" }, "ocspMaxRetries": { "type": "integer", "description": "The number of retries to attempt when\nconnecting to an OCSP server. Defaults to 4 retries.\nMust be a non-negative value. Requires Vault version 1.16+.\n" }, "ocspQueryAllServers": { "type": "boolean", "description": "If set to true, rather than\naccepting the first successful OCSP response, query all servers and consider\nthe certificate valid only if all servers agree.\nRequires Vault version 1.13+.\n" }, "ocspServersOverrides": { "type": "array", "items": { "type": "string" }, "description": ": A comma-separated list of OCSP\nserver addresses. If unset, the OCSP server is determined from the\nAuthorityInformationAccess extension on the certificate being inspected.\nRequires Vault version 1.13+.\n" }, "ocspThisUpdateMaxAge": { "type": "integer", "description": "The maximum age in seconds of the\n'thisUpdate' field in an OCSP response before it is considered too old.\nDefaults to 0 (disabled). Must be a non-negative value.\nRequires Vault version 1.16+.\n" }, "requiredExtensions": { "type": "array", "items": { "type": "string" }, "description": "TLS extensions required on\nclient certificates\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "allowedCommonNames", "allowedDnsSans", "allowedEmailSans", "allowedNames", "allowedUriSans", "certificate", "displayName", "name", "ocspEnabled", "ocspFailOpen", "ocspQueryAllServers", "requiredExtensions" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowedCommonNames": { "type": "array", "items": { "type": "string" }, "description": "Allowed the common names for authenticated client certificates\n" }, "allowedDnsSans": { "type": "array", "items": { "type": "string" }, "description": "Allowed alternative dns names for authenticated client certificates\n" }, "allowedEmailSans": { "type": "array", "items": { "type": "string" }, "description": "Allowed emails for authenticated client certificates\n" }, "allowedNames": { "type": "array", "items": { "type": "string" }, "description": "DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates\n" }, "allowedOrganizationalUnits": { "type": "array", "items": { "type": "string" }, "description": "Allowed organization units for authenticated client certificates.\n" }, "allowedUriSans": { "type": "array", "items": { "type": "string" }, "description": "Allowed URIs for authenticated client certificates\n" }, "backend": { "type": "string", "description": "Path to the mounted Cert auth backend\n", "willReplaceOnChanges": true }, "certificate": { "type": "string", "description": "CA certificate used to validate client certificates\n", "willReplaceOnChanges": true }, "displayName": { "type": "string", "description": "The name to display on tokens issued under this role.\n" }, "name": { "type": "string", "description": "Name of the role\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocspCaCertificates": { "type": "string", "description": "Any additional CA certificates\nneeded to verify OCSP responses. Provided as base64 encoded PEM data.\nRequires Vault version 1.13+.\n" }, "ocspEnabled": { "type": "boolean", "description": "If enabled, validate certificates'\nrevocation status using OCSP. Requires Vault version 1.13+.\n" }, "ocspFailOpen": { "type": "boolean", "description": "If true and an OCSP response cannot\nbe fetched or is of an unknown status, the login will proceed as if the\ncertificate has not been revoked.\nRequires Vault version 1.13+.\n" }, "ocspMaxRetries": { "type": "integer", "description": "The number of retries to attempt when\nconnecting to an OCSP server. Defaults to 4 retries.\nMust be a non-negative value. Requires Vault version 1.16+.\n" }, "ocspQueryAllServers": { "type": "boolean", "description": "If set to true, rather than\naccepting the first successful OCSP response, query all servers and consider\nthe certificate valid only if all servers agree.\nRequires Vault version 1.13+.\n" }, "ocspServersOverrides": { "type": "array", "items": { "type": "string" }, "description": ": A comma-separated list of OCSP\nserver addresses. If unset, the OCSP server is determined from the\nAuthorityInformationAccess extension on the certificate being inspected.\nRequires Vault version 1.13+.\n" }, "ocspThisUpdateMaxAge": { "type": "integer", "description": "The maximum age in seconds of the\n'thisUpdate' field in an OCSP response before it is considered too old.\nDefaults to 0 (disabled). Must be a non-negative value.\nRequires Vault version 1.16+.\n" }, "requiredExtensions": { "type": "array", "items": { "type": "string" }, "description": "TLS extensions required on\nclient certificates\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "requiredInputs": [ "certificate" ], "stateInputs": { "description": "Input properties used for looking up and filtering CertAuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowedCommonNames": { "type": "array", "items": { "type": "string" }, "description": "Allowed the common names for authenticated client certificates\n" }, "allowedDnsSans": { "type": "array", "items": { "type": "string" }, "description": "Allowed alternative dns names for authenticated client certificates\n" }, "allowedEmailSans": { "type": "array", "items": { "type": "string" }, "description": "Allowed emails for authenticated client certificates\n" }, "allowedNames": { "type": "array", "items": { "type": "string" }, "description": "DEPRECATED: Please use the individual `allowed_X_sans` parameters instead. Allowed subject names for authenticated client certificates\n" }, "allowedOrganizationalUnits": { "type": "array", "items": { "type": "string" }, "description": "Allowed organization units for authenticated client certificates.\n" }, "allowedUriSans": { "type": "array", "items": { "type": "string" }, "description": "Allowed URIs for authenticated client certificates\n" }, "backend": { "type": "string", "description": "Path to the mounted Cert auth backend\n", "willReplaceOnChanges": true }, "certificate": { "type": "string", "description": "CA certificate used to validate client certificates\n", "willReplaceOnChanges": true }, "displayName": { "type": "string", "description": "The name to display on tokens issued under this role.\n" }, "name": { "type": "string", "description": "Name of the role\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocspCaCertificates": { "type": "string", "description": "Any additional CA certificates\nneeded to verify OCSP responses. Provided as base64 encoded PEM data.\nRequires Vault version 1.13+.\n" }, "ocspEnabled": { "type": "boolean", "description": "If enabled, validate certificates'\nrevocation status using OCSP. Requires Vault version 1.13+.\n" }, "ocspFailOpen": { "type": "boolean", "description": "If true and an OCSP response cannot\nbe fetched or is of an unknown status, the login will proceed as if the\ncertificate has not been revoked.\nRequires Vault version 1.13+.\n" }, "ocspMaxRetries": { "type": "integer", "description": "The number of retries to attempt when\nconnecting to an OCSP server. Defaults to 4 retries.\nMust be a non-negative value. Requires Vault version 1.16+.\n" }, "ocspQueryAllServers": { "type": "boolean", "description": "If set to true, rather than\naccepting the first successful OCSP response, query all servers and consider\nthe certificate valid only if all servers agree.\nRequires Vault version 1.13+.\n" }, "ocspServersOverrides": { "type": "array", "items": { "type": "string" }, "description": ": A comma-separated list of OCSP\nserver addresses. If unset, the OCSP server is determined from the\nAuthorityInformationAccess extension on the certificate being inspected.\nRequires Vault version 1.13+.\n" }, "ocspThisUpdateMaxAge": { "type": "integer", "description": "The maximum age in seconds of the\n'thisUpdate' field in an OCSP response before it is considered too old.\nDefaults to 0 (disabled). Must be a non-negative value.\nRequires Vault version 1.16+.\n" }, "requiredExtensions": { "type": "array", "items": { "type": "string" }, "description": "TLS extensions required on\nclient certificates\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:index/egpPolicy:EgpPolicy": { "description": "Provides a resource to manage Endpoint Governing Policy (EGP) via [Sentinel](https://www.vaultproject.io/docs/enterprise/sentinel/index.html).\n\n**Note** this feature is available only with Vault Enterprise.\n\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst allow_all = new vault.EgpPolicy(\"allow-all\", {\n name: \"allow-all\",\n paths: [\"*\"],\n enforcementLevel: \"soft-mandatory\",\n policy: `main = rule {\n true\n}\n`,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nallow_all = vault.EgpPolicy(\"allow-all\",\n name=\"allow-all\",\n paths=[\"*\"],\n enforcement_level=\"soft-mandatory\",\n policy=\"\"\"main = rule {\n true\n}\n\"\"\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var allow_all = new Vault.EgpPolicy(\"allow-all\", new()\n {\n Name = \"allow-all\",\n Paths = new[]\n {\n \"*\",\n },\n EnforcementLevel = \"soft-mandatory\",\n Policy = @\"main = rule {\n true\n}\n\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewEgpPolicy(ctx, \"allow-all\", \u0026vault.EgpPolicyArgs{\n\t\t\tName: pulumi.String(\"allow-all\"),\n\t\t\tPaths: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*\"),\n\t\t\t},\n\t\t\tEnforcementLevel: pulumi.String(\"soft-mandatory\"),\n\t\t\tPolicy: pulumi.String(\"main = rule {\\n true\\n}\\n\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_egppolicy\" \"allow-all\" {\n name = \"allow-all\"\n paths = [\"*\"]\n enforcement_level = \"soft-mandatory\"\n policy = \"main = rule {\\n true\\n}\\n\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.EgpPolicy;\nimport com.pulumi.vault.EgpPolicyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var allow_all = new EgpPolicy(\"allow-all\", EgpPolicyArgs.builder()\n .name(\"allow-all\")\n .paths(\"*\")\n .enforcementLevel(\"soft-mandatory\")\n .policy(\"\"\"\nmain = rule {\n true\n}\n \"\"\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n allow-all:\n type: vault:EgpPolicy\n properties:\n name: allow-all\n paths:\n - '*'\n enforcementLevel: soft-mandatory\n policy: |\n main = rule {\n true\n }\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "enforcementLevel": { "type": "string", "description": "Enforcement level of Sentinel policy. Can be either \u003cspan pulumi-lang-nodejs=\"`advisory`\" pulumi-lang-dotnet=\"`Advisory`\" pulumi-lang-go=\"`advisory`\" pulumi-lang-python=\"`advisory`\" pulumi-lang-yaml=\"`advisory`\" pulumi-lang-java=\"`advisory`\" pulumi-lang-hcl=\"`advisory`\"\u003e`advisory`\u003c/span\u003e or `soft-mandatory` or `hard-mandatory`\n" }, "name": { "type": "string", "description": "The name of the policy\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "paths": { "type": "array", "items": { "type": "string" }, "description": "List of paths to which the policy will be applied to\n" }, "policy": { "type": "string", "description": "String containing a Sentinel policy\n" } }, "required": [ "enforcementLevel", "name", "paths", "policy" ], "inputProperties": { "enforcementLevel": { "type": "string", "description": "Enforcement level of Sentinel policy. Can be either \u003cspan pulumi-lang-nodejs=\"`advisory`\" pulumi-lang-dotnet=\"`Advisory`\" pulumi-lang-go=\"`advisory`\" pulumi-lang-python=\"`advisory`\" pulumi-lang-yaml=\"`advisory`\" pulumi-lang-java=\"`advisory`\" pulumi-lang-hcl=\"`advisory`\"\u003e`advisory`\u003c/span\u003e or `soft-mandatory` or `hard-mandatory`\n" }, "name": { "type": "string", "description": "The name of the policy\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "paths": { "type": "array", "items": { "type": "string" }, "description": "List of paths to which the policy will be applied to\n" }, "policy": { "type": "string", "description": "String containing a Sentinel policy\n" } }, "requiredInputs": [ "enforcementLevel", "paths", "policy" ], "stateInputs": { "description": "Input properties used for looking up and filtering EgpPolicy resources.\n", "properties": { "enforcementLevel": { "type": "string", "description": "Enforcement level of Sentinel policy. Can be either \u003cspan pulumi-lang-nodejs=\"`advisory`\" pulumi-lang-dotnet=\"`Advisory`\" pulumi-lang-go=\"`advisory`\" pulumi-lang-python=\"`advisory`\" pulumi-lang-yaml=\"`advisory`\" pulumi-lang-java=\"`advisory`\" pulumi-lang-hcl=\"`advisory`\"\u003e`advisory`\u003c/span\u003e or `soft-mandatory` or `hard-mandatory`\n" }, "name": { "type": "string", "description": "The name of the policy\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "paths": { "type": "array", "items": { "type": "string" }, "description": "List of paths to which the policy will be applied to\n" }, "policy": { "type": "string", "description": "String containing a Sentinel policy\n" } }, "type": "object" } }, "vault:index/kerberosAuthBackendConfig:KerberosAuthBackendConfig": { "description": "Manages the configuration of a Kerberos Auth Backend in Vault.\n\nThis resource configures the Kerberos authentication method by providing the keytab\nand service account information required for Vault to authenticate users via Kerberos.\n\nFor more information, see the\n[Vault docs](https://www.vaultproject.io/docs/auth/kerberos).\n\n\u003e **Important** The \u003cspan pulumi-lang-nodejs=\"`keytabWo`\" pulumi-lang-dotnet=\"`KeytabWo`\" pulumi-lang-go=\"`keytabWo`\" pulumi-lang-python=\"`keytab_wo`\" pulumi-lang-yaml=\"`keytabWo`\" pulumi-lang-java=\"`keytabWo`\" pulumi-lang-hcl=\"`keytab_wo`\"\u003e`keytabWo`\u003c/span\u003e field is write-only and is not stored in Terraform state.\nIt is only sent to Vault when the \u003cspan pulumi-lang-nodejs=\"`keytabWoVersion`\" pulumi-lang-dotnet=\"`KeytabWoVersion`\" pulumi-lang-go=\"`keytabWoVersion`\" pulumi-lang-python=\"`keytab_wo_version`\" pulumi-lang-yaml=\"`keytabWoVersion`\" pulumi-lang-java=\"`keytabWoVersion`\" pulumi-lang-hcl=\"`keytab_wo_version`\"\u003e`keytabWoVersion`\u003c/span\u003e changes or during initial creation.\nSee the main provider documentation for more details.\n\n\u003e **Note** Vault does not support deleting auth backend configurations via the API.\nWhen this resource is destroyed or replaced (e.g., when changing the \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e), it is \nonly removed from Terraform state. The configuration remains in Vault until the auth \nmount itself is deleted.\n\n## Example Usage\n\n### Basic Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst config = new vault.KerberosAuthBackendConfig(\"config\", {\n mount: kerberos.path,\n keytabWo: std.filebase64({\n input: \"/path/to/vault.keytab\",\n }).then(invoke =\u003e invoke.result),\n keytabWoVersion: 1,\n serviceAccount: \"vault/localhost@EXAMPLE.COM\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nkerberos = vault.AuthBackend(\"kerberos\",\n type=\"kerberos\",\n path=\"kerberos\")\nconfig = vault.KerberosAuthBackendConfig(\"config\",\n mount=kerberos.path,\n keytab_wo=std.filebase64(input=\"/path/to/vault.keytab\").result,\n keytab_wo_version=1,\n service_account=\"vault/localhost@EXAMPLE.COM\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var config = new Vault.KerberosAuthBackendConfig(\"config\", new()\n {\n Mount = kerberos.Path,\n KeytabWo = Std.Filebase64.Invoke(new()\n {\n Input = \"/path/to/vault.keytab\",\n }).Apply(invoke =\u003e invoke.Result),\n KeytabWoVersion = 1,\n ServiceAccount = \"vault/localhost@EXAMPLE.COM\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFilebase64, err := std.Filebase64(ctx, \u0026std.Filebase64Args{\n\t\t\tInput: \"/path/to/vault.keytab\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendConfig(ctx, \"config\", \u0026vault.KerberosAuthBackendConfigArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tKeytabWo: pulumi.String(invokeFilebase64.Result),\n\t\t\tKeytabWoVersion: pulumi.Int(1),\n\t\t\tServiceAccount: pulumi.String(\"vault/localhost@EXAMPLE.COM\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kerberos\" {\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendconfig\" \"config\" {\n mount = vault_authbackend.kerberos.path\n keytab_wo = filebase64(\"/path/to/vault.keytab\")\n keytab_wo_version = 1\n service_account = \"vault/localhost@EXAMPLE.COM\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendConfig;\nimport com.pulumi.vault.KerberosAuthBackendConfigArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.Filebase64Args;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var config = new KerberosAuthBackendConfig(\"config\", KerberosAuthBackendConfigArgs.builder()\n .mount(kerberos.path())\n .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()\n .input(\"/path/to/vault.keytab\")\n .build()).result())\n .keytabWoVersion(1)\n .serviceAccount(\"vault/localhost@EXAMPLE.COM\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kerberos:\n type: vault:AuthBackend\n properties:\n type: kerberos\n path: kerberos\n config:\n type: vault:KerberosAuthBackendConfig\n properties:\n mount: ${kerberos.path}\n keytabWo:\n fn::invoke:\n function: std:filebase64\n arguments:\n input: /path/to/vault.keytab\n return: result\n keytabWoVersion: 1\n serviceAccount: vault/localhost@EXAMPLE.COM\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Full Configuration with All Options\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst config = new vault.KerberosAuthBackendConfig(\"config\", {\n mount: kerberos.path,\n keytabWo: std.filebase64({\n input: \"/path/to/vault.keytab\",\n }).then(invoke =\u003e invoke.result),\n keytabWoVersion: 1,\n serviceAccount: \"vault/localhost@EXAMPLE.COM\",\n removeInstanceName: true,\n addGroupAliases: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nkerberos = vault.AuthBackend(\"kerberos\",\n type=\"kerberos\",\n path=\"kerberos\")\nconfig = vault.KerberosAuthBackendConfig(\"config\",\n mount=kerberos.path,\n keytab_wo=std.filebase64(input=\"/path/to/vault.keytab\").result,\n keytab_wo_version=1,\n service_account=\"vault/localhost@EXAMPLE.COM\",\n remove_instance_name=True,\n add_group_aliases=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var config = new Vault.KerberosAuthBackendConfig(\"config\", new()\n {\n Mount = kerberos.Path,\n KeytabWo = Std.Filebase64.Invoke(new()\n {\n Input = \"/path/to/vault.keytab\",\n }).Apply(invoke =\u003e invoke.Result),\n KeytabWoVersion = 1,\n ServiceAccount = \"vault/localhost@EXAMPLE.COM\",\n RemoveInstanceName = true,\n AddGroupAliases = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFilebase64, err := std.Filebase64(ctx, \u0026std.Filebase64Args{\n\t\t\tInput: \"/path/to/vault.keytab\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendConfig(ctx, \"config\", \u0026vault.KerberosAuthBackendConfigArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tKeytabWo: pulumi.String(invokeFilebase64.Result),\n\t\t\tKeytabWoVersion: pulumi.Int(1),\n\t\t\tServiceAccount: pulumi.String(\"vault/localhost@EXAMPLE.COM\"),\n\t\t\tRemoveInstanceName: pulumi.Bool(true),\n\t\t\tAddGroupAliases: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kerberos\" {\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendconfig\" \"config\" {\n mount = vault_authbackend.kerberos.path\n keytab_wo = filebase64(\"/path/to/vault.keytab\")\n keytab_wo_version = 1\n service_account = \"vault/localhost@EXAMPLE.COM\"\n remove_instance_name = true\n add_group_aliases = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendConfig;\nimport com.pulumi.vault.KerberosAuthBackendConfigArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.Filebase64Args;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var config = new KerberosAuthBackendConfig(\"config\", KerberosAuthBackendConfigArgs.builder()\n .mount(kerberos.path())\n .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()\n .input(\"/path/to/vault.keytab\")\n .build()).result())\n .keytabWoVersion(1)\n .serviceAccount(\"vault/localhost@EXAMPLE.COM\")\n .removeInstanceName(true)\n .addGroupAliases(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kerberos:\n type: vault:AuthBackend\n properties:\n type: kerberos\n path: kerberos\n config:\n type: vault:KerberosAuthBackendConfig\n properties:\n mount: ${kerberos.path}\n keytabWo:\n fn::invoke:\n function: std:filebase64\n arguments:\n input: /path/to/vault.keytab\n return: result\n keytabWoVersion: 1\n serviceAccount: vault/localhost@EXAMPLE.COM\n removeInstanceName: true\n addGroupAliases: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Namespace (Vault Enterprise)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.Namespace(\"example\", {path: \"example-namespace\"});\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n namespace: example.path,\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst config = new vault.KerberosAuthBackendConfig(\"config\", {\n namespace: example.path,\n mount: kerberos.path,\n keytabWo: std.filebase64({\n input: \"/path/to/vault.keytab\",\n }).then(invoke =\u003e invoke.result),\n keytabWoVersion: 1,\n serviceAccount: \"vault/localhost@EXAMPLE.COM\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nexample = vault.Namespace(\"example\", path=\"example-namespace\")\nkerberos = vault.AuthBackend(\"kerberos\",\n namespace=example.path,\n type=\"kerberos\",\n path=\"kerberos\")\nconfig = vault.KerberosAuthBackendConfig(\"config\",\n namespace=example.path,\n mount=kerberos.path,\n keytab_wo=std.filebase64(input=\"/path/to/vault.keytab\").result,\n keytab_wo_version=1,\n service_account=\"vault/localhost@EXAMPLE.COM\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Namespace(\"example\", new()\n {\n Path = \"example-namespace\",\n });\n\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Namespace = example.Path,\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var config = new Vault.KerberosAuthBackendConfig(\"config\", new()\n {\n Namespace = example.Path,\n Mount = kerberos.Path,\n KeytabWo = Std.Filebase64.Invoke(new()\n {\n Input = \"/path/to/vault.keytab\",\n }).Apply(invoke =\u003e invoke.Result),\n KeytabWoVersion = 1,\n ServiceAccount = \"vault/localhost@EXAMPLE.COM\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewNamespace(ctx, \"example\", \u0026vault.NamespaceArgs{\n\t\t\tPath: pulumi.String(\"example-namespace\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tNamespace: example.Path,\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFilebase64, err := std.Filebase64(ctx, \u0026std.Filebase64Args{\n\t\t\tInput: \"/path/to/vault.keytab\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendConfig(ctx, \"config\", \u0026vault.KerberosAuthBackendConfigArgs{\n\t\t\tNamespace: example.Path,\n\t\t\tMount: kerberos.Path,\n\t\t\tKeytabWo: pulumi.String(invokeFilebase64.Result),\n\t\t\tKeytabWoVersion: pulumi.Int(1),\n\t\t\tServiceAccount: pulumi.String(\"vault/localhost@EXAMPLE.COM\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_namespace\" \"example\" {\n path = \"example-namespace\"\n}\nresource \"vault_authbackend\" \"kerberos\" {\n namespace = vault_namespace.example.path\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendconfig\" \"config\" {\n namespace = vault_namespace.example.path\n mount = vault_authbackend.kerberos.path\n keytab_wo = filebase64(\"/path/to/vault.keytab\")\n keytab_wo_version = 1\n service_account = \"vault/localhost@EXAMPLE.COM\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Namespace;\nimport com.pulumi.vault.NamespaceArgs;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendConfig;\nimport com.pulumi.vault.KerberosAuthBackendConfigArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.Filebase64Args;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new Namespace(\"example\", NamespaceArgs.builder()\n .path(\"example-namespace\")\n .build());\n\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .namespace(example.path())\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var config = new KerberosAuthBackendConfig(\"config\", KerberosAuthBackendConfigArgs.builder()\n .namespace(example.path())\n .mount(kerberos.path())\n .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()\n .input(\"/path/to/vault.keytab\")\n .build()).result())\n .keytabWoVersion(1)\n .serviceAccount(\"vault/localhost@EXAMPLE.COM\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:Namespace\n properties:\n path: example-namespace\n kerberos:\n type: vault:AuthBackend\n properties:\n namespace: ${example.path}\n type: kerberos\n path: kerberos\n config:\n type: vault:KerberosAuthBackendConfig\n properties:\n namespace: ${example.path}\n mount: ${kerberos.path}\n keytabWo:\n fn::invoke:\n function: std:filebase64\n arguments:\n input: /path/to/vault.keytab\n return: result\n keytabWoVersion: 1\n serviceAccount: vault/localhost@EXAMPLE.COM\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKerberos auth backend configurations can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/kerberosAuthBackendConfig:KerberosAuthBackendConfig config auth/kerberos/config\n```\n\n\u003e **Note** The \u003cspan pulumi-lang-nodejs=\"`keytabWo`\" pulumi-lang-dotnet=\"`KeytabWo`\" pulumi-lang-go=\"`keytabWo`\" pulumi-lang-python=\"`keytab_wo`\" pulumi-lang-yaml=\"`keytabWo`\" pulumi-lang-java=\"`keytabWo`\" pulumi-lang-hcl=\"`keytab_wo`\"\u003e`keytabWo`\u003c/span\u003e field cannot be imported as it is write-only and not stored\nin state. You will need to provide it in your configuration after import.\n\n### Importing with Namespace (Vault Enterprise)\n\nFor Vault Enterprise with namespaces, set the `TERRAFORM_VAULT_NAMESPACE_IMPORT` environment variable \nbefore importing:\n\n```\n$ export TERRAFORM_VAULT_NAMESPACE_IMPORT=example-namespace\n$ terraform import vault_kerberos_auth_backend_config.config auth/kerberos/config\n\n```", "properties": { "addGroupAliases": { "type": "boolean", "description": "Adds group aliases during authentication. When \nenabled, Vault will create entity aliases for each group the user belongs to.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "keytabWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nBase64-encoded keytab file content. This is a write-only\nfield and is not stored in Terraform state. The keytab must contain an entry\nmatching the \u003cspan pulumi-lang-nodejs=\"`serviceAccount`\" pulumi-lang-dotnet=\"`ServiceAccount`\" pulumi-lang-go=\"`serviceAccount`\" pulumi-lang-python=\"`service_account`\" pulumi-lang-yaml=\"`serviceAccount`\" pulumi-lang-java=\"`serviceAccount`\" pulumi-lang-hcl=\"`service_account`\"\u003e`serviceAccount`\u003c/span\u003e.\n", "secret": true }, "keytabWoVersion": { "type": "integer", "description": "Version identifier for keytab updates. Increment this\nvalue to trigger a keytab update in Vault. This allows you to rotate the keytab without\nforcing resource replacement.\n" }, "mount": { "type": "string", "description": "Path where the Kerberos auth method is mounted.\nChanging this will force a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "removeInstanceName": { "type": "boolean", "description": "Removes instance names from Kerberos service \nprincipal names during authentication. This can be useful when the instance name\nis not relevant for authentication. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "serviceAccount": { "type": "string", "description": "The Kerberos service account associated with the \nkeytab entry (e.g., `vault/localhost@EXAMPLE.COM` or \u003cspan pulumi-lang-nodejs=\"`vaultSvc`\" pulumi-lang-dotnet=\"`VaultSvc`\" pulumi-lang-go=\"`vaultSvc`\" pulumi-lang-python=\"`vault_svc`\" pulumi-lang-yaml=\"`vaultSvc`\" pulumi-lang-java=\"`vaultSvc`\" pulumi-lang-hcl=\"`vault_svc`\"\u003e`vaultSvc`\u003c/span\u003e).\n" } }, "required": [ "keytabWo", "keytabWoVersion", "mount", "serviceAccount" ], "inputProperties": { "addGroupAliases": { "type": "boolean", "description": "Adds group aliases during authentication. When \nenabled, Vault will create entity aliases for each group the user belongs to.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "keytabWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nBase64-encoded keytab file content. This is a write-only\nfield and is not stored in Terraform state. The keytab must contain an entry\nmatching the \u003cspan pulumi-lang-nodejs=\"`serviceAccount`\" pulumi-lang-dotnet=\"`ServiceAccount`\" pulumi-lang-go=\"`serviceAccount`\" pulumi-lang-python=\"`service_account`\" pulumi-lang-yaml=\"`serviceAccount`\" pulumi-lang-java=\"`serviceAccount`\" pulumi-lang-hcl=\"`service_account`\"\u003e`serviceAccount`\u003c/span\u003e.\n", "secret": true }, "keytabWoVersion": { "type": "integer", "description": "Version identifier for keytab updates. Increment this\nvalue to trigger a keytab update in Vault. This allows you to rotate the keytab without\nforcing resource replacement.\n" }, "mount": { "type": "string", "description": "Path where the Kerberos auth method is mounted.\nChanging this will force a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "removeInstanceName": { "type": "boolean", "description": "Removes instance names from Kerberos service \nprincipal names during authentication. This can be useful when the instance name\nis not relevant for authentication. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "serviceAccount": { "type": "string", "description": "The Kerberos service account associated with the \nkeytab entry (e.g., `vault/localhost@EXAMPLE.COM` or \u003cspan pulumi-lang-nodejs=\"`vaultSvc`\" pulumi-lang-dotnet=\"`VaultSvc`\" pulumi-lang-go=\"`vaultSvc`\" pulumi-lang-python=\"`vault_svc`\" pulumi-lang-yaml=\"`vaultSvc`\" pulumi-lang-java=\"`vaultSvc`\" pulumi-lang-hcl=\"`vault_svc`\"\u003e`vaultSvc`\u003c/span\u003e).\n" } }, "requiredInputs": [ "keytabWo", "keytabWoVersion", "mount", "serviceAccount" ], "stateInputs": { "description": "Input properties used for looking up and filtering KerberosAuthBackendConfig resources.\n", "properties": { "addGroupAliases": { "type": "boolean", "description": "Adds group aliases during authentication. When \nenabled, Vault will create entity aliases for each group the user belongs to.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "keytabWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nBase64-encoded keytab file content. This is a write-only\nfield and is not stored in Terraform state. The keytab must contain an entry\nmatching the \u003cspan pulumi-lang-nodejs=\"`serviceAccount`\" pulumi-lang-dotnet=\"`ServiceAccount`\" pulumi-lang-go=\"`serviceAccount`\" pulumi-lang-python=\"`service_account`\" pulumi-lang-yaml=\"`serviceAccount`\" pulumi-lang-java=\"`serviceAccount`\" pulumi-lang-hcl=\"`service_account`\"\u003e`serviceAccount`\u003c/span\u003e.\n", "secret": true }, "keytabWoVersion": { "type": "integer", "description": "Version identifier for keytab updates. Increment this\nvalue to trigger a keytab update in Vault. This allows you to rotate the keytab without\nforcing resource replacement.\n" }, "mount": { "type": "string", "description": "Path where the Kerberos auth method is mounted.\nChanging this will force a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "removeInstanceName": { "type": "boolean", "description": "Removes instance names from Kerberos service \nprincipal names during authentication. This can be useful when the instance name\nis not relevant for authentication. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "serviceAccount": { "type": "string", "description": "The Kerberos service account associated with the \nkeytab entry (e.g., `vault/localhost@EXAMPLE.COM` or \u003cspan pulumi-lang-nodejs=\"`vaultSvc`\" pulumi-lang-dotnet=\"`VaultSvc`\" pulumi-lang-go=\"`vaultSvc`\" pulumi-lang-python=\"`vault_svc`\" pulumi-lang-yaml=\"`vaultSvc`\" pulumi-lang-java=\"`vaultSvc`\" pulumi-lang-hcl=\"`vault_svc`\"\u003e`vaultSvc`\u003c/span\u003e).\n" } }, "type": "object" } }, "vault:index/kerberosAuthBackendGroup:KerberosAuthBackendGroup": { "description": "Manages LDAP group to Vault policy mappings for the Kerberos authentication method in Vault.\n\nThis resource allows you to map LDAP groups to Vault policies when using the Kerberos \nauthentication method. After a user successfully authenticates via Kerberos, Vault queries \nLDAP to determine the user's group memberships. These group mappings then \ndetermine which Vault policies are assigned to the authenticated user's token.\n\nFor more information, see the\n[Vault Kerberos Auth Method documentation](https://www.vaultproject.io/docs/auth/kerberos).\n\n\u003e **Note** This resource requires that LDAP integration be configured for the Kerberos \nauth method using \u003cspan pulumi-lang-nodejs=\"`vault.KerberosAuthBackendLdapConfig`\" pulumi-lang-dotnet=\"`vault.KerberosAuthBackendLdapConfig`\" pulumi-lang-go=\"`KerberosAuthBackendLdapConfig`\" pulumi-lang-python=\"`KerberosAuthBackendLdapConfig`\" pulumi-lang-yaml=\"`vault.KerberosAuthBackendLdapConfig`\" pulumi-lang-java=\"`vault.KerberosAuthBackendLdapConfig`\" pulumi-lang-hcl=\"`vault_kerberos_auth_backend_ldap_config`\"\u003e`vault.KerberosAuthBackendLdapConfig`\u003c/span\u003e. \nWithout LDAP configuration, group mappings cannot be resolved.\n\n## Example Usage\n\n### Basic Group Mapping\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst kerberosKerberosAuthBackendConfig = new vault.KerberosAuthBackendConfig(\"kerberos\", {\n mount: kerberos.path,\n keytabWo: std.filebase64({\n input: \"/path/to/vault.keytab\",\n }).then(invoke =\u003e invoke.result),\n keytabWoVersion: 1,\n serviceAccount: \"vault/localhost@EXAMPLE.COM\",\n});\nconst ldap = new vault.KerberosAuthBackendLdapConfig(\"ldap\", {\n mount: kerberos.path,\n url: \"ldap://ldap.example.com\",\n binddn: \"cn=vault,ou=Users,dc=example,dc=com\",\n userdn: \"ou=People,dc=example,dc=org\",\n groupdn: \"ou=Groups,dc=example,dc=org\",\n});\nconst developers = new vault.KerberosAuthBackendGroup(\"developers\", {\n mount: kerberos.path,\n name: \"developers\",\n policies: [\n \"dev-policy\",\n \"read-only\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nkerberos = vault.AuthBackend(\"kerberos\",\n type=\"kerberos\",\n path=\"kerberos\")\nkerberos_kerberos_auth_backend_config = vault.KerberosAuthBackendConfig(\"kerberos\",\n mount=kerberos.path,\n keytab_wo=std.filebase64(input=\"/path/to/vault.keytab\").result,\n keytab_wo_version=1,\n service_account=\"vault/localhost@EXAMPLE.COM\")\nldap = vault.KerberosAuthBackendLdapConfig(\"ldap\",\n mount=kerberos.path,\n url=\"ldap://ldap.example.com\",\n binddn=\"cn=vault,ou=Users,dc=example,dc=com\",\n userdn=\"ou=People,dc=example,dc=org\",\n groupdn=\"ou=Groups,dc=example,dc=org\")\ndevelopers = vault.KerberosAuthBackendGroup(\"developers\",\n mount=kerberos.path,\n name=\"developers\",\n policies=[\n \"dev-policy\",\n \"read-only\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var kerberosKerberosAuthBackendConfig = new Vault.KerberosAuthBackendConfig(\"kerberos\", new()\n {\n Mount = kerberos.Path,\n KeytabWo = Std.Filebase64.Invoke(new()\n {\n Input = \"/path/to/vault.keytab\",\n }).Apply(invoke =\u003e invoke.Result),\n KeytabWoVersion = 1,\n ServiceAccount = \"vault/localhost@EXAMPLE.COM\",\n });\n\n var ldap = new Vault.KerberosAuthBackendLdapConfig(\"ldap\", new()\n {\n Mount = kerberos.Path,\n Url = \"ldap://ldap.example.com\",\n Binddn = \"cn=vault,ou=Users,dc=example,dc=com\",\n Userdn = \"ou=People,dc=example,dc=org\",\n Groupdn = \"ou=Groups,dc=example,dc=org\",\n });\n\n var developers = new Vault.KerberosAuthBackendGroup(\"developers\", new()\n {\n Mount = kerberos.Path,\n Name = \"developers\",\n Policies = new[]\n {\n \"dev-policy\",\n \"read-only\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFilebase64, err := std.Filebase64(ctx, \u0026std.Filebase64Args{\n\t\t\tInput: \"/path/to/vault.keytab\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendConfig(ctx, \"kerberos\", \u0026vault.KerberosAuthBackendConfigArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tKeytabWo: pulumi.String(invokeFilebase64.Result),\n\t\t\tKeytabWoVersion: pulumi.Int(1),\n\t\t\tServiceAccount: pulumi.String(\"vault/localhost@EXAMPLE.COM\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, \"ldap\", \u0026vault.KerberosAuthBackendLdapConfigArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tUrl: pulumi.String(\"ldap://ldap.example.com\"),\n\t\t\tBinddn: pulumi.String(\"cn=vault,ou=Users,dc=example,dc=com\"),\n\t\t\tUserdn: pulumi.String(\"ou=People,dc=example,dc=org\"),\n\t\t\tGroupdn: pulumi.String(\"ou=Groups,dc=example,dc=org\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendGroup(ctx, \"developers\", \u0026vault.KerberosAuthBackendGroupArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tName: pulumi.String(\"developers\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dev-policy\"),\n\t\t\t\tpulumi.String(\"read-only\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kerberos\" {\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendconfig\" \"kerberos\" {\n mount = vault_authbackend.kerberos.path\n keytab_wo = filebase64(\"/path/to/vault.keytab\")\n keytab_wo_version = 1\n service_account = \"vault/localhost@EXAMPLE.COM\"\n}\nresource \"vault_kerberosauthbackendldapconfig\" \"ldap\" {\n mount = vault_authbackend.kerberos.path\n url = \"ldap://ldap.example.com\"\n binddn = \"cn=vault,ou=Users,dc=example,dc=com\"\n userdn = \"ou=People,dc=example,dc=org\"\n groupdn = \"ou=Groups,dc=example,dc=org\"\n}\nresource \"vault_kerberosauthbackendgroup\" \"developers\" {\n mount = vault_authbackend.kerberos.path\n name = \"developers\"\n policies = [\"dev-policy\", \"read-only\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendConfig;\nimport com.pulumi.vault.KerberosAuthBackendConfigArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.Filebase64Args;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfig;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;\nimport com.pulumi.vault.KerberosAuthBackendGroup;\nimport com.pulumi.vault.KerberosAuthBackendGroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var kerberosKerberosAuthBackendConfig = new KerberosAuthBackendConfig(\"kerberosKerberosAuthBackendConfig\", KerberosAuthBackendConfigArgs.builder()\n .mount(kerberos.path())\n .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()\n .input(\"/path/to/vault.keytab\")\n .build()).result())\n .keytabWoVersion(1)\n .serviceAccount(\"vault/localhost@EXAMPLE.COM\")\n .build());\n\n var ldap = new KerberosAuthBackendLdapConfig(\"ldap\", KerberosAuthBackendLdapConfigArgs.builder()\n .mount(kerberos.path())\n .url(\"ldap://ldap.example.com\")\n .binddn(\"cn=vault,ou=Users,dc=example,dc=com\")\n .userdn(\"ou=People,dc=example,dc=org\")\n .groupdn(\"ou=Groups,dc=example,dc=org\")\n .build());\n\n var developers = new KerberosAuthBackendGroup(\"developers\", KerberosAuthBackendGroupArgs.builder()\n .mount(kerberos.path())\n .name(\"developers\")\n .policies( \n \"dev-policy\",\n \"read-only\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kerberos:\n type: vault:AuthBackend\n properties:\n type: kerberos\n path: kerberos\n kerberosKerberosAuthBackendConfig:\n type: vault:KerberosAuthBackendConfig\n name: kerberos\n properties:\n mount: ${kerberos.path}\n keytabWo:\n fn::invoke:\n function: std:filebase64\n arguments:\n input: /path/to/vault.keytab\n return: result\n keytabWoVersion: 1\n serviceAccount: vault/localhost@EXAMPLE.COM\n ldap:\n type: vault:KerberosAuthBackendLdapConfig\n properties:\n mount: ${kerberos.path}\n url: ldap://ldap.example.com\n binddn: cn=vault,ou=Users,dc=example,dc=com\n userdn: ou=People,dc=example,dc=org\n groupdn: ou=Groups,dc=example,dc=org\n developers:\n type: vault:KerberosAuthBackendGroup\n properties:\n mount: ${kerberos.path}\n name: developers\n policies:\n - dev-policy\n - read-only\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Multiple Group Mappings\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst admins = new vault.KerberosAuthBackendGroup(\"admins\", {\n mount: kerberos.path,\n name: \"admins\",\n policies: [\n \"admin-policy\",\n \"default\",\n ],\n});\nconst developers = new vault.KerberosAuthBackendGroup(\"developers\", {\n mount: kerberos.path,\n name: \"developers\",\n policies: [\n \"dev-policy\",\n \"default\",\n ],\n});\nconst readonly = new vault.KerberosAuthBackendGroup(\"readonly\", {\n mount: kerberos.path,\n name: \"readonly-users\",\n policies: [\"read-only\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkerberos = vault.AuthBackend(\"kerberos\",\n type=\"kerberos\",\n path=\"kerberos\")\nadmins = vault.KerberosAuthBackendGroup(\"admins\",\n mount=kerberos.path,\n name=\"admins\",\n policies=[\n \"admin-policy\",\n \"default\",\n ])\ndevelopers = vault.KerberosAuthBackendGroup(\"developers\",\n mount=kerberos.path,\n name=\"developers\",\n policies=[\n \"dev-policy\",\n \"default\",\n ])\nreadonly = vault.KerberosAuthBackendGroup(\"readonly\",\n mount=kerberos.path,\n name=\"readonly-users\",\n policies=[\"read-only\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var admins = new Vault.KerberosAuthBackendGroup(\"admins\", new()\n {\n Mount = kerberos.Path,\n Name = \"admins\",\n Policies = new[]\n {\n \"admin-policy\",\n \"default\",\n },\n });\n\n var developers = new Vault.KerberosAuthBackendGroup(\"developers\", new()\n {\n Mount = kerberos.Path,\n Name = \"developers\",\n Policies = new[]\n {\n \"dev-policy\",\n \"default\",\n },\n });\n\n var @readonly = new Vault.KerberosAuthBackendGroup(\"readonly\", new()\n {\n Mount = kerberos.Path,\n Name = \"readonly-users\",\n Policies = new[]\n {\n \"read-only\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendGroup(ctx, \"admins\", \u0026vault.KerberosAuthBackendGroupArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tName: pulumi.String(\"admins\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"admin-policy\"),\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendGroup(ctx, \"developers\", \u0026vault.KerberosAuthBackendGroupArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tName: pulumi.String(\"developers\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dev-policy\"),\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendGroup(ctx, \"readonly\", \u0026vault.KerberosAuthBackendGroupArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tName: pulumi.String(\"readonly-users\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"read-only\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kerberos\" {\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendgroup\" \"admins\" {\n mount = vault_authbackend.kerberos.path\n name = \"admins\"\n policies = [\"admin-policy\", \"default\"]\n}\nresource \"vault_kerberosauthbackendgroup\" \"developers\" {\n mount = vault_authbackend.kerberos.path\n name = \"developers\"\n policies = [\"dev-policy\", \"default\"]\n}\nresource \"vault_kerberosauthbackendgroup\" \"readonly\" {\n mount = vault_authbackend.kerberos.path\n name = \"readonly-users\"\n policies = [\"read-only\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendGroup;\nimport com.pulumi.vault.KerberosAuthBackendGroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var admins = new KerberosAuthBackendGroup(\"admins\", KerberosAuthBackendGroupArgs.builder()\n .mount(kerberos.path())\n .name(\"admins\")\n .policies( \n \"admin-policy\",\n \"default\")\n .build());\n\n var developers = new KerberosAuthBackendGroup(\"developers\", KerberosAuthBackendGroupArgs.builder()\n .mount(kerberos.path())\n .name(\"developers\")\n .policies( \n \"dev-policy\",\n \"default\")\n .build());\n\n var readonly = new KerberosAuthBackendGroup(\"readonly\", KerberosAuthBackendGroupArgs.builder()\n .mount(kerberos.path())\n .name(\"readonly-users\")\n .policies(\"read-only\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kerberos:\n type: vault:AuthBackend\n properties:\n type: kerberos\n path: kerberos\n admins:\n type: vault:KerberosAuthBackendGroup\n properties:\n mount: ${kerberos.path}\n name: admins\n policies:\n - admin-policy\n - default\n developers:\n type: vault:KerberosAuthBackendGroup\n properties:\n mount: ${kerberos.path}\n name: developers\n policies:\n - dev-policy\n - default\n readonly:\n type: vault:KerberosAuthBackendGroup\n properties:\n mount: ${kerberos.path}\n name: readonly-users\n policies:\n - read-only\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Namespace (Vault Enterprise)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.Namespace(\"example\", {path: \"example-namespace\"});\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n namespace: example.path,\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst team = new vault.KerberosAuthBackendGroup(\"team\", {\n namespace: example.path,\n mount: kerberos.path,\n name: \"team-alpha\",\n policies: [\"team-alpha-policy\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.Namespace(\"example\", path=\"example-namespace\")\nkerberos = vault.AuthBackend(\"kerberos\",\n namespace=example.path,\n type=\"kerberos\",\n path=\"kerberos\")\nteam = vault.KerberosAuthBackendGroup(\"team\",\n namespace=example.path,\n mount=kerberos.path,\n name=\"team-alpha\",\n policies=[\"team-alpha-policy\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Namespace(\"example\", new()\n {\n Path = \"example-namespace\",\n });\n\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Namespace = example.Path,\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var team = new Vault.KerberosAuthBackendGroup(\"team\", new()\n {\n Namespace = example.Path,\n Mount = kerberos.Path,\n Name = \"team-alpha\",\n Policies = new[]\n {\n \"team-alpha-policy\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewNamespace(ctx, \"example\", \u0026vault.NamespaceArgs{\n\t\t\tPath: pulumi.String(\"example-namespace\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tNamespace: example.Path,\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendGroup(ctx, \"team\", \u0026vault.KerberosAuthBackendGroupArgs{\n\t\t\tNamespace: example.Path,\n\t\t\tMount: kerberos.Path,\n\t\t\tName: pulumi.String(\"team-alpha\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"team-alpha-policy\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_namespace\" \"example\" {\n path = \"example-namespace\"\n}\nresource \"vault_authbackend\" \"kerberos\" {\n namespace = vault_namespace.example.path\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendgroup\" \"team\" {\n namespace = vault_namespace.example.path\n mount = vault_authbackend.kerberos.path\n name = \"team-alpha\"\n policies = [\"team-alpha-policy\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Namespace;\nimport com.pulumi.vault.NamespaceArgs;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendGroup;\nimport com.pulumi.vault.KerberosAuthBackendGroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new Namespace(\"example\", NamespaceArgs.builder()\n .path(\"example-namespace\")\n .build());\n\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .namespace(example.path())\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var team = new KerberosAuthBackendGroup(\"team\", KerberosAuthBackendGroupArgs.builder()\n .namespace(example.path())\n .mount(kerberos.path())\n .name(\"team-alpha\")\n .policies(\"team-alpha-policy\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:Namespace\n properties:\n path: example-namespace\n kerberos:\n type: vault:AuthBackend\n properties:\n namespace: ${example.path}\n type: kerberos\n path: kerberos\n team:\n type: vault:KerberosAuthBackendGroup\n properties:\n namespace: ${example.path}\n mount: ${kerberos.path}\n name: team-alpha\n policies:\n - team-alpha-policy\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Group Without Policies\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n type: \"kerberos\",\n path: \"kerberos\",\n});\n// Create a group mapping without policies\n// Useful for tracking groups or for later policy assignment\nconst contractors = new vault.KerberosAuthBackendGroup(\"contractors\", {\n mount: kerberos.path,\n name: \"contractors\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkerberos = vault.AuthBackend(\"kerberos\",\n type=\"kerberos\",\n path=\"kerberos\")\n# Create a group mapping without policies\n# Useful for tracking groups or for later policy assignment\ncontractors = vault.KerberosAuthBackendGroup(\"contractors\",\n mount=kerberos.path,\n name=\"contractors\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n // Create a group mapping without policies\n // Useful for tracking groups or for later policy assignment\n var contractors = new Vault.KerberosAuthBackendGroup(\"contractors\", new()\n {\n Mount = kerberos.Path,\n Name = \"contractors\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// Create a group mapping without policies\n\t\t// Useful for tracking groups or for later policy assignment\n\t\t_, err = vault.NewKerberosAuthBackendGroup(ctx, \"contractors\", \u0026vault.KerberosAuthBackendGroupArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tName: pulumi.String(\"contractors\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kerberos\" {\n type = \"kerberos\"\n path = \"kerberos\"\n}\n# Create a group mapping without policies\n# Useful for tracking groups or for later policy assignment\nresource \"vault_kerberosauthbackendgroup\" \"contractors\" {\n mount = vault_authbackend.kerberos.path\n name = \"contractors\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendGroup;\nimport com.pulumi.vault.KerberosAuthBackendGroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n // Create a group mapping without policies\n // Useful for tracking groups or for later policy assignment\n var contractors = new KerberosAuthBackendGroup(\"contractors\", KerberosAuthBackendGroupArgs.builder()\n .mount(kerberos.path())\n .name(\"contractors\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kerberos:\n type: vault:AuthBackend\n properties:\n type: kerberos\n path: kerberos\n # Create a group mapping without policies\n # Useful for tracking groups or for later policy assignment\n contractors:\n type: vault:KerberosAuthBackendGroup\n properties:\n mount: ${kerberos.path}\n name: contractors\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKerberos auth backend group mappings can be imported using the path, e.g.\n\n```sh\n$ pulumi import vault:index/kerberosAuthBackendGroup:KerberosAuthBackendGroup developers auth/kerberos/groups/developers\n```\n\n### Importing with Namespace (Vault Enterprise)\n\nFor Vault Enterprise with namespaces, set the `TERRAFORM_VAULT_NAMESPACE_IMPORT` environment variable \nbefore importing:\n\n```\n$ export TERRAFORM_VAULT_NAMESPACE_IMPORT=example-namespace\n$ terraform import vault_kerberos_auth_backend_group.developers auth/kerberos/groups/developers\n\n```", "properties": { "mount": { "type": "string", "description": "Path where the Kerberos auth method is mounted.\nChanging this will force a new resource to be created.\n" }, "name": { "type": "string", "description": "The name of the LDAP group to map to Vault policies. \nThis should match the group name as it appears in your LDAP directory.\nChanging this will force a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Set of Vault policy names to associate with this group. \nUsers who are members of this LDAP group will receive these policies when they\nauthenticate via Kerberos.\n" } }, "required": [ "mount", "name" ], "inputProperties": { "mount": { "type": "string", "description": "Path where the Kerberos auth method is mounted.\nChanging this will force a new resource to be created.\n" }, "name": { "type": "string", "description": "The name of the LDAP group to map to Vault policies. \nThis should match the group name as it appears in your LDAP directory.\nChanging this will force a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Set of Vault policy names to associate with this group. \nUsers who are members of this LDAP group will receive these policies when they\nauthenticate via Kerberos.\n" } }, "requiredInputs": [ "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering KerberosAuthBackendGroup resources.\n", "properties": { "mount": { "type": "string", "description": "Path where the Kerberos auth method is mounted.\nChanging this will force a new resource to be created.\n" }, "name": { "type": "string", "description": "The name of the LDAP group to map to Vault policies. \nThis should match the group name as it appears in your LDAP directory.\nChanging this will force a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Set of Vault policy names to associate with this group. \nUsers who are members of this LDAP group will receive these policies when they\nauthenticate via Kerberos.\n" } }, "type": "object" } }, "vault:index/kerberosAuthBackendLdapConfig:KerberosAuthBackendLdapConfig": { "description": "Manages LDAP configuration for the Kerberos authentication method in Vault.\n\nThis resource configures LDAP integration for the Kerberos auth method, allowing Vault to \nquery LDAP for user and group information after successful Kerberos authentication. This \nenables group-based policy assignment and additional user metadata retrieval.\n\nFor more information, see the\n[Vault Kerberos Auth Method documentation](https://www.vaultproject.io/docs/auth/kerberos).\n\n\u003e **Important** The \u003cspan pulumi-lang-nodejs=\"`certificate`\" pulumi-lang-dotnet=\"`Certificate`\" pulumi-lang-go=\"`certificate`\" pulumi-lang-python=\"`certificate`\" pulumi-lang-yaml=\"`certificate`\" pulumi-lang-java=\"`certificate`\" pulumi-lang-hcl=\"`certificate`\"\u003e`certificate`\u003c/span\u003e field is marked as sensitive and will be stored in state\nfiles (but masked in output). Write-only fields (\u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`clientTlsCertWo`\" pulumi-lang-dotnet=\"`ClientTlsCertWo`\" pulumi-lang-go=\"`clientTlsCertWo`\" pulumi-lang-python=\"`client_tls_cert_wo`\" pulumi-lang-yaml=\"`clientTlsCertWo`\" pulumi-lang-java=\"`clientTlsCertWo`\" pulumi-lang-hcl=\"`client_tls_cert_wo`\"\u003e`clientTlsCertWo`\u003c/span\u003e,\n\u003cspan pulumi-lang-nodejs=\"`clientTlsKeyWo`\" pulumi-lang-dotnet=\"`ClientTlsKeyWo`\" pulumi-lang-go=\"`clientTlsKeyWo`\" pulumi-lang-python=\"`client_tls_key_wo`\" pulumi-lang-yaml=\"`clientTlsKeyWo`\" pulumi-lang-java=\"`clientTlsKeyWo`\" pulumi-lang-hcl=\"`client_tls_key_wo`\"\u003e`clientTlsKeyWo`\u003c/span\u003e) are not stored in state and are only sent to Vault during configuration.\nProtect state files accordingly. See the main provider documentation for more details.\n\n\u003e **Note** Vault does not support deleting auth backend LDAP configurations via the API.\nWhen this resource is destroyed or replaced (e.g., when changing the \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e), it is \nonly removed from Terraform state. The configuration remains in Vault until the auth \nmount itself is deleted.\n\n## Example Usage\n\n### Basic Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst kerberosKerberosAuthBackendConfig = new vault.KerberosAuthBackendConfig(\"kerberos\", {\n mount: kerberos.path,\n keytabWo: std.filebase64({\n input: \"/path/to/vault.keytab\",\n }).then(invoke =\u003e invoke.result),\n keytabWoVersion: 1,\n serviceAccount: \"vault/localhost@EXAMPLE.COM\",\n});\nconst config = new vault.KerberosAuthBackendLdapConfig(\"config\", {\n mount: kerberos.path,\n url: \"ldap://ldap.example.com\",\n binddn: \"cn=vault,ou=Users,dc=example,dc=com\",\n userdn: \"ou=People,dc=example,dc=org\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nkerberos = vault.AuthBackend(\"kerberos\",\n type=\"kerberos\",\n path=\"kerberos\")\nkerberos_kerberos_auth_backend_config = vault.KerberosAuthBackendConfig(\"kerberos\",\n mount=kerberos.path,\n keytab_wo=std.filebase64(input=\"/path/to/vault.keytab\").result,\n keytab_wo_version=1,\n service_account=\"vault/localhost@EXAMPLE.COM\")\nconfig = vault.KerberosAuthBackendLdapConfig(\"config\",\n mount=kerberos.path,\n url=\"ldap://ldap.example.com\",\n binddn=\"cn=vault,ou=Users,dc=example,dc=com\",\n userdn=\"ou=People,dc=example,dc=org\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var kerberosKerberosAuthBackendConfig = new Vault.KerberosAuthBackendConfig(\"kerberos\", new()\n {\n Mount = kerberos.Path,\n KeytabWo = Std.Filebase64.Invoke(new()\n {\n Input = \"/path/to/vault.keytab\",\n }).Apply(invoke =\u003e invoke.Result),\n KeytabWoVersion = 1,\n ServiceAccount = \"vault/localhost@EXAMPLE.COM\",\n });\n\n var config = new Vault.KerberosAuthBackendLdapConfig(\"config\", new()\n {\n Mount = kerberos.Path,\n Url = \"ldap://ldap.example.com\",\n Binddn = \"cn=vault,ou=Users,dc=example,dc=com\",\n Userdn = \"ou=People,dc=example,dc=org\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFilebase64, err := std.Filebase64(ctx, \u0026std.Filebase64Args{\n\t\t\tInput: \"/path/to/vault.keytab\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendConfig(ctx, \"kerberos\", \u0026vault.KerberosAuthBackendConfigArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tKeytabWo: pulumi.String(invokeFilebase64.Result),\n\t\t\tKeytabWoVersion: pulumi.Int(1),\n\t\t\tServiceAccount: pulumi.String(\"vault/localhost@EXAMPLE.COM\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, \"config\", \u0026vault.KerberosAuthBackendLdapConfigArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tUrl: pulumi.String(\"ldap://ldap.example.com\"),\n\t\t\tBinddn: pulumi.String(\"cn=vault,ou=Users,dc=example,dc=com\"),\n\t\t\tUserdn: pulumi.String(\"ou=People,dc=example,dc=org\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kerberos\" {\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendconfig\" \"kerberos\" {\n mount = vault_authbackend.kerberos.path\n keytab_wo = filebase64(\"/path/to/vault.keytab\")\n keytab_wo_version = 1\n service_account = \"vault/localhost@EXAMPLE.COM\"\n}\nresource \"vault_kerberosauthbackendldapconfig\" \"config\" {\n mount = vault_authbackend.kerberos.path\n url = \"ldap://ldap.example.com\"\n binddn = \"cn=vault,ou=Users,dc=example,dc=com\"\n userdn = \"ou=People,dc=example,dc=org\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendConfig;\nimport com.pulumi.vault.KerberosAuthBackendConfigArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.Filebase64Args;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfig;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var kerberosKerberosAuthBackendConfig = new KerberosAuthBackendConfig(\"kerberosKerberosAuthBackendConfig\", KerberosAuthBackendConfigArgs.builder()\n .mount(kerberos.path())\n .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()\n .input(\"/path/to/vault.keytab\")\n .build()).result())\n .keytabWoVersion(1)\n .serviceAccount(\"vault/localhost@EXAMPLE.COM\")\n .build());\n\n var config = new KerberosAuthBackendLdapConfig(\"config\", KerberosAuthBackendLdapConfigArgs.builder()\n .mount(kerberos.path())\n .url(\"ldap://ldap.example.com\")\n .binddn(\"cn=vault,ou=Users,dc=example,dc=com\")\n .userdn(\"ou=People,dc=example,dc=org\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kerberos:\n type: vault:AuthBackend\n properties:\n type: kerberos\n path: kerberos\n kerberosKerberosAuthBackendConfig:\n type: vault:KerberosAuthBackendConfig\n name: kerberos\n properties:\n mount: ${kerberos.path}\n keytabWo:\n fn::invoke:\n function: std:filebase64\n arguments:\n input: /path/to/vault.keytab\n return: result\n keytabWoVersion: 1\n serviceAccount: vault/localhost@EXAMPLE.COM\n config:\n type: vault:KerberosAuthBackendLdapConfig\n properties:\n mount: ${kerberos.path}\n url: ldap://ldap.example.com\n binddn: cn=vault,ou=Users,dc=example,dc=com\n userdn: ou=People,dc=example,dc=org\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Configuration with Bind Password\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst config = new vault.KerberosAuthBackendLdapConfig(\"config\", {\n mount: kerberos.path,\n url: \"ldap://ldap.example.com\",\n binddn: \"cn=vault,ou=Users,dc=example,dc=com\",\n bindpassWo: ldapBindPassword,\n bindpassWoVersion: 1,\n userdn: \"ou=People,dc=example,dc=org\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkerberos = vault.AuthBackend(\"kerberos\",\n type=\"kerberos\",\n path=\"kerberos\")\nconfig = vault.KerberosAuthBackendLdapConfig(\"config\",\n mount=kerberos.path,\n url=\"ldap://ldap.example.com\",\n binddn=\"cn=vault,ou=Users,dc=example,dc=com\",\n bindpass_wo=ldap_bind_password,\n bindpass_wo_version=1,\n userdn=\"ou=People,dc=example,dc=org\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var config = new Vault.KerberosAuthBackendLdapConfig(\"config\", new()\n {\n Mount = kerberos.Path,\n Url = \"ldap://ldap.example.com\",\n Binddn = \"cn=vault,ou=Users,dc=example,dc=com\",\n BindpassWo = ldapBindPassword,\n BindpassWoVersion = 1,\n Userdn = \"ou=People,dc=example,dc=org\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, \"config\", \u0026vault.KerberosAuthBackendLdapConfigArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tUrl: pulumi.String(\"ldap://ldap.example.com\"),\n\t\t\tBinddn: pulumi.String(\"cn=vault,ou=Users,dc=example,dc=com\"),\n\t\t\tBindpassWo: pulumi.Any(ldapBindPassword),\n\t\t\tBindpassWoVersion: pulumi.Int(1),\n\t\t\tUserdn: pulumi.String(\"ou=People,dc=example,dc=org\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kerberos\" {\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendldapconfig\" \"config\" {\n mount = vault_authbackend.kerberos.path\n url = \"ldap://ldap.example.com\"\n binddn = \"cn=vault,ou=Users,dc=example,dc=com\"\n bindpass_wo = ldapBindPassword\n bindpass_wo_version = 1\n userdn = \"ou=People,dc=example,dc=org\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfig;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var config = new KerberosAuthBackendLdapConfig(\"config\", KerberosAuthBackendLdapConfigArgs.builder()\n .mount(kerberos.path())\n .url(\"ldap://ldap.example.com\")\n .binddn(\"cn=vault,ou=Users,dc=example,dc=com\")\n .bindpassWo(ldapBindPassword)\n .bindpassWoVersion(1)\n .userdn(\"ou=People,dc=example,dc=org\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kerberos:\n type: vault:AuthBackend\n properties:\n type: kerberos\n path: kerberos\n config:\n type: vault:KerberosAuthBackendLdapConfig\n properties:\n mount: ${kerberos.path}\n url: ldap://ldap.example.com\n binddn: cn=vault,ou=Users,dc=example,dc=com\n bindpassWo: ${ldapBindPassword}\n bindpassWoVersion: 1\n userdn: ou=People,dc=example,dc=org\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Full Configuration with TLS and Groups\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst config = new vault.KerberosAuthBackendLdapConfig(\"config\", {\n mount: kerberos.path,\n url: \"ldaps://ldap.example.com:636\",\n binddn: \"cn=vault,ou=Users,dc=example,dc=com\",\n bindpassWo: ldapBindPassword,\n bindpassWoVersion: 1,\n userdn: \"ou=People,dc=example,dc=org\",\n userattr: \"samaccountname\",\n groupdn: \"ou=Groups,dc=example,dc=org\",\n groupfilter: \"(objectClass=group)\",\n groupattr: \"cn\",\n useTokenGroups: true,\n tlsMinVersion: \"tls12\",\n tlsMaxVersion: \"tls13\",\n certificate: std.file({\n input: \"/path/to/ca-cert.pem\",\n }).then(invoke =\u003e invoke.result),\n denyNullBind: true,\n tokenTtl: 1800,\n tokenMaxTtl: 3600,\n tokenPolicies: [\n \"default\",\n \"dev\",\n ],\n tokenType: \"service\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nkerberos = vault.AuthBackend(\"kerberos\",\n type=\"kerberos\",\n path=\"kerberos\")\nconfig = vault.KerberosAuthBackendLdapConfig(\"config\",\n mount=kerberos.path,\n url=\"ldaps://ldap.example.com:636\",\n binddn=\"cn=vault,ou=Users,dc=example,dc=com\",\n bindpass_wo=ldap_bind_password,\n bindpass_wo_version=1,\n userdn=\"ou=People,dc=example,dc=org\",\n userattr=\"samaccountname\",\n groupdn=\"ou=Groups,dc=example,dc=org\",\n groupfilter=\"(objectClass=group)\",\n groupattr=\"cn\",\n use_token_groups=True,\n tls_min_version=\"tls12\",\n tls_max_version=\"tls13\",\n certificate=std.file(input=\"/path/to/ca-cert.pem\").result,\n deny_null_bind=True,\n token_ttl=1800,\n token_max_ttl=3600,\n token_policies=[\n \"default\",\n \"dev\",\n ],\n token_type=\"service\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var config = new Vault.KerberosAuthBackendLdapConfig(\"config\", new()\n {\n Mount = kerberos.Path,\n Url = \"ldaps://ldap.example.com:636\",\n Binddn = \"cn=vault,ou=Users,dc=example,dc=com\",\n BindpassWo = ldapBindPassword,\n BindpassWoVersion = 1,\n Userdn = \"ou=People,dc=example,dc=org\",\n Userattr = \"samaccountname\",\n Groupdn = \"ou=Groups,dc=example,dc=org\",\n Groupfilter = \"(objectClass=group)\",\n Groupattr = \"cn\",\n UseTokenGroups = true,\n TlsMinVersion = \"tls12\",\n TlsMaxVersion = \"tls13\",\n Certificate = Std.File.Invoke(new()\n {\n Input = \"/path/to/ca-cert.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n DenyNullBind = true,\n TokenTtl = 1800,\n TokenMaxTtl = 3600,\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n },\n TokenType = \"service\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/ca-cert.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, \"config\", \u0026vault.KerberosAuthBackendLdapConfigArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tUrl: pulumi.String(\"ldaps://ldap.example.com:636\"),\n\t\t\tBinddn: pulumi.String(\"cn=vault,ou=Users,dc=example,dc=com\"),\n\t\t\tBindpassWo: pulumi.Any(ldapBindPassword),\n\t\t\tBindpassWoVersion: pulumi.Int(1),\n\t\t\tUserdn: pulumi.String(\"ou=People,dc=example,dc=org\"),\n\t\t\tUserattr: pulumi.String(\"samaccountname\"),\n\t\t\tGroupdn: pulumi.String(\"ou=Groups,dc=example,dc=org\"),\n\t\t\tGroupfilter: pulumi.String(\"(objectClass=group)\"),\n\t\t\tGroupattr: pulumi.String(\"cn\"),\n\t\t\tUseTokenGroups: pulumi.Bool(true),\n\t\t\tTlsMinVersion: pulumi.String(\"tls12\"),\n\t\t\tTlsMaxVersion: pulumi.String(\"tls13\"),\n\t\t\tCertificate: pulumi.String(invokeFile.Result),\n\t\t\tDenyNullBind: pulumi.Bool(true),\n\t\t\tTokenTtl: pulumi.Int(1800),\n\t\t\tTokenMaxTtl: pulumi.Int(3600),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t},\n\t\t\tTokenType: pulumi.String(\"service\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kerberos\" {\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendldapconfig\" \"config\" {\n mount = vault_authbackend.kerberos.path\n url = \"ldaps://ldap.example.com:636\"\n binddn = \"cn=vault,ou=Users,dc=example,dc=com\"\n bindpass_wo = ldapBindPassword\n bindpass_wo_version = 1\n userdn = \"ou=People,dc=example,dc=org\"\n userattr = \"samaccountname\"\n groupdn = \"ou=Groups,dc=example,dc=org\"\n groupfilter = \"(objectClass=group)\"\n groupattr = \"cn\"\n use_token_groups = true\n tls_min_version = \"tls12\"\n tls_max_version = \"tls13\"\n certificate = file(\"/path/to/ca-cert.pem\")\n deny_null_bind = true\n # Token configuration\n token_ttl = 1800\n token_max_ttl = 3600\n token_policies = [\"default\", \"dev\"]\n token_type = \"service\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfig;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var config = new KerberosAuthBackendLdapConfig(\"config\", KerberosAuthBackendLdapConfigArgs.builder()\n .mount(kerberos.path())\n .url(\"ldaps://ldap.example.com:636\")\n .binddn(\"cn=vault,ou=Users,dc=example,dc=com\")\n .bindpassWo(ldapBindPassword)\n .bindpassWoVersion(1)\n .userdn(\"ou=People,dc=example,dc=org\")\n .userattr(\"samaccountname\")\n .groupdn(\"ou=Groups,dc=example,dc=org\")\n .groupfilter(\"(objectClass=group)\")\n .groupattr(\"cn\")\n .useTokenGroups(true)\n .tlsMinVersion(\"tls12\")\n .tlsMaxVersion(\"tls13\")\n .certificate(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/ca-cert.pem\")\n .build()).result())\n .denyNullBind(true)\n .tokenTtl(1800)\n .tokenMaxTtl(3600)\n .tokenPolicies( \n \"default\",\n \"dev\")\n .tokenType(\"service\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kerberos:\n type: vault:AuthBackend\n properties:\n type: kerberos\n path: kerberos\n config:\n type: vault:KerberosAuthBackendLdapConfig\n properties:\n mount: ${kerberos.path}\n url: ldaps://ldap.example.com:636\n binddn: cn=vault,ou=Users,dc=example,dc=com\n bindpassWo: ${ldapBindPassword}\n bindpassWoVersion: 1\n userdn: ou=People,dc=example,dc=org\n userattr: samaccountname\n groupdn: ou=Groups,dc=example,dc=org\n groupfilter: (objectClass=group)\n groupattr: cn\n useTokenGroups: true\n tlsMinVersion: tls12\n tlsMaxVersion: tls13\n certificate:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/ca-cert.pem\n return: result\n denyNullBind: true # Token configuration\n tokenTtl: 1800\n tokenMaxTtl: 3600\n tokenPolicies:\n - default\n - dev\n tokenType: service\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Configuration with Client TLS Certificates\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst config = new vault.KerberosAuthBackendLdapConfig(\"config\", {\n mount: kerberos.path,\n url: \"ldaps://ldap.example.com:636\",\n binddn: \"cn=vault,ou=Users,dc=example,dc=com\",\n userdn: \"ou=People,dc=example,dc=org\",\n certificate: std.file({\n input: \"/path/to/ca-cert.pem\",\n }).then(invoke =\u003e invoke.result),\n clientTlsCertWo: std.file({\n input: \"/path/to/client-cert.pem\",\n }).then(invoke =\u003e invoke.result),\n clientTlsCertWoVersion: 1,\n clientTlsKeyWo: std.file({\n input: \"/path/to/client-key.pem\",\n }).then(invoke =\u003e invoke.result),\n clientTlsKeyWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nkerberos = vault.AuthBackend(\"kerberos\",\n type=\"kerberos\",\n path=\"kerberos\")\nconfig = vault.KerberosAuthBackendLdapConfig(\"config\",\n mount=kerberos.path,\n url=\"ldaps://ldap.example.com:636\",\n binddn=\"cn=vault,ou=Users,dc=example,dc=com\",\n userdn=\"ou=People,dc=example,dc=org\",\n certificate=std.file(input=\"/path/to/ca-cert.pem\").result,\n client_tls_cert_wo=std.file(input=\"/path/to/client-cert.pem\").result,\n client_tls_cert_wo_version=1,\n client_tls_key_wo=std.file(input=\"/path/to/client-key.pem\").result,\n client_tls_key_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var config = new Vault.KerberosAuthBackendLdapConfig(\"config\", new()\n {\n Mount = kerberos.Path,\n Url = \"ldaps://ldap.example.com:636\",\n Binddn = \"cn=vault,ou=Users,dc=example,dc=com\",\n Userdn = \"ou=People,dc=example,dc=org\",\n Certificate = Std.File.Invoke(new()\n {\n Input = \"/path/to/ca-cert.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n ClientTlsCertWo = Std.File.Invoke(new()\n {\n Input = \"/path/to/client-cert.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n ClientTlsCertWoVersion = 1,\n ClientTlsKeyWo = Std.File.Invoke(new()\n {\n Input = \"/path/to/client-key.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n ClientTlsKeyWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/ca-cert.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile1, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/client-cert.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile2, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/client-key.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, \"config\", \u0026vault.KerberosAuthBackendLdapConfigArgs{\n\t\t\tMount: kerberos.Path,\n\t\t\tUrl: pulumi.String(\"ldaps://ldap.example.com:636\"),\n\t\t\tBinddn: pulumi.String(\"cn=vault,ou=Users,dc=example,dc=com\"),\n\t\t\tUserdn: pulumi.String(\"ou=People,dc=example,dc=org\"),\n\t\t\tCertificate: pulumi.String(invokeFile.Result),\n\t\t\tClientTlsCertWo: pulumi.String(invokeFile1.Result),\n\t\t\tClientTlsCertWoVersion: pulumi.Int(1),\n\t\t\tClientTlsKeyWo: pulumi.String(invokeFile2.Result),\n\t\t\tClientTlsKeyWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kerberos\" {\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendldapconfig\" \"config\" {\n mount = vault_authbackend.kerberos.path\n url = \"ldaps://ldap.example.com:636\"\n binddn = \"cn=vault,ou=Users,dc=example,dc=com\"\n userdn = \"ou=People,dc=example,dc=org\"\n certificate = file(\"/path/to/ca-cert.pem\")\n client_tls_cert_wo = file(\"/path/to/client-cert.pem\")\n client_tls_cert_wo_version = 1\n client_tls_key_wo = file(\"/path/to/client-key.pem\")\n client_tls_key_wo_version = 1\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfig;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var config = new KerberosAuthBackendLdapConfig(\"config\", KerberosAuthBackendLdapConfigArgs.builder()\n .mount(kerberos.path())\n .url(\"ldaps://ldap.example.com:636\")\n .binddn(\"cn=vault,ou=Users,dc=example,dc=com\")\n .userdn(\"ou=People,dc=example,dc=org\")\n .certificate(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/ca-cert.pem\")\n .build()).result())\n .clientTlsCertWo(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/client-cert.pem\")\n .build()).result())\n .clientTlsCertWoVersion(1)\n .clientTlsKeyWo(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/client-key.pem\")\n .build()).result())\n .clientTlsKeyWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kerberos:\n type: vault:AuthBackend\n properties:\n type: kerberos\n path: kerberos\n config:\n type: vault:KerberosAuthBackendLdapConfig\n properties:\n mount: ${kerberos.path}\n url: ldaps://ldap.example.com:636\n binddn: cn=vault,ou=Users,dc=example,dc=com\n userdn: ou=People,dc=example,dc=org\n certificate:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/ca-cert.pem\n return: result\n clientTlsCertWo:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/client-cert.pem\n return: result\n clientTlsCertWoVersion: 1\n clientTlsKeyWo:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/client-key.pem\n return: result\n clientTlsKeyWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Namespace (Vault Enterprise)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.Namespace(\"example\", {path: \"example-namespace\"});\nconst kerberos = new vault.AuthBackend(\"kerberos\", {\n namespace: example.path,\n type: \"kerberos\",\n path: \"kerberos\",\n});\nconst config = new vault.KerberosAuthBackendLdapConfig(\"config\", {\n namespace: example.path,\n mount: kerberos.path,\n url: \"ldap://ldap.example.com\",\n binddn: \"cn=vault,ou=Users,dc=example,dc=com\",\n userdn: \"ou=People,dc=example,dc=org\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.Namespace(\"example\", path=\"example-namespace\")\nkerberos = vault.AuthBackend(\"kerberos\",\n namespace=example.path,\n type=\"kerberos\",\n path=\"kerberos\")\nconfig = vault.KerberosAuthBackendLdapConfig(\"config\",\n namespace=example.path,\n mount=kerberos.path,\n url=\"ldap://ldap.example.com\",\n binddn=\"cn=vault,ou=Users,dc=example,dc=com\",\n userdn=\"ou=People,dc=example,dc=org\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Namespace(\"example\", new()\n {\n Path = \"example-namespace\",\n });\n\n var kerberos = new Vault.AuthBackend(\"kerberos\", new()\n {\n Namespace = example.Path,\n Type = \"kerberos\",\n Path = \"kerberos\",\n });\n\n var config = new Vault.KerberosAuthBackendLdapConfig(\"config\", new()\n {\n Namespace = example.Path,\n Mount = kerberos.Path,\n Url = \"ldap://ldap.example.com\",\n Binddn = \"cn=vault,ou=Users,dc=example,dc=com\",\n Userdn = \"ou=People,dc=example,dc=org\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := vault.NewNamespace(ctx, \"example\", \u0026vault.NamespaceArgs{\n\t\t\tPath: pulumi.String(\"example-namespace\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tkerberos, err := vault.NewAuthBackend(ctx, \"kerberos\", \u0026vault.AuthBackendArgs{\n\t\t\tNamespace: example.Path,\n\t\t\tType: pulumi.String(\"kerberos\"),\n\t\t\tPath: pulumi.String(\"kerberos\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewKerberosAuthBackendLdapConfig(ctx, \"config\", \u0026vault.KerberosAuthBackendLdapConfigArgs{\n\t\t\tNamespace: example.Path,\n\t\t\tMount: kerberos.Path,\n\t\t\tUrl: pulumi.String(\"ldap://ldap.example.com\"),\n\t\t\tBinddn: pulumi.String(\"cn=vault,ou=Users,dc=example,dc=com\"),\n\t\t\tUserdn: pulumi.String(\"ou=People,dc=example,dc=org\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_namespace\" \"example\" {\n path = \"example-namespace\"\n}\nresource \"vault_authbackend\" \"kerberos\" {\n namespace = vault_namespace.example.path\n type = \"kerberos\"\n path = \"kerberos\"\n}\nresource \"vault_kerberosauthbackendldapconfig\" \"config\" {\n namespace = vault_namespace.example.path\n mount = vault_authbackend.kerberos.path\n url = \"ldap://ldap.example.com\"\n binddn = \"cn=vault,ou=Users,dc=example,dc=com\"\n userdn = \"ou=People,dc=example,dc=org\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Namespace;\nimport com.pulumi.vault.NamespaceArgs;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfig;\nimport com.pulumi.vault.KerberosAuthBackendLdapConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new Namespace(\"example\", NamespaceArgs.builder()\n .path(\"example-namespace\")\n .build());\n\n var kerberos = new AuthBackend(\"kerberos\", AuthBackendArgs.builder()\n .namespace(example.path())\n .type(\"kerberos\")\n .path(\"kerberos\")\n .build());\n\n var config = new KerberosAuthBackendLdapConfig(\"config\", KerberosAuthBackendLdapConfigArgs.builder()\n .namespace(example.path())\n .mount(kerberos.path())\n .url(\"ldap://ldap.example.com\")\n .binddn(\"cn=vault,ou=Users,dc=example,dc=com\")\n .userdn(\"ou=People,dc=example,dc=org\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:Namespace\n properties:\n path: example-namespace\n kerberos:\n type: vault:AuthBackend\n properties:\n namespace: ${example.path}\n type: kerberos\n path: kerberos\n config:\n type: vault:KerberosAuthBackendLdapConfig\n properties:\n namespace: ${example.path}\n mount: ${kerberos.path}\n url: ldap://ldap.example.com\n binddn: cn=vault,ou=Users,dc=example,dc=com\n userdn: ou=People,dc=example,dc=org\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKerberos auth backend LDAP configurations can be imported using the `auth/{mount}/config/ldap` path, e.g.\n\n```sh\n$ pulumi import vault:index/kerberosAuthBackendLdapConfig:KerberosAuthBackendLdapConfig config auth/kerberos/config/ldap\n```\n\n\u003e **Note** Write-only fields (\u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`clientTlsCertWo`\" pulumi-lang-dotnet=\"`ClientTlsCertWo`\" pulumi-lang-go=\"`clientTlsCertWo`\" pulumi-lang-python=\"`client_tls_cert_wo`\" pulumi-lang-yaml=\"`clientTlsCertWo`\" pulumi-lang-java=\"`clientTlsCertWo`\" pulumi-lang-hcl=\"`client_tls_cert_wo`\"\u003e`clientTlsCertWo`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`clientTlsKeyWo`\" pulumi-lang-dotnet=\"`ClientTlsKeyWo`\" pulumi-lang-go=\"`clientTlsKeyWo`\" pulumi-lang-python=\"`client_tls_key_wo`\" pulumi-lang-yaml=\"`clientTlsKeyWo`\" pulumi-lang-java=\"`clientTlsKeyWo`\" pulumi-lang-hcl=\"`client_tls_key_wo`\"\u003e`clientTlsKeyWo`\u003c/span\u003e) and \ntheir version fields cannot be imported. You will need to ignore changes to these fields or \nprovide them in your configuration after import.\n\n### Importing with Namespace (Vault Enterprise)\n\nFor Vault Enterprise with namespaces, set the `TERRAFORM_VAULT_NAMESPACE_IMPORT` environment variable \nbefore importing:\n\n```\n$ export TERRAFORM_VAULT_NAMESPACE_IMPORT=example-namespace\n$ terraform import vault_kerberos_auth_backend_ldap_config.config auth/kerberos/config/ldap\n\n```", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "anonymousGroupSearch": { "type": "boolean", "description": "Use anonymous binds when performing LDAP group searches. Default: false." }, "binddn": { "type": "string", "description": "Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com')." }, "bindpassWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nLDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.", "secret": true }, "bindpassWoVersion": { "type": "integer", "description": "Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo." }, "caseSensitiveNames": { "type": "boolean", "description": "If true, usernames and group names are case sensitive. Default: false." }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.", "secret": true }, "clientTlsCertWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nClient certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.", "secret": true }, "clientTlsCertWoVersion": { "type": "integer", "description": "Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo." }, "clientTlsKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nClient certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.", "secret": true }, "clientTlsKeyWoVersion": { "type": "integer", "description": "Version identifier for client TLS key updates. Must be used together with client_tls_key_wo." }, "connectionTimeout": { "type": "integer", "description": "Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30." }, "denyNullBind": { "type": "boolean", "description": "Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true." }, "dereferenceAliases": { "type": "string", "description": "When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'" }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover bind DN of a user. Default: false." }, "enableSamaccountnameLogin": { "type": "boolean", "description": "If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. **Note:** Requires Vault 1.19.0+" }, "groupattr": { "type": "string", "description": "LDAP attribute to follow for group membership. Default: 'cn'" }, "groupdn": { "type": "string", "description": "LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org)." }, "groupfilter": { "type": "string", "description": "Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'" }, "insecureTls": { "type": "boolean", "description": "Skip TLS certificate verification. Not recommended for production. Default: false." }, "maxPageSize": { "type": "integer", "description": "If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0." }, "mount": { "type": "string", "description": "Path where the Kerberos auth method is mounted.\nChanging this will force a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "requestTimeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server. Default: 90." }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing an unencrypted connection. Default: false." }, "tlsMaxVersion": { "type": "string", "description": "Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'." }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'." }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain." }, "url": { "type": "string", "description": "LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1" }, "useTokenGroups": { "type": "boolean", "description": "If true, use the Active Directory tokenGroups constructed attribute. Default: false." }, "userattr": { "type": "string", "description": "Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (e.g., ou=People,dc=example,dc=org)." }, "userfilter": { "type": "string", "description": "Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'" }, "usernameAsAlias": { "type": "boolean", "description": "Use username as alias name. Default: false." } }, "required": [ "connectionTimeout", "denyNullBind", "dereferenceAliases", "groupattr", "groupfilter", "mount", "requestTimeout", "tlsMaxVersion", "tlsMinVersion", "tokenType", "url", "userattr", "userfilter" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "anonymousGroupSearch": { "type": "boolean", "description": "Use anonymous binds when performing LDAP group searches. Default: false." }, "binddn": { "type": "string", "description": "Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com')." }, "bindpassWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nLDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.", "secret": true }, "bindpassWoVersion": { "type": "integer", "description": "Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo." }, "caseSensitiveNames": { "type": "boolean", "description": "If true, usernames and group names are case sensitive. Default: false." }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.", "secret": true }, "clientTlsCertWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nClient certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.", "secret": true }, "clientTlsCertWoVersion": { "type": "integer", "description": "Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo." }, "clientTlsKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nClient certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.", "secret": true }, "clientTlsKeyWoVersion": { "type": "integer", "description": "Version identifier for client TLS key updates. Must be used together with client_tls_key_wo." }, "connectionTimeout": { "type": "integer", "description": "Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30." }, "denyNullBind": { "type": "boolean", "description": "Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true." }, "dereferenceAliases": { "type": "string", "description": "When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'" }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover bind DN of a user. Default: false." }, "enableSamaccountnameLogin": { "type": "boolean", "description": "If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. **Note:** Requires Vault 1.19.0+" }, "groupattr": { "type": "string", "description": "LDAP attribute to follow for group membership. Default: 'cn'" }, "groupdn": { "type": "string", "description": "LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org)." }, "groupfilter": { "type": "string", "description": "Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'" }, "insecureTls": { "type": "boolean", "description": "Skip TLS certificate verification. Not recommended for production. Default: false." }, "maxPageSize": { "type": "integer", "description": "If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0." }, "mount": { "type": "string", "description": "Path where the Kerberos auth method is mounted.\nChanging this will force a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "requestTimeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server. Default: 90." }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing an unencrypted connection. Default: false." }, "tlsMaxVersion": { "type": "string", "description": "Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'." }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'." }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain." }, "url": { "type": "string", "description": "LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1" }, "useTokenGroups": { "type": "boolean", "description": "If true, use the Active Directory tokenGroups constructed attribute. Default: false." }, "userattr": { "type": "string", "description": "Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (e.g., ou=People,dc=example,dc=org)." }, "userfilter": { "type": "string", "description": "Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'" }, "usernameAsAlias": { "type": "boolean", "description": "Use username as alias name. Default: false." } }, "requiredInputs": [ "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering KerberosAuthBackendLdapConfig resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "anonymousGroupSearch": { "type": "boolean", "description": "Use anonymous binds when performing LDAP group searches. Default: false." }, "binddn": { "type": "string", "description": "Distinguished name of object to bind for search (e.g., 'cn=vault,ou=Users,dc=example,dc=com')." }, "bindpassWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nLDAP password for searching for the user DN (write-only). Must be used together with bindpass_wo_version.", "secret": true }, "bindpassWoVersion": { "type": "integer", "description": "Version identifier for bindpass updates. Change to trigger password update. Must be used together with bindpass_wo." }, "caseSensitiveNames": { "type": "boolean", "description": "If true, usernames and group names are case sensitive. Default: false." }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.", "secret": true }, "clientTlsCertWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nClient certificate to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_cert_wo_version.", "secret": true }, "clientTlsCertWoVersion": { "type": "integer", "description": "Version identifier for client TLS certificate updates. Change to trigger certificate update. Must be used together with client_tls_cert_wo." }, "clientTlsKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nClient certificate key to provide to the LDAP server, must be x509 PEM encoded (write-only). Must be used together with client_tls_key_wo_version.", "secret": true }, "clientTlsKeyWoVersion": { "type": "integer", "description": "Version identifier for client TLS key updates. Must be used together with client_tls_key_wo." }, "connectionTimeout": { "type": "integer", "description": "Timeout, in seconds, when attempting to connect to the LDAP server. Default: 30." }, "denyNullBind": { "type": "boolean", "description": "Denies an unauthenticated LDAP bind request if the user's password is empty. Default: true." }, "dereferenceAliases": { "type": "string", "description": "When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Default: 'never'" }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover bind DN of a user. Default: false." }, "enableSamaccountnameLogin": { "type": "boolean", "description": "If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined. Default: false. **Note:** Requires Vault 1.19.0+" }, "groupattr": { "type": "string", "description": "LDAP attribute to follow for group membership. Default: 'cn'" }, "groupdn": { "type": "string", "description": "LDAP search base to use for group membership search (e.g., ou=Groups,dc=example,dc=org)." }, "groupfilter": { "type": "string", "description": "Go template for querying group membership of user. Default: '(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))'" }, "insecureTls": { "type": "boolean", "description": "Skip TLS certificate verification. Not recommended for production. Default: false." }, "maxPageSize": { "type": "integer", "description": "If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control. Default: 0." }, "mount": { "type": "string", "description": "Path where the Kerberos auth method is mounted.\nChanging this will force a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "requestTimeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server. Default: 90." }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing an unencrypted connection. Default: false." }, "tlsMaxVersion": { "type": "string", "description": "Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'." }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Default: 'tls12'." }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain." }, "url": { "type": "string", "description": "LDAP URL to connect. Multiple URLs can be specified by concatenating them with commas. Default: ldap://127.0.0.1" }, "useTokenGroups": { "type": "boolean", "description": "If true, use the Active Directory tokenGroups constructed attribute. Default: false." }, "userattr": { "type": "string", "description": "Attribute used as username. Common values: 'samaccountname', 'uid'. Default: 'cn'" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (e.g., ou=People,dc=example,dc=org)." }, "userfilter": { "type": "string", "description": "Go template for LDAP user search filter. Default: '({{.UserAttr}}={{.Username}})'" }, "usernameAsAlias": { "type": "boolean", "description": "Use username as alias name. Default: false." } }, "type": "object" } }, "vault:index/mfaDuo:MfaDuo": { "description": "Provides a resource to manage [Duo MFA](https://www.vaultproject.io/docs/enterprise/mfa/mfa-duo.html).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst userpass = new vault.AuthBackend(\"userpass\", {\n type: \"userpass\",\n path: \"userpass\",\n});\nconst myDuo = new vault.MfaDuo(\"my_duo\", {\n name: \"my_duo\",\n mountAccessor: userpass.accessor,\n secretKey: \"8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz\",\n integrationKey: \"BIACEUEAXI20BNWTEYXT\",\n apiHostname: \"api-2b5c39f5.duosecurity.com\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nuserpass = vault.AuthBackend(\"userpass\",\n type=\"userpass\",\n path=\"userpass\")\nmy_duo = vault.MfaDuo(\"my_duo\",\n name=\"my_duo\",\n mount_accessor=userpass.accessor,\n secret_key=\"8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz\",\n integration_key=\"BIACEUEAXI20BNWTEYXT\",\n api_hostname=\"api-2b5c39f5.duosecurity.com\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var userpass = new Vault.AuthBackend(\"userpass\", new()\n {\n Type = \"userpass\",\n Path = \"userpass\",\n });\n\n var myDuo = new Vault.MfaDuo(\"my_duo\", new()\n {\n Name = \"my_duo\",\n MountAccessor = userpass.Accessor,\n SecretKey = \"8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz\",\n IntegrationKey = \"BIACEUEAXI20BNWTEYXT\",\n ApiHostname = \"api-2b5c39f5.duosecurity.com\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tuserpass, err := vault.NewAuthBackend(ctx, \"userpass\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"userpass\"),\n\t\t\tPath: pulumi.String(\"userpass\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewMfaDuo(ctx, \"my_duo\", \u0026vault.MfaDuoArgs{\n\t\t\tName: pulumi.String(\"my_duo\"),\n\t\t\tMountAccessor: userpass.Accessor,\n\t\t\tSecretKey: pulumi.String(\"8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz\"),\n\t\t\tIntegrationKey: pulumi.String(\"BIACEUEAXI20BNWTEYXT\"),\n\t\t\tApiHostname: pulumi.String(\"api-2b5c39f5.duosecurity.com\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"userpass\" {\n type = \"userpass\"\n path = \"userpass\"\n}\nresource \"vault_mfaduo\" \"my_duo\" {\n name = \"my_duo\"\n mount_accessor = vault_authbackend.userpass.accessor\n secret_key = \"8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz\"\n integration_key = \"BIACEUEAXI20BNWTEYXT\"\n api_hostname = \"api-2b5c39f5.duosecurity.com\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.MfaDuo;\nimport com.pulumi.vault.MfaDuoArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var userpass = new AuthBackend(\"userpass\", AuthBackendArgs.builder()\n .type(\"userpass\")\n .path(\"userpass\")\n .build());\n\n var myDuo = new MfaDuo(\"myDuo\", MfaDuoArgs.builder()\n .name(\"my_duo\")\n .mountAccessor(userpass.accessor())\n .secretKey(\"8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz\")\n .integrationKey(\"BIACEUEAXI20BNWTEYXT\")\n .apiHostname(\"api-2b5c39f5.duosecurity.com\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n userpass:\n type: vault:AuthBackend\n properties:\n type: userpass\n path: userpass\n myDuo:\n type: vault:MfaDuo\n name: my_duo\n properties:\n name: my_duo\n mountAccessor: ${userpass.accessor}\n secretKey: 8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz\n integrationKey: BIACEUEAXI20BNWTEYXT\n apiHostname: api-2b5c39f5.duosecurity.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nMounts can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/mfaDuo:MfaDuo my_duo my_duo\n```\n\n", "properties": { "apiHostname": { "type": "string", "description": "`(string: \u003crequired\u003e)` - API hostname for Duo.\n" }, "integrationKey": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Integration key for Duo.\n", "secret": true }, "mountAccessor": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.\n" }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "pushInfo": { "type": "string", "description": "`(string)` - Push information for Duo.\n" }, "secretKey": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Secret key for Duo.\n", "secret": true }, "usernameFormat": { "type": "string", "description": "`(string)` - A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `\"{{alias.name}}@example.com\"`. If blank, the Alias's Name field will be used as-is. Currently-supported mappings:\n- alias.name: The name returned by the mount configured via the \u003cspan pulumi-lang-nodejs=\"`mountAccessor`\" pulumi-lang-dotnet=\"`MountAccessor`\" pulumi-lang-go=\"`mountAccessor`\" pulumi-lang-python=\"`mount_accessor`\" pulumi-lang-yaml=\"`mountAccessor`\" pulumi-lang-java=\"`mountAccessor`\" pulumi-lang-hcl=\"`mount_accessor`\"\u003e`mountAccessor`\u003c/span\u003e parameter\n- entity.name: The name configured for the Entity\n- alias.metadata.`\u003ckey\u003e`: The value of the Alias's metadata parameter\n- entity.metadata.`\u003ckey\u003e`: The value of the Entity's metadata parameter\n" } }, "required": [ "apiHostname", "integrationKey", "mountAccessor", "name", "secretKey" ], "inputProperties": { "apiHostname": { "type": "string", "description": "`(string: \u003crequired\u003e)` - API hostname for Duo.\n" }, "integrationKey": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Integration key for Duo.\n", "secret": true }, "mountAccessor": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.\n" }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "pushInfo": { "type": "string", "description": "`(string)` - Push information for Duo.\n" }, "secretKey": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Secret key for Duo.\n", "secret": true }, "usernameFormat": { "type": "string", "description": "`(string)` - A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `\"{{alias.name}}@example.com\"`. If blank, the Alias's Name field will be used as-is. Currently-supported mappings:\n- alias.name: The name returned by the mount configured via the \u003cspan pulumi-lang-nodejs=\"`mountAccessor`\" pulumi-lang-dotnet=\"`MountAccessor`\" pulumi-lang-go=\"`mountAccessor`\" pulumi-lang-python=\"`mount_accessor`\" pulumi-lang-yaml=\"`mountAccessor`\" pulumi-lang-java=\"`mountAccessor`\" pulumi-lang-hcl=\"`mount_accessor`\"\u003e`mountAccessor`\u003c/span\u003e parameter\n- entity.name: The name configured for the Entity\n- alias.metadata.`\u003ckey\u003e`: The value of the Alias's metadata parameter\n- entity.metadata.`\u003ckey\u003e`: The value of the Entity's metadata parameter\n" } }, "requiredInputs": [ "apiHostname", "integrationKey", "mountAccessor", "secretKey" ], "stateInputs": { "description": "Input properties used for looking up and filtering MfaDuo resources.\n", "properties": { "apiHostname": { "type": "string", "description": "`(string: \u003crequired\u003e)` - API hostname for Duo.\n" }, "integrationKey": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Integration key for Duo.\n", "secret": true }, "mountAccessor": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.\n" }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "pushInfo": { "type": "string", "description": "`(string)` - Push information for Duo.\n" }, "secretKey": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Secret key for Duo.\n", "secret": true }, "usernameFormat": { "type": "string", "description": "`(string)` - A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `\"{{alias.name}}@example.com\"`. If blank, the Alias's Name field will be used as-is. Currently-supported mappings:\n- alias.name: The name returned by the mount configured via the \u003cspan pulumi-lang-nodejs=\"`mountAccessor`\" pulumi-lang-dotnet=\"`MountAccessor`\" pulumi-lang-go=\"`mountAccessor`\" pulumi-lang-python=\"`mount_accessor`\" pulumi-lang-yaml=\"`mountAccessor`\" pulumi-lang-java=\"`mountAccessor`\" pulumi-lang-hcl=\"`mount_accessor`\"\u003e`mountAccessor`\u003c/span\u003e parameter\n- entity.name: The name configured for the Entity\n- alias.metadata.`\u003ckey\u003e`: The value of the Alias's metadata parameter\n- entity.metadata.`\u003ckey\u003e`: The value of the Entity's metadata parameter\n" } }, "type": "object" } }, "vault:index/mfaOkta:MfaOkta": { "description": "Provides a resource to manage [Okta MFA](https://www.vaultproject.io/docs/enterprise/mfa/mfa-okta).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst userpass = new vault.AuthBackend(\"userpass\", {\n type: \"userpass\",\n path: \"userpass\",\n});\nconst myOkta = new vault.MfaOkta(\"my_okta\", {\n name: \"my_okta\",\n mountAccessor: userpass.accessor,\n usernameFormat: \"user@example.com\",\n orgName: \"hashicorp\",\n apiToken: \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nuserpass = vault.AuthBackend(\"userpass\",\n type=\"userpass\",\n path=\"userpass\")\nmy_okta = vault.MfaOkta(\"my_okta\",\n name=\"my_okta\",\n mount_accessor=userpass.accessor,\n username_format=\"user@example.com\",\n org_name=\"hashicorp\",\n api_token=\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var userpass = new Vault.AuthBackend(\"userpass\", new()\n {\n Type = \"userpass\",\n Path = \"userpass\",\n });\n\n var myOkta = new Vault.MfaOkta(\"my_okta\", new()\n {\n Name = \"my_okta\",\n MountAccessor = userpass.Accessor,\n UsernameFormat = \"user@example.com\",\n OrgName = \"hashicorp\",\n ApiToken = \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tuserpass, err := vault.NewAuthBackend(ctx, \"userpass\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"userpass\"),\n\t\t\tPath: pulumi.String(\"userpass\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewMfaOkta(ctx, \"my_okta\", \u0026vault.MfaOktaArgs{\n\t\t\tName: pulumi.String(\"my_okta\"),\n\t\t\tMountAccessor: userpass.Accessor,\n\t\t\tUsernameFormat: pulumi.String(\"user@example.com\"),\n\t\t\tOrgName: pulumi.String(\"hashicorp\"),\n\t\t\tApiToken: pulumi.String(\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"userpass\" {\n type = \"userpass\"\n path = \"userpass\"\n}\nresource \"vault_mfaokta\" \"my_okta\" {\n name = \"my_okta\"\n mount_accessor = vault_authbackend.userpass.accessor\n username_format = \"user@example.com\"\n org_name = \"hashicorp\"\n api_token = \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.MfaOkta;\nimport com.pulumi.vault.MfaOktaArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var userpass = new AuthBackend(\"userpass\", AuthBackendArgs.builder()\n .type(\"userpass\")\n .path(\"userpass\")\n .build());\n\n var myOkta = new MfaOkta(\"myOkta\", MfaOktaArgs.builder()\n .name(\"my_okta\")\n .mountAccessor(userpass.accessor())\n .usernameFormat(\"user@example.com\")\n .orgName(\"hashicorp\")\n .apiToken(\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n userpass:\n type: vault:AuthBackend\n properties:\n type: userpass\n path: userpass\n myOkta:\n type: vault:MfaOkta\n name: my_okta\n properties:\n name: my_okta\n mountAccessor: ${userpass.accessor}\n usernameFormat: user@example.com\n orgName: hashicorp\n apiToken: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nMounts can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/mfaOkta:MfaOkta my_okta my_okta\n```\n\n", "properties": { "apiToken": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Okta API key.\n", "secret": true }, "baseUrl": { "type": "string", "description": "`(string)` - If set, will be used as the base domain for API requests. Examples are `okta.com`, \n`oktapreview.com`, and `okta-emea.com`.\n" }, "mfaOktaId": { "type": "string", "description": "ID computed by Vault." }, "mountAccessor": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The mount to tie this method to for use in automatic mappings. \nThe mapping will use the Name field of Aliases associated with this mount as the username in the mapping.\n" }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "orgName": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Name of the organization to be used in the Okta API.\n" }, "primaryEmail": { "type": "boolean", "description": "`(string: \u003crequired\u003e)` - If set to true, the username will only match the \nprimary email for the account.\n" }, "usernameFormat": { "type": "string", "description": "`(string)` - A format string for mapping Identity names to MFA method names. \nValues to substitute should be placed in `{{}}`. For example, `\"{{alias.name}}@example.com\"`.\nIf blank, the Alias's Name field will be used as-is. Currently-supported mappings:\n- alias.name: The name returned by the mount configured via the \u003cspan pulumi-lang-nodejs=\"`mountAccessor`\" pulumi-lang-dotnet=\"`MountAccessor`\" pulumi-lang-go=\"`mountAccessor`\" pulumi-lang-python=\"`mount_accessor`\" pulumi-lang-yaml=\"`mountAccessor`\" pulumi-lang-java=\"`mountAccessor`\" pulumi-lang-hcl=\"`mount_accessor`\"\u003e`mountAccessor`\u003c/span\u003e parameter\n- entity.name: The name configured for the Entity\n- alias.metadata.`\u003ckey\u003e`: The value of the Alias's metadata parameter\n- entity.metadata.`\u003ckey\u003e`: The value of the Entity's metadata parameter\n" } }, "required": [ "apiToken", "mfaOktaId", "mountAccessor", "name", "orgName" ], "inputProperties": { "apiToken": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Okta API key.\n", "secret": true, "willReplaceOnChanges": true }, "baseUrl": { "type": "string", "description": "`(string)` - If set, will be used as the base domain for API requests. Examples are `okta.com`, \n`oktapreview.com`, and `okta-emea.com`.\n", "willReplaceOnChanges": true }, "mfaOktaId": { "type": "string", "description": "ID computed by Vault." }, "mountAccessor": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The mount to tie this method to for use in automatic mappings. \nThe mapping will use the Name field of Aliases associated with this mount as the username in the mapping.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "orgName": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Name of the organization to be used in the Okta API.\n", "willReplaceOnChanges": true }, "primaryEmail": { "type": "boolean", "description": "`(string: \u003crequired\u003e)` - If set to true, the username will only match the \nprimary email for the account.\n", "willReplaceOnChanges": true }, "usernameFormat": { "type": "string", "description": "`(string)` - A format string for mapping Identity names to MFA method names. \nValues to substitute should be placed in `{{}}`. For example, `\"{{alias.name}}@example.com\"`.\nIf blank, the Alias's Name field will be used as-is. Currently-supported mappings:\n- alias.name: The name returned by the mount configured via the \u003cspan pulumi-lang-nodejs=\"`mountAccessor`\" pulumi-lang-dotnet=\"`MountAccessor`\" pulumi-lang-go=\"`mountAccessor`\" pulumi-lang-python=\"`mount_accessor`\" pulumi-lang-yaml=\"`mountAccessor`\" pulumi-lang-java=\"`mountAccessor`\" pulumi-lang-hcl=\"`mount_accessor`\"\u003e`mountAccessor`\u003c/span\u003e parameter\n- entity.name: The name configured for the Entity\n- alias.metadata.`\u003ckey\u003e`: The value of the Alias's metadata parameter\n- entity.metadata.`\u003ckey\u003e`: The value of the Entity's metadata parameter\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "apiToken", "mountAccessor", "orgName" ], "stateInputs": { "description": "Input properties used for looking up and filtering MfaOkta resources.\n", "properties": { "apiToken": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Okta API key.\n", "secret": true, "willReplaceOnChanges": true }, "baseUrl": { "type": "string", "description": "`(string)` - If set, will be used as the base domain for API requests. Examples are `okta.com`, \n`oktapreview.com`, and `okta-emea.com`.\n", "willReplaceOnChanges": true }, "mfaOktaId": { "type": "string", "description": "ID computed by Vault." }, "mountAccessor": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The mount to tie this method to for use in automatic mappings. \nThe mapping will use the Name field of Aliases associated with this mount as the username in the mapping.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "orgName": { "type": "string", "description": "`(string: \u003crequired\u003e)` - Name of the organization to be used in the Okta API.\n", "willReplaceOnChanges": true }, "primaryEmail": { "type": "boolean", "description": "`(string: \u003crequired\u003e)` - If set to true, the username will only match the \nprimary email for the account.\n", "willReplaceOnChanges": true }, "usernameFormat": { "type": "string", "description": "`(string)` - A format string for mapping Identity names to MFA method names. \nValues to substitute should be placed in `{{}}`. For example, `\"{{alias.name}}@example.com\"`.\nIf blank, the Alias's Name field will be used as-is. Currently-supported mappings:\n- alias.name: The name returned by the mount configured via the \u003cspan pulumi-lang-nodejs=\"`mountAccessor`\" pulumi-lang-dotnet=\"`MountAccessor`\" pulumi-lang-go=\"`mountAccessor`\" pulumi-lang-python=\"`mount_accessor`\" pulumi-lang-yaml=\"`mountAccessor`\" pulumi-lang-java=\"`mountAccessor`\" pulumi-lang-hcl=\"`mount_accessor`\"\u003e`mountAccessor`\u003c/span\u003e parameter\n- entity.name: The name configured for the Entity\n- alias.metadata.`\u003ckey\u003e`: The value of the Alias's metadata parameter\n- entity.metadata.`\u003ckey\u003e`: The value of the Entity's metadata parameter\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:index/mfaPingid:MfaPingid": { "description": "Provides a resource to manage [PingID MFA](https://www.vaultproject.io/docs/enterprise/mfa/mfa-pingid).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new pulumi.Config();\nconst settingsFile = config.requireObject\u003cany\u003e(\"settingsFile\");\nconst userpass = new vault.AuthBackend(\"userpass\", {\n type: \"userpass\",\n path: \"userpass\",\n});\nconst myPingid = new vault.MfaPingid(\"my_pingid\", {\n name: \"my_pingid\",\n mountAccessor: userpass.accessor,\n usernameFormat: \"user@example.com\",\n settingsFileBase64: settingsFile,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = pulumi.Config()\nsettings_file = config.require_object(\"settingsFile\")\nuserpass = vault.AuthBackend(\"userpass\",\n type=\"userpass\",\n path=\"userpass\")\nmy_pingid = vault.MfaPingid(\"my_pingid\",\n name=\"my_pingid\",\n mount_accessor=userpass.accessor,\n username_format=\"user@example.com\",\n settings_file_base64=settings_file)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Config();\n var settingsFile = config.RequireObject\u003cdynamic\u003e(\"settingsFile\");\n var userpass = new Vault.AuthBackend(\"userpass\", new()\n {\n Type = \"userpass\",\n Path = \"userpass\",\n });\n\n var myPingid = new Vault.MfaPingid(\"my_pingid\", new()\n {\n Name = \"my_pingid\",\n MountAccessor = userpass.Accessor,\n UsernameFormat = \"user@example.com\",\n SettingsFileBase64 = settingsFile,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tcfg := config.New(ctx, \"\")\n\t\tvar settingsFile interface{}\n\t\tcfg.RequireObject(\"settingsFile\", \u0026settingsFile)\n\t\tuserpass, err := vault.NewAuthBackend(ctx, \"userpass\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"userpass\"),\n\t\t\tPath: pulumi.String(\"userpass\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewMfaPingid(ctx, \"my_pingid\", \u0026vault.MfaPingidArgs{\n\t\t\tName: pulumi.String(\"my_pingid\"),\n\t\t\tMountAccessor: userpass.Accessor,\n\t\t\tUsernameFormat: pulumi.String(\"user@example.com\"),\n\t\t\tSettingsFileBase64: pulumi.Any(settingsFile),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"userpass\" {\n type = \"userpass\"\n path = \"userpass\"\n}\nresource \"vault_mfapingid\" \"my_pingid\" {\n name = \"my_pingid\"\n mount_accessor = vault_authbackend.userpass.accessor\n username_format = \"user@example.com\"\n settings_file_base64 = var.settingsFile\n}\nvariable \"settingsFile\" {\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.MfaPingid;\nimport com.pulumi.vault.MfaPingidArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n final var config = ctx.config();\n final var settingsFile = config.require(\"settingsFile\");\n var userpass = new AuthBackend(\"userpass\", AuthBackendArgs.builder()\n .type(\"userpass\")\n .path(\"userpass\")\n .build());\n\n var myPingid = new MfaPingid(\"myPingid\", MfaPingidArgs.builder()\n .name(\"my_pingid\")\n .mountAccessor(userpass.accessor())\n .usernameFormat(\"user@example.com\")\n .settingsFileBase64(settingsFile)\n .build());\n\n }\n}\n```\n```yaml\nconfiguration:\n settingsFile:\n type: object\nresources:\n userpass:\n type: vault:AuthBackend\n properties:\n type: userpass\n path: userpass\n myPingid:\n type: vault:MfaPingid\n name: my_pingid\n properties:\n name: my_pingid\n mountAccessor: ${userpass.accessor}\n usernameFormat: user@example.com\n settingsFileBase64: ${settingsFile}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nMounts can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/mfaPingid:MfaPingid my_pingid my_pingid\n```\n\n", "properties": { "adminUrl": { "type": "string", "description": "`(string)` – Admin URL computed by Vault\n" }, "authenticatorUrl": { "type": "string", "description": "`(string)` – Authenticator URL computed by Vault\n" }, "idpUrl": { "type": "string", "description": "`(string)` – IDP URL computed by Vault\n" }, "mfaPingidId": { "type": "string", "description": "`(string)` – ID computed by Vault\n" }, "mountAccessor": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The mount to tie this method to for use in automatic mappings. \nThe mapping will use the Name field of Aliases associated with this mount as the username in the mapping.\n" }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "namespaceId": { "type": "string", "description": "`(string)` – Namespace ID computed by Vault\n" }, "orgAlias": { "type": "string", "description": "`(string)` – Org Alias computed by Vault\n" }, "settingsFileBase64": { "type": "string", "description": "`(string: \u003crequired\u003e)` - A base64-encoded third-party settings file retrieved\nfrom PingID's configuration page.\n" }, "type": { "type": "string", "description": "`(string)` – Type of configuration computed by Vault\n" }, "useSignature": { "type": "boolean", "description": "`(string)` – If set to true, enables use of PingID signature. Computed by Vault\n" }, "usernameFormat": { "type": "string", "description": "`(string)` - A format string for mapping Identity names to MFA method names. \nValues to substitute should be placed in `{{}}`. For example, `\"{{alias.name}}@example.com\"`.\nIf blank, the Alias's Name field will be used as-is. Currently-supported mappings:\n- alias.name: The name returned by the mount configured via the \u003cspan pulumi-lang-nodejs=\"`mountAccessor`\" pulumi-lang-dotnet=\"`MountAccessor`\" pulumi-lang-go=\"`mountAccessor`\" pulumi-lang-python=\"`mount_accessor`\" pulumi-lang-yaml=\"`mountAccessor`\" pulumi-lang-java=\"`mountAccessor`\" pulumi-lang-hcl=\"`mount_accessor`\"\u003e`mountAccessor`\u003c/span\u003e parameter\n- entity.name: The name configured for the Entity\n- alias.metadata.`\u003ckey\u003e`: The value of the Alias's metadata parameter\n- entity.metadata.`\u003ckey\u003e`: The value of the Entity's metadata parameter\n" } }, "required": [ "adminUrl", "authenticatorUrl", "mfaPingidId", "idpUrl", "mountAccessor", "name", "namespaceId", "orgAlias", "settingsFileBase64", "type", "useSignature" ], "inputProperties": { "mfaPingidId": { "type": "string", "description": "`(string)` – ID computed by Vault\n" }, "mountAccessor": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The mount to tie this method to for use in automatic mappings. \nThe mapping will use the Name field of Aliases associated with this mount as the username in the mapping.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "settingsFileBase64": { "type": "string", "description": "`(string: \u003crequired\u003e)` - A base64-encoded third-party settings file retrieved\nfrom PingID's configuration page.\n", "willReplaceOnChanges": true }, "usernameFormat": { "type": "string", "description": "`(string)` - A format string for mapping Identity names to MFA method names. \nValues to substitute should be placed in `{{}}`. For example, `\"{{alias.name}}@example.com\"`.\nIf blank, the Alias's Name field will be used as-is. Currently-supported mappings:\n- alias.name: The name returned by the mount configured via the \u003cspan pulumi-lang-nodejs=\"`mountAccessor`\" pulumi-lang-dotnet=\"`MountAccessor`\" pulumi-lang-go=\"`mountAccessor`\" pulumi-lang-python=\"`mount_accessor`\" pulumi-lang-yaml=\"`mountAccessor`\" pulumi-lang-java=\"`mountAccessor`\" pulumi-lang-hcl=\"`mount_accessor`\"\u003e`mountAccessor`\u003c/span\u003e parameter\n- entity.name: The name configured for the Entity\n- alias.metadata.`\u003ckey\u003e`: The value of the Alias's metadata parameter\n- entity.metadata.`\u003ckey\u003e`: The value of the Entity's metadata parameter\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "mountAccessor", "settingsFileBase64" ], "stateInputs": { "description": "Input properties used for looking up and filtering MfaPingid resources.\n", "properties": { "adminUrl": { "type": "string", "description": "`(string)` – Admin URL computed by Vault\n" }, "authenticatorUrl": { "type": "string", "description": "`(string)` – Authenticator URL computed by Vault\n" }, "idpUrl": { "type": "string", "description": "`(string)` – IDP URL computed by Vault\n" }, "mfaPingidId": { "type": "string", "description": "`(string)` – ID computed by Vault\n" }, "mountAccessor": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The mount to tie this method to for use in automatic mappings. \nThe mapping will use the Name field of Aliases associated with this mount as the username in the mapping.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "namespaceId": { "type": "string", "description": "`(string)` – Namespace ID computed by Vault\n" }, "orgAlias": { "type": "string", "description": "`(string)` – Org Alias computed by Vault\n" }, "settingsFileBase64": { "type": "string", "description": "`(string: \u003crequired\u003e)` - A base64-encoded third-party settings file retrieved\nfrom PingID's configuration page.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "`(string)` – Type of configuration computed by Vault\n" }, "useSignature": { "type": "boolean", "description": "`(string)` – If set to true, enables use of PingID signature. Computed by Vault\n" }, "usernameFormat": { "type": "string", "description": "`(string)` - A format string for mapping Identity names to MFA method names. \nValues to substitute should be placed in `{{}}`. For example, `\"{{alias.name}}@example.com\"`.\nIf blank, the Alias's Name field will be used as-is. Currently-supported mappings:\n- alias.name: The name returned by the mount configured via the \u003cspan pulumi-lang-nodejs=\"`mountAccessor`\" pulumi-lang-dotnet=\"`MountAccessor`\" pulumi-lang-go=\"`mountAccessor`\" pulumi-lang-python=\"`mount_accessor`\" pulumi-lang-yaml=\"`mountAccessor`\" pulumi-lang-java=\"`mountAccessor`\" pulumi-lang-hcl=\"`mount_accessor`\"\u003e`mountAccessor`\u003c/span\u003e parameter\n- entity.name: The name configured for the Entity\n- alias.metadata.`\u003ckey\u003e`: The value of the Alias's metadata parameter\n- entity.metadata.`\u003ckey\u003e`: The value of the Entity's metadata parameter\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:index/mfaTotp:MfaTotp": { "description": "Provides a resource to manage [TOTP MFA](https://www.vaultproject.io/docs/enterprise/mfa/mfa-totp).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst myTotp = new vault.MfaTotp(\"my_totp\", {\n name: \"my_totp\",\n issuer: \"hashicorp\",\n period: 60,\n algorithm: \"SHA256\",\n digits: 8,\n keySize: 20,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nmy_totp = vault.MfaTotp(\"my_totp\",\n name=\"my_totp\",\n issuer=\"hashicorp\",\n period=60,\n algorithm=\"SHA256\",\n digits=8,\n key_size=20)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var myTotp = new Vault.MfaTotp(\"my_totp\", new()\n {\n Name = \"my_totp\",\n Issuer = \"hashicorp\",\n Period = 60,\n Algorithm = \"SHA256\",\n Digits = 8,\n KeySize = 20,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewMfaTotp(ctx, \"my_totp\", \u0026vault.MfaTotpArgs{\n\t\t\tName: pulumi.String(\"my_totp\"),\n\t\t\tIssuer: pulumi.String(\"hashicorp\"),\n\t\t\tPeriod: pulumi.Int(60),\n\t\t\tAlgorithm: pulumi.String(\"SHA256\"),\n\t\t\tDigits: pulumi.Int(8),\n\t\t\tKeySize: pulumi.Int(20),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mfatotp\" \"my_totp\" {\n name = \"my_totp\"\n issuer = \"hashicorp\"\n period = 60\n algorithm = \"SHA256\"\n digits = 8\n key_size = 20\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.MfaTotp;\nimport com.pulumi.vault.MfaTotpArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var myTotp = new MfaTotp(\"myTotp\", MfaTotpArgs.builder()\n .name(\"my_totp\")\n .issuer(\"hashicorp\")\n .period(60)\n .algorithm(\"SHA256\")\n .digits(8)\n .keySize(20)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n myTotp:\n type: vault:MfaTotp\n name: my_totp\n properties:\n name: my_totp\n issuer: hashicorp\n period: 60\n algorithm: SHA256\n digits: 8\n keySize: 20\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nMounts can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/mfaTotp:MfaTotp my_totp my_totp\n```\n\n", "properties": { "algorithm": { "type": "string", "description": "`(string)` - Specifies the hashing algorithm used to generate the TOTP code.\nOptions include `SHA1`, `SHA256` and `SHA512`\n" }, "digits": { "type": "integer", "description": "`(int)` - The number of digits in the generated TOTP token.\nThis value can either be 6 or 8.\n" }, "issuer": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The name of the key's issuing organization.\n" }, "keySize": { "type": "integer", "description": "`(int)` - Specifies the size in bytes of the generated key.\n" }, "maxValidationAttempts": { "type": "integer", "description": "`(int)` - The maximum number of consecutive failed validation attempts allowed. Must be a positive integer. Vault defaults this value to \u003cspan pulumi-lang-nodejs=\"`5`\" pulumi-lang-dotnet=\"`5`\" pulumi-lang-go=\"`5`\" pulumi-lang-python=\"`5`\" pulumi-lang-yaml=\"`5`\" pulumi-lang-java=\"`5`\" pulumi-lang-hcl=\"`5`\"\u003e`5`\u003c/span\u003e if not provided or if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e.\n" }, "mfaTotpId": { "type": "string", "description": "ID computed by Vault." }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "period": { "type": "integer", "description": "`(int)` - The length of time used to generate a counter for the TOTP token calculation.\n" }, "qrSize": { "type": "integer", "description": "`(int)` - The pixel size of the generated square QR code.\n" }, "skew": { "type": "integer", "description": "`(int)` - The number of delay periods that are allowed when validating a TOTP token.\nThis value can either be 0 or 1.\n" } }, "required": [ "mfaTotpId", "issuer", "name" ], "inputProperties": { "algorithm": { "type": "string", "description": "`(string)` - Specifies the hashing algorithm used to generate the TOTP code.\nOptions include `SHA1`, `SHA256` and `SHA512`\n", "willReplaceOnChanges": true }, "digits": { "type": "integer", "description": "`(int)` - The number of digits in the generated TOTP token.\nThis value can either be 6 or 8.\n", "willReplaceOnChanges": true }, "issuer": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The name of the key's issuing organization.\n", "willReplaceOnChanges": true }, "keySize": { "type": "integer", "description": "`(int)` - Specifies the size in bytes of the generated key.\n", "willReplaceOnChanges": true }, "maxValidationAttempts": { "type": "integer", "description": "`(int)` - The maximum number of consecutive failed validation attempts allowed. Must be a positive integer. Vault defaults this value to \u003cspan pulumi-lang-nodejs=\"`5`\" pulumi-lang-dotnet=\"`5`\" pulumi-lang-go=\"`5`\" pulumi-lang-python=\"`5`\" pulumi-lang-yaml=\"`5`\" pulumi-lang-java=\"`5`\" pulumi-lang-hcl=\"`5`\"\u003e`5`\u003c/span\u003e if not provided or if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "mfaTotpId": { "type": "string", "description": "ID computed by Vault." }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "period": { "type": "integer", "description": "`(int)` - The length of time used to generate a counter for the TOTP token calculation.\n", "willReplaceOnChanges": true }, "qrSize": { "type": "integer", "description": "`(int)` - The pixel size of the generated square QR code.\n", "willReplaceOnChanges": true }, "skew": { "type": "integer", "description": "`(int)` - The number of delay periods that are allowed when validating a TOTP token.\nThis value can either be 0 or 1.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "issuer" ], "stateInputs": { "description": "Input properties used for looking up and filtering MfaTotp resources.\n", "properties": { "algorithm": { "type": "string", "description": "`(string)` - Specifies the hashing algorithm used to generate the TOTP code.\nOptions include `SHA1`, `SHA256` and `SHA512`\n", "willReplaceOnChanges": true }, "digits": { "type": "integer", "description": "`(int)` - The number of digits in the generated TOTP token.\nThis value can either be 6 or 8.\n", "willReplaceOnChanges": true }, "issuer": { "type": "string", "description": "`(string: \u003crequired\u003e)` - The name of the key's issuing organization.\n", "willReplaceOnChanges": true }, "keySize": { "type": "integer", "description": "`(int)` - Specifies the size in bytes of the generated key.\n", "willReplaceOnChanges": true }, "maxValidationAttempts": { "type": "integer", "description": "`(int)` - The maximum number of consecutive failed validation attempts allowed. Must be a positive integer. Vault defaults this value to \u003cspan pulumi-lang-nodejs=\"`5`\" pulumi-lang-dotnet=\"`5`\" pulumi-lang-go=\"`5`\" pulumi-lang-python=\"`5`\" pulumi-lang-yaml=\"`5`\" pulumi-lang-java=\"`5`\" pulumi-lang-hcl=\"`5`\"\u003e`5`\u003c/span\u003e if not provided or if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "mfaTotpId": { "type": "string", "description": "ID computed by Vault." }, "name": { "type": "string", "description": "`(string: \u003crequired\u003e)` – Name of the MFA method.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "period": { "type": "integer", "description": "`(int)` - The length of time used to generate a counter for the TOTP token calculation.\n", "willReplaceOnChanges": true }, "qrSize": { "type": "integer", "description": "`(int)` - The pixel size of the generated square QR code.\n", "willReplaceOnChanges": true }, "skew": { "type": "integer", "description": "`(int)` - The number of delay periods that are allowed when validating a TOTP token.\nThis value can either be 0 or 1.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:index/mount:Mount": { "description": "This resource enables a new secrets engine at the given path.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.Mount(\"example\", {\n path: \"dummy\",\n type: \"generic\",\n description: \"This is an example mount\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.Mount(\"example\",\n path=\"dummy\",\n type=\"generic\",\n description=\"This is an example mount\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Mount(\"example\", new()\n {\n Path = \"dummy\",\n Type = \"generic\",\n Description = \"This is an example mount\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewMount(ctx, \"example\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"dummy\"),\n\t\t\tType: pulumi.String(\"generic\"),\n\t\t\tDescription: pulumi.String(\"This is an example mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"example\" {\n path = \"dummy\"\n type = \"generic\"\n description = \"This is an example mount\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new Mount(\"example\", MountArgs.builder()\n .path(\"dummy\")\n .type(\"generic\")\n .description(\"This is an example mount\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:Mount\n properties:\n path: dummy\n type: generic\n description: This is an example mount\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kvv2_example = new vault.Mount(\"kvv2-example\", {\n path: \"version2-example\",\n type: \"kv-v2\",\n options: {\n version: \"2\",\n type: \"kv-v2\",\n },\n description: \"This is an example KV Version 2 secret engine mount\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkvv2_example = vault.Mount(\"kvv2-example\",\n path=\"version2-example\",\n type=\"kv-v2\",\n options={\n \"version\": \"2\",\n \"type\": \"kv-v2\",\n },\n description=\"This is an example KV Version 2 secret engine mount\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kvv2_example = new Vault.Mount(\"kvv2-example\", new()\n {\n Path = \"version2-example\",\n Type = \"kv-v2\",\n Options = \n {\n { \"version\", \"2\" },\n { \"type\", \"kv-v2\" },\n },\n Description = \"This is an example KV Version 2 secret engine mount\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewMount(ctx, \"kvv2-example\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"version2-example\"),\n\t\t\tType: pulumi.String(\"kv-v2\"),\n\t\t\tOptions: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t\t\"type\": pulumi.String(\"kv-v2\"),\n\t\t\t},\n\t\t\tDescription: pulumi.String(\"This is an example KV Version 2 secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"kvv2-example\" {\n path = \"version2-example\"\n type = \"kv-v2\"\n options = {\n \"version\" = \"2\"\n \"type\" = \"kv-v2\"\n }\n description = \"This is an example KV Version 2 secret engine mount\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kvv2_example = new Mount(\"kvv2-example\", MountArgs.builder()\n .path(\"version2-example\")\n .type(\"kv-v2\")\n .options(Map.ofEntries(\n Map.entry(\"version\", \"2\"),\n Map.entry(\"type\", \"kv-v2\")\n ))\n .description(\"This is an example KV Version 2 secret engine mount\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kvv2-example:\n type: vault:Mount\n properties:\n path: version2-example\n type: kv-v2\n options:\n version: '2'\n type: kv-v2\n description: This is an example KV Version 2 secret engine mount\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst transit_example = new vault.Mount(\"transit-example\", {\n path: \"transit-example\",\n type: \"transit\",\n description: \"This is an example transit secret engine mount\",\n options: {\n convergent_encryption: \"false\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntransit_example = vault.Mount(\"transit-example\",\n path=\"transit-example\",\n type=\"transit\",\n description=\"This is an example transit secret engine mount\",\n options={\n \"convergent_encryption\": \"false\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var transit_example = new Vault.Mount(\"transit-example\", new()\n {\n Path = \"transit-example\",\n Type = \"transit\",\n Description = \"This is an example transit secret engine mount\",\n Options = \n {\n { \"convergent_encryption\", \"false\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewMount(ctx, \"transit-example\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"transit-example\"),\n\t\t\tType: pulumi.String(\"transit\"),\n\t\t\tDescription: pulumi.String(\"This is an example transit secret engine mount\"),\n\t\t\tOptions: pulumi.StringMap{\n\t\t\t\t\"convergent_encryption\": pulumi.String(\"false\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"transit-example\" {\n path = \"transit-example\"\n type = \"transit\"\n description = \"This is an example transit secret engine mount\"\n options = {\n \"convergent_encryption\" = false\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var transit_example = new Mount(\"transit-example\", MountArgs.builder()\n .path(\"transit-example\")\n .type(\"transit\")\n .description(\"This is an example transit secret engine mount\")\n .options(Map.of(\"convergent_encryption\", \"false\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n transit-example:\n type: vault:Mount\n properties:\n path: transit-example\n type: transit\n description: This is an example transit secret engine mount\n options:\n convergent_encryption: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki_example = new vault.Mount(\"pki-example\", {\n path: \"pki-example\",\n type: \"pki\",\n description: \"This is an example PKI mount\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 86400,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki_example = vault.Mount(\"pki-example\",\n path=\"pki-example\",\n type=\"pki\",\n description=\"This is an example PKI mount\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=86400)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki_example = new Vault.Mount(\"pki-example\", new()\n {\n Path = \"pki-example\",\n Type = \"pki\",\n Description = \"This is an example PKI mount\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 86400,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewMount(ctx, \"pki-example\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-example\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"This is an example PKI mount\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki-example\" {\n path = \"pki-example\"\n type = \"pki\"\n description = \"This is an example PKI mount\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki_example = new Mount(\"pki-example\", MountArgs.builder()\n .path(\"pki-example\")\n .type(\"pki\")\n .description(\"This is an example PKI mount\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(86400)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki-example:\n type: vault:Mount\n properties:\n path: pki-example\n type: pki\n description: This is an example PKI mount\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nMounts can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/mount:Mount example dummy\n```\n\n", "properties": { "accessor": { "type": "string", "description": "The accessor for this mount.\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "Set of managed key registry entry names that the mount in question is allowed to access\n" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow, allowing a plugin to include\nthem in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds\n" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of allowed authentication mount accessors the\nbackend can request delegated authentication for.\n" }, "description": { "type": "string", "description": "Human-friendly description of the mount\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source\n" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens. If\nnot provided, this will default to Vault's OIDC default key.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific\nlisting endpoint. Valid values are \u003cspan pulumi-lang-nodejs=\"`unauth`\" pulumi-lang-dotnet=\"`Unauth`\" pulumi-lang-go=\"`unauth`\" pulumi-lang-python=\"`unauth`\" pulumi-lang-yaml=\"`unauth`\" pulumi-lang-java=\"`unauth`\" pulumi-lang-hcl=\"`unauth`\"\u003e`unauth`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`hidden`\" pulumi-lang-dotnet=\"`Hidden`\" pulumi-lang-go=\"`hidden`\" pulumi-lang-python=\"`hidden`\" pulumi-lang-yaml=\"`hidden`\" pulumi-lang-java=\"`hidden`\" pulumi-lang-hcl=\"`hidden`\"\u003e`hidden`\u003c/span\u003e. If not set, behaves like \u003cspan pulumi-lang-nodejs=\"`hidden`\" pulumi-lang-dotnet=\"`Hidden`\" pulumi-lang-go=\"`hidden`\" pulumi-lang-python=\"`hidden`\" pulumi-lang-yaml=\"`hidden`\" pulumi-lang-java=\"`hidden`\" pulumi-lang-hcl=\"`hidden`\"\u003e`hidden`\u003c/span\u003e.\n" }, "local": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enforce local mount in HA environment\n" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to\nthe plugin.\n" }, "path": { "type": "string", "description": "Where the secret backend will be mounted\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. \"v1.0.0\".\nIf unspecified, the server will select any matching unversioned plugin that may have been\nregistered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.\n" }, "sealWrap": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability\n" }, "type": { "type": "string", "description": "Type of the backend, such as \"aws\"\n" } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "defaultLeaseTtlSeconds", "forceNoCache", "maxLeaseTtlSeconds", "path", "sealWrap", "type" ], "inputProperties": { "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "Set of managed key registry entry names that the mount in question is allowed to access\n" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow, allowing a plugin to include\nthem in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds\n" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of allowed authentication mount accessors the\nbackend can request delegated authentication for.\n" }, "description": { "type": "string", "description": "Human-friendly description of the mount\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source\n", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens. If\nnot provided, this will default to Vault's OIDC default key.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific\nlisting endpoint. Valid values are \u003cspan pulumi-lang-nodejs=\"`unauth`\" pulumi-lang-dotnet=\"`Unauth`\" pulumi-lang-go=\"`unauth`\" pulumi-lang-python=\"`unauth`\" pulumi-lang-yaml=\"`unauth`\" pulumi-lang-java=\"`unauth`\" pulumi-lang-hcl=\"`unauth`\"\u003e`unauth`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`hidden`\" pulumi-lang-dotnet=\"`Hidden`\" pulumi-lang-go=\"`hidden`\" pulumi-lang-python=\"`hidden`\" pulumi-lang-yaml=\"`hidden`\" pulumi-lang-java=\"`hidden`\" pulumi-lang-hcl=\"`hidden`\"\u003e`hidden`\u003c/span\u003e. If not set, behaves like \u003cspan pulumi-lang-nodejs=\"`hidden`\" pulumi-lang-dotnet=\"`Hidden`\" pulumi-lang-go=\"`hidden`\" pulumi-lang-python=\"`hidden`\" pulumi-lang-yaml=\"`hidden`\" pulumi-lang-java=\"`hidden`\" pulumi-lang-hcl=\"`hidden`\"\u003e`hidden`\u003c/span\u003e.\n" }, "local": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enforce local mount in HA environment\n", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to\nthe plugin.\n" }, "path": { "type": "string", "description": "Where the secret backend will be mounted\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. \"v1.0.0\".\nIf unspecified, the server will select any matching unversioned plugin that may have been\nregistered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.\n" }, "sealWrap": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Type of the backend, such as \"aws\"\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "path", "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering Mount resources.\n", "properties": { "accessor": { "type": "string", "description": "The accessor for this mount.\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "Set of managed key registry entry names that the mount in question is allowed to access\n" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow, allowing a plugin to include\nthem in the response.\n" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.\n" }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds\n" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of allowed authentication mount accessors the\nbackend can request delegated authentication for.\n" }, "description": { "type": "string", "description": "Human-friendly description of the mount\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source\n", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens. If\nnot provided, this will default to Vault's OIDC default key.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific\nlisting endpoint. Valid values are \u003cspan pulumi-lang-nodejs=\"`unauth`\" pulumi-lang-dotnet=\"`Unauth`\" pulumi-lang-go=\"`unauth`\" pulumi-lang-python=\"`unauth`\" pulumi-lang-yaml=\"`unauth`\" pulumi-lang-java=\"`unauth`\" pulumi-lang-hcl=\"`unauth`\"\u003e`unauth`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`hidden`\" pulumi-lang-dotnet=\"`Hidden`\" pulumi-lang-go=\"`hidden`\" pulumi-lang-python=\"`hidden`\" pulumi-lang-yaml=\"`hidden`\" pulumi-lang-java=\"`hidden`\" pulumi-lang-hcl=\"`hidden`\"\u003e`hidden`\u003c/span\u003e. If not set, behaves like \u003cspan pulumi-lang-nodejs=\"`hidden`\" pulumi-lang-dotnet=\"`Hidden`\" pulumi-lang-go=\"`hidden`\" pulumi-lang-python=\"`hidden`\" pulumi-lang-yaml=\"`hidden`\" pulumi-lang-java=\"`hidden`\" pulumi-lang-hcl=\"`hidden`\"\u003e`hidden`\u003c/span\u003e.\n" }, "local": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enforce local mount in HA environment\n", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend\n" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to\nthe plugin.\n" }, "path": { "type": "string", "description": "Where the secret backend will be mounted\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. \"v1.0.0\".\nIf unspecified, the server will select any matching unversioned plugin that may have been\nregistered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.\n" }, "sealWrap": { "type": "boolean", "description": "Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Type of the backend, such as \"aws\"\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:index/namespace:Namespace": { "description": "Provides a resource to manage [Namespaces](https://www.vaultproject.io/docs/enterprise/namespaces/index.html).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n### Single namespace\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst ns1 = new vault.Namespace(\"ns1\", {path: \"ns1\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nns1 = vault.Namespace(\"ns1\", path=\"ns1\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var ns1 = new Vault.Namespace(\"ns1\", new()\n {\n Path = \"ns1\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewNamespace(ctx, \"ns1\", \u0026vault.NamespaceArgs{\n\t\t\tPath: pulumi.String(\"ns1\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_namespace\" \"ns1\" {\n path = \"ns1\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Namespace;\nimport com.pulumi.vault.NamespaceArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var ns1 = new Namespace(\"ns1\", NamespaceArgs.builder()\n .path(\"ns1\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n ns1:\n type: vault:Namespace\n properties:\n path: ns1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Nested namespaces\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new pulumi.Config();\nconst childNamespaces = config.getObject\u003cArray\u003cstring\u003e\u003e(\"childNamespaces\") || [\n \"child_0\",\n \"child_1\",\n \"child_2\",\n];\nconst parent = new vault.Namespace(\"parent\", {path: \"parent\"});\nconst children: vault.Namespace[] = [];\nfor (const range of childNamespaces.map((v, k) =\u003e ({key: k, value: v}))) {\n children.push(new vault.Namespace(`children-${range.key}`, {\n namespace: parent.path,\n path: String(range.key),\n }));\n}\nconst childrenMount: vault.Mount[] = [];\nchildren.apply(rangeBody =\u003e {\n for (const range of rangeBody.map((v, k) =\u003e ({key: k, value: v}))) {\n childrenMount.push(new vault.Mount(`children-${range.key}`, {\n namespace: range.value.pathFq,\n path: \"secrets\",\n type: \"kv\",\n options: {\n version: \"1\",\n },\n }));\n }\n});\nconst childrenSecret: vault.generic.Secret[] = [];\nchildrenMount.apply(rangeBody =\u003e {\n for (const range of rangeBody.map((v, k) =\u003e ({key: k, value: v}))) {\n childrenSecret.push(new vault.generic.Secret(`children-${range.key}`, {\n namespace: range.value.namespace,\n path: `${range.value.path}/secret`,\n dataJson: JSON.stringify({\n ns: range.key,\n }),\n }));\n }\n});\n```\n```python\nimport pulumi\nfrom typing import Any\nimport json\nimport pulumi_vault as vault\n\nconfig = pulumi.Config()\nchild_namespaces = config.get_object(\"childNamespaces\")\nif child_namespaces is None:\n child_namespaces = [\n \"child_0\",\n \"child_1\",\n \"child_2\",\n ]\nparent = vault.Namespace(\"parent\", path=\"parent\")\nchildren: list[vault.Namespace] = []\nfor children_range in [{\"key\": k, \"value\": v} for [k, v] in enumerate(child_namespaces)]:\n children.append(vault.Namespace(f\"children-{children_range['key']}\",\n namespace=parent.path,\n path=str(children_range[\"key\"])))\nchildren_mount: list[vault.Mount] = []\ndef create_children(range_body):\n for children_mount_range in [{\"key\": k, \"value\": v} for [k, v] in enumerate(range_body)]:\n children_mount.append(vault.Mount(f\"children-{children_mount_range['key']}\",\n namespace=children_mount_range[\"value\"].path_fq,\n path=\"secrets\",\n type=\"kv\",\n options={\n \"version\": \"1\",\n }))\n\nchildren.apply(create_children)\nchildren_secret: list[vault.generic.Secret] = []\ndef create_children(range_body):\n for children_secret_range in [{\"key\": k, \"value\": v} for [k, v] in enumerate(range_body)]:\n children_secret.append(vault.generic.Secret(f\"children-{children_secret_range['key']}\",\n namespace=children_secret_range[\"value\"].namespace,\n path=f\"{children_secret_range['value'].path}/secret\",\n data_json=json.dumps({\n \"ns\": children_secret_range[\"key\"],\n })))\n\nchildren_mount.apply(create_children)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text.Json;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Config();\n var childNamespaces = config.GetObject\u003cstring[]\u003e(\"childNamespaces\") ?? new[]\n {\n \"child_0\",\n \"child_1\",\n \"child_2\",\n };\n var parent = new Vault.Namespace(\"parent\", new()\n {\n Path = \"parent\",\n });\n\n var children = new List\u003cVault.Namespace\u003e();\n foreach (var range in childNamespaces.Select((v, k) =\u003e new { Key = k, Value = v }))\n {\n children.Add(new Vault.Namespace($\"children-{range.Key}\", new()\n {\n TargetNamespace = parent.Path,\n Path = range.Key,\n }));\n }\n var childrenMount = new List\u003cVault.Mount\u003e();\n children.Apply(rangeBody =\u003e\n {\n foreach (var range in rangeBody.Select((v, k) =\u003e new { Key = k, Value = v }))\n {\n childrenMount.Add(new Vault.Mount($\"children-{range.Key}\", new()\n {\n Namespace = range.Value.PathFq,\n Path = \"secrets\",\n Type = \"kv\",\n Options = \n {\n { \"version\", \"1\" },\n },\n }));\n }\n return 0;\n });\n var childrenSecret = new List\u003cVault.Generic.Secret\u003e();\n childrenMount.Apply(rangeBody =\u003e\n {\n foreach (var range in rangeBody.Select((v, k) =\u003e new { Key = k, Value = v }))\n {\n childrenSecret.Add(new Vault.Generic.Secret($\"children-{range.Key}\", new()\n {\n Namespace = range.Value.Namespace,\n Path = $\"{range.Value.Path}/secret\",\n DataJson = JsonSerializer.Serialize(new Dictionary\u003cstring, object?\u003e\n {\n [\"ns\"] = range.Key,\n }),\n }));\n }\n return 0;\n });\n});\n```\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\t\"fmt\"\n\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/generic\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tcfg := config.New(ctx, \"\")\n\t\tchildNamespaces := []string{\n\t\t\t\"child_0\",\n\t\t\t\"child_1\",\n\t\t\t\"child_2\",\n\t\t}\n\t\tif param := cfg.GetObject(\"childNamespaces\"); param != nil {\n\t\t\tchildNamespaces = param\n\t\t}\n\t\tparent, err := vault.NewNamespace(ctx, \"parent\", \u0026vault.NamespaceArgs{\n\t\t\tPath: pulumi.String(\"parent\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tvar children []*vault.Namespace\n\t\tfor key0, _ := range childNamespaces {\n\t\t\t__res, err := vault.NewNamespace(ctx, fmt.Sprintf(\"children-%v\", key0), \u0026vault.NamespaceArgs{\n\t\t\t\tNamespace: parent.Path,\n\t\t\t\tPath: pulumi.Int(key0),\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tchildren = append(children, __res)\n\t\t}\n\t\tvar childrenMount []*vault.Mount\n\t\tfor key0, val0 := range children {\n\t\t\t__res, err := vault.NewMount(ctx, fmt.Sprintf(\"children-%v\", key0), \u0026vault.MountArgs{\n\t\t\t\tNamespace: pulumi.String(val0),\n\t\t\t\tPath: pulumi.String(\"secrets\"),\n\t\t\t\tType: pulumi.String(\"kv\"),\n\t\t\t\tOptions: pulumi.StringMap{\n\t\t\t\t\t\"version\": pulumi.String(\"1\"),\n\t\t\t\t},\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tchildrenMount = append(childrenMount, __res)\n\t\t}\n\t\ttmpJSON0, err := json.Marshal(map[string]int{\n\t\t\t\"ns\": key0,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjson0 := string(tmpJSON0)\n\t\tvar childrenSecret []*generic.Secret\n\t\tfor key0, val0 := range childrenMount {\n\t\t\t__res, err := generic.NewSecret(ctx, fmt.Sprintf(\"children-%v\", key0), \u0026generic.SecretArgs{\n\t\t\t\tNamespace: pulumi.String(val0),\n\t\t\t\tPath: pulumi.Sprintf(\"%v/secret\", val0),\n\t\t\t\tDataJson: pulumi.String(json0),\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tchildrenSecret = append(childrenSecret, __res)\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_namespace\" \"parent\" {\n path = \"parent\"\n}\nresource \"vault_namespace\" \"children\" {\n for_each = { for __key, __value in var.childNamespaces : tostring(__key) =\u003e __value }\n namespace = vault_namespace.parent.path\n path = each.key\n}\nresource \"vault_mount\" \"children\" {\n for_each = { for __key, __value in vault_namespace.children : tostring(__key) =\u003e __value }\n namespace = each.value.pathFq\n path = \"secrets\"\n type = \"kv\"\n options = {\n \"version\" = \"1\"\n }\n}\nresource \"vault_generic_secret\" \"children\" {\n for_each = { for __key, __value in vault_mount.children : tostring(__key) =\u003e __value }\n namespace = each.value.namespace\n path =\"${each.value.path}/secret\"\n data_json = jsonencode({\n \"ns\" = each.key\n })\n}\nvariable \"childNamespaces\" {\n type = list(string)\n default = [\"child_0\", \"child_1\", \"child_2\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Namespace;\nimport com.pulumi.vault.NamespaceArgs;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.generic.Secret;\nimport com.pulumi.vault.generic.SecretArgs;\nimport static com.pulumi.codegen.internal.Serialization.*;\nimport com.pulumi.codegen.internal.KeyedValue;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n final var config = ctx.config();\n final var childNamespaces = config.get(\"childNamespaces\").orElse(Arrays.asList( \n \"child_0\",\n \"child_1\",\n \"child_2\"));\n var parent = new Namespace(\"parent\", NamespaceArgs.builder()\n .path(\"parent\")\n .build());\n\n for (var range : KeyedValue.of(childNamespaces)) {\n new Namespace(\"children-\" + range.key(), NamespaceArgs.builder()\n .namespace(parent.path())\n .path(range.key())\n .build());\n }\n\n for (var range : KeyedValue.of(children)) {\n new Mount(\"childrenMount-\" + range.key(), MountArgs.builder()\n .namespace(range.value().pathFq())\n .path(\"secrets\")\n .type(\"kv\")\n .options(Map.of(\"version\", \"1\"))\n .build());\n }\n\n for (var range : KeyedValue.of(childrenMount)) {\n new Secret(\"childrenSecret-\" + range.key(), SecretArgs.builder()\n .namespace(range.value().namespace())\n .path(String.format(\"%s/secret\", range.value().path()))\n .dataJson(serializeJson(\n jsonObject(\n jsonProperty(\"ns\", range.key())\n )))\n .build());\n }\n\n }\n}\n```\n```yaml\nconfiguration:\n childNamespaces:\n type: list\u003cstring\u003e\n default:\n - child_0\n - child_1\n - child_2\nresources:\n parent:\n type: vault:Namespace\n properties:\n path: parent\n children:\n type: vault:Namespace\n properties:\n namespace: ${parent.path}\n path: ${range.key}\n options: {}\n childrenMount:\n type: vault:Mount\n name: children\n properties:\n namespace: ${range.value.pathFq}\n path: secrets\n type: kv\n options:\n version: '1'\n options: {}\n childrenSecret:\n type: vault:generic:Secret\n name: children\n properties:\n namespace: ${range.value.namespace}\n path: ${range.value.path}/secret\n dataJson:\n fn::toJSON:\n ns: ${range.key}\n options: {}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Tutorials\n\nRefer to the [Codify Management of Vault Enterprise Using Terraform](https://learn.hashicorp.com/tutorials/vault/codify-mgmt-enterprise) tutorial for additional examples using Vault namespaces.\n\n## Import\n\nNamespaces can be imported using its \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e as accessor id\n\n```sh\n$ pulumi import vault:index/namespace:Namespace example \u003cname\u003e\n```\n\nIf the declared resource is imported and intends to support namespaces using a provider alias, then the name is relative to the namespace path.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example2 = new vault.Namespace(\"example2\", {path: \"example2\"});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample2 = vault.Namespace(\"example2\", path=\"example2\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example2 = new Vault.Namespace(\"example2\", new()\n {\n Path = \"example2\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewNamespace(ctx, \"example2\", \u0026vault.NamespaceArgs{\n\t\t\tPath: pulumi.String(\"example2\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_namespace\" \"example2\" {\n path = \"example2\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Namespace;\nimport com.pulumi.vault.NamespaceArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example2 = new Namespace(\"example2\", NamespaceArgs.builder()\n .path(\"example2\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example2:\n type: vault:Namespace\n properties:\n path: example2\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n```sh\n$ pulumi import vault:index/namespace:Namespace example2 example2\n\n$ terraform state show vault_namespace.example2\n```\n\nvault_namespace.example2:\nresource \u003cspan pulumi-lang-nodejs=\"\"vault.Namespace\"\" pulumi-lang-dotnet=\"\"vault.Namespace\"\" pulumi-lang-go=\"\"Namespace\"\" pulumi-lang-python=\"\"Namespace\"\" pulumi-lang-yaml=\"\"vault.Namespace\"\" pulumi-lang-java=\"\"vault.Namespace\"\" pulumi-lang-hcl=\"\"vault_namespace\"\"\u003e\"vault.Namespace\"\u003c/span\u003e \"example2\" {\nid = \"example/example2/\"\u003cspan pulumi-lang-nodejs=\"\nnamespaceId \" pulumi-lang-dotnet=\"\nNamespaceId \" pulumi-lang-go=\"\nnamespaceId \" pulumi-lang-python=\"\nnamespace_id \" pulumi-lang-yaml=\"\nnamespaceId \" pulumi-lang-java=\"\nnamespaceId \" pulumi-lang-hcl=\"\nnamespace_id \"\u003e\nnamespaceId \u003c/span\u003e= \u003cknown after import\u003e\npath = \"example2\"\u003cspan pulumi-lang-nodejs=\"\npathFq \" pulumi-lang-dotnet=\"\nPathFq \" pulumi-lang-go=\"\npathFq \" pulumi-lang-python=\"\npath_fq \" pulumi-lang-yaml=\"\npathFq \" pulumi-lang-java=\"\npathFq \" pulumi-lang-hcl=\"\npath_fq \"\u003e\npathFq \u003c/span\u003e = \"example2\"\n}\n\n", "properties": { "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom metadata describing this namespace. Value type\nis `map[string]string`. Requires Vault version 1.12+.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "language": { "csharp": { "name": "TargetNamespace" } } }, "namespaceId": { "type": "string", "description": "Vault server's internal ID of the namespace.\n" }, "path": { "type": "string", "description": "The path of the namespace. Must not have a trailing `/`.\n" }, "pathFq": { "type": "string", "description": "The fully qualified path to the namespace. Useful when provisioning resources in a child \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e.\nThe path is relative to the provider's \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e argument.\n" } }, "required": [ "customMetadata", "namespaceId", "path", "pathFq" ], "inputProperties": { "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom metadata describing this namespace. Value type\nis `map[string]string`. Requires Vault version 1.12+.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "language": { "csharp": { "name": "TargetNamespace" } }, "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path of the namespace. Must not have a trailing `/`.\n", "willReplaceOnChanges": true }, "pathFq": { "type": "string", "description": "The fully qualified path to the namespace. Useful when provisioning resources in a child \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e.\nThe path is relative to the provider's \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e argument.\n" } }, "requiredInputs": [ "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering Namespace resources.\n", "properties": { "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom metadata describing this namespace. Value type\nis `map[string]string`. Requires Vault version 1.12+.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "language": { "csharp": { "name": "TargetNamespace" } }, "willReplaceOnChanges": true }, "namespaceId": { "type": "string", "description": "Vault server's internal ID of the namespace.\n" }, "path": { "type": "string", "description": "The path of the namespace. Must not have a trailing `/`.\n", "willReplaceOnChanges": true }, "pathFq": { "type": "string", "description": "The fully qualified path to the namespace. Useful when provisioning resources in a child \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e.\nThe path is relative to the provider's \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e argument.\n" } }, "type": "object" } }, "vault:index/nomadSecretBackend:NomadSecretBackend": { "description": "Creates a Nomad Secret Backend for Vault. The Nomad secret backend for Vault\ngenerates Nomad ACL tokens dynamically based on pre-existing Nomad ACL policies.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.NomadSecretBackend(\"config\", {\n backend: \"nomad\",\n description: \"test description\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 7200,\n maxTtl: 240,\n address: \"https://127.0.0.1:4646\",\n token: \"ae20ceaa-...\",\n ttl: 120,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.NomadSecretBackend(\"config\",\n backend=\"nomad\",\n description=\"test description\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=7200,\n max_ttl=240,\n address=\"https://127.0.0.1:4646\",\n token=\"ae20ceaa-...\",\n ttl=120)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.NomadSecretBackend(\"config\", new()\n {\n Backend = \"nomad\",\n Description = \"test description\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 7200,\n MaxTtl = 240,\n Address = \"https://127.0.0.1:4646\",\n Token = \"ae20ceaa-...\",\n Ttl = 120,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewNomadSecretBackend(ctx, \"config\", \u0026vault.NomadSecretBackendArgs{\n\t\t\tBackend: pulumi.String(\"nomad\"),\n\t\t\tDescription: pulumi.String(\"test description\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(7200),\n\t\t\tMaxTtl: pulumi.Int(240),\n\t\t\tAddress: pulumi.String(\"https://127.0.0.1:4646\"),\n\t\t\tToken: pulumi.String(\"ae20ceaa-...\"),\n\t\t\tTtl: pulumi.Int(120),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_nomadsecretbackend\" \"config\" {\n backend = \"nomad\"\n description = \"test description\"\n default_lease_ttl_seconds = \"3600\"\n max_lease_ttl_seconds = \"7200\"\n max_ttl = \"240\"\n address = \"https://127.0.0.1:4646\"\n token = \"ae20ceaa-...\"\n ttl = \"120\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.NomadSecretBackend;\nimport com.pulumi.vault.NomadSecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new NomadSecretBackend(\"config\", NomadSecretBackendArgs.builder()\n .backend(\"nomad\")\n .description(\"test description\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(7200)\n .maxTtl(240)\n .address(\"https://127.0.0.1:4646\")\n .token(\"ae20ceaa-...\")\n .ttl(120)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:NomadSecretBackend\n properties:\n backend: nomad\n description: test description\n defaultLeaseTtlSeconds: '3600'\n maxLeaseTtlSeconds: '7200'\n maxTtl: '240'\n address: https://127.0.0.1:4646\n token: ae20ceaa-...\n ttl: '120'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e - (Optional) Write-only client certificate key to provide to the Nomad server, must be x509 PEM encoded.\n Use this for enhanced security when you don't want the client key to appear in state files. Requires \u003cspan pulumi-lang-nodejs=\"`clientKeyWoVersion`\" pulumi-lang-dotnet=\"`ClientKeyWoVersion`\" pulumi-lang-go=\"`clientKeyWoVersion`\" pulumi-lang-python=\"`client_key_wo_version`\" pulumi-lang-yaml=\"`clientKeyWoVersion`\" pulumi-lang-java=\"`clientKeyWoVersion`\" pulumi-lang-hcl=\"`client_key_wo_version`\"\u003e`clientKeyWoVersion`\u003c/span\u003e. Conflicts with \u003cspan pulumi-lang-nodejs=\"`clientKey`\" pulumi-lang-dotnet=\"`ClientKey`\" pulumi-lang-go=\"`clientKey`\" pulumi-lang-python=\"`client_key`\" pulumi-lang-yaml=\"`clientKey`\" pulumi-lang-java=\"`clientKey`\" pulumi-lang-hcl=\"`client_key`\"\u003e`clientKey`\u003c/span\u003e.\n **Note**: This property is write-only and will not be read from the API.\n\n* \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e - (Optional) Write-only Nomad Management token to use.\n Use this for enhanced security when you don't want the token to appear in state files. Requires \u003cspan pulumi-lang-nodejs=\"`tokenWoVersion`\" pulumi-lang-dotnet=\"`TokenWoVersion`\" pulumi-lang-go=\"`tokenWoVersion`\" pulumi-lang-python=\"`token_wo_version`\" pulumi-lang-yaml=\"`tokenWoVersion`\" pulumi-lang-java=\"`tokenWoVersion`\" pulumi-lang-hcl=\"`token_wo_version`\"\u003e`tokenWoVersion`\u003c/span\u003e. Conflicts with \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e.\n **Note**: This property is write-only and will not be read from the API.\n\n## Import\n\nNomad secret backend can be imported using the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/nomadSecretBackend:NomadSecretBackend nomad nomad\n```\n\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "address": { "type": "string", "description": "Specifies the address of the Nomad instance, provided\nas \"protocol://host:port\" like \"http://127.0.0.1:4646\".\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "backend": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`nomad`\" pulumi-lang-dotnet=\"`Nomad`\" pulumi-lang-go=\"`nomad`\" pulumi-lang-python=\"`nomad`\" pulumi-lang-yaml=\"`nomad`\" pulumi-lang-java=\"`nomad`\" pulumi-lang-hcl=\"`nomad`\"\u003e`nomad`\u003c/span\u003e.\n" }, "caCert": { "type": "string", "description": "CA certificate to use when verifying the Nomad server certificate, must be\nx509 PEM encoded.\n" }, "clientCert": { "type": "string", "description": "Client certificate to provide to the Nomad server, must be x509 PEM encoded.\n", "secret": true }, "clientKey": { "type": "string", "description": "Client certificate key to provide to the Nomad server, must be x509 PEM encoded.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e.\n", "secret": true }, "clientKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only client key used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert.", "secret": true }, "clientKeyWoVersion": { "type": "integer", "description": "Version counter for the write-only client key. This must be incremented\neach time the \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e value is changed to trigger an update. Required when using \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds." }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Mark the secrets engine as local-only. Local engines are not replicated or removed by replication. Tolerance duration to use when checking the last rotation time." }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds." }, "maxTokenNameLength": { "type": "integer", "description": "Specifies the maximum length to use for the name of the Nomad token\ngenerated with Generate Credential. If omitted, 0 is used and ignored, defaulting to the max value allowed\nby the Nomad version.\n" }, "maxTtl": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "token": { "type": "string", "description": "Specifies the Nomad Management token to use. Conflicts with \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e.\n", "secret": true }, "tokenWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only Nomad Management token to use.", "secret": true }, "tokenWoVersion": { "type": "integer", "description": "Version counter for the write-only token. This must be incremented each time\nthe \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e value is changed to trigger an update. Required when using \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "Specifies the ttl of the lease for the generated token.\n" } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "defaultLeaseTtlSeconds", "forceNoCache", "maxLeaseTtlSeconds", "maxTokenNameLength", "maxTtl", "sealWrap", "ttl" ], "inputProperties": { "address": { "type": "string", "description": "Specifies the address of the Nomad instance, provided\nas \"protocol://host:port\" like \"http://127.0.0.1:4646\".\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "backend": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`nomad`\" pulumi-lang-dotnet=\"`Nomad`\" pulumi-lang-go=\"`nomad`\" pulumi-lang-python=\"`nomad`\" pulumi-lang-yaml=\"`nomad`\" pulumi-lang-java=\"`nomad`\" pulumi-lang-hcl=\"`nomad`\"\u003e`nomad`\u003c/span\u003e.\n" }, "caCert": { "type": "string", "description": "CA certificate to use when verifying the Nomad server certificate, must be\nx509 PEM encoded.\n" }, "clientCert": { "type": "string", "description": "Client certificate to provide to the Nomad server, must be x509 PEM encoded.\n", "secret": true }, "clientKey": { "type": "string", "description": "Client certificate key to provide to the Nomad server, must be x509 PEM encoded.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e.\n", "secret": true }, "clientKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only client key used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert.", "secret": true }, "clientKeyWoVersion": { "type": "integer", "description": "Version counter for the write-only client key. This must be incremented\neach time the \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e value is changed to trigger an update. Required when using \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds." }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Mark the secrets engine as local-only. Local engines are not replicated or removed by replication. Tolerance duration to use when checking the last rotation time." }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds." }, "maxTokenNameLength": { "type": "integer", "description": "Specifies the maximum length to use for the name of the Nomad token\ngenerated with Generate Credential. If omitted, 0 is used and ignored, defaulting to the max value allowed\nby the Nomad version.\n" }, "maxTtl": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "token": { "type": "string", "description": "Specifies the Nomad Management token to use. Conflicts with \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e.\n", "secret": true }, "tokenWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only Nomad Management token to use.", "secret": true }, "tokenWoVersion": { "type": "integer", "description": "Version counter for the write-only token. This must be incremented each time\nthe \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e value is changed to trigger an update. Required when using \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "Specifies the ttl of the lease for the generated token.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering NomadSecretBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "address": { "type": "string", "description": "Specifies the address of the Nomad instance, provided\nas \"protocol://host:port\" like \"http://127.0.0.1:4646\".\n" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "backend": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`nomad`\" pulumi-lang-dotnet=\"`Nomad`\" pulumi-lang-go=\"`nomad`\" pulumi-lang-python=\"`nomad`\" pulumi-lang-yaml=\"`nomad`\" pulumi-lang-java=\"`nomad`\" pulumi-lang-hcl=\"`nomad`\"\u003e`nomad`\u003c/span\u003e.\n" }, "caCert": { "type": "string", "description": "CA certificate to use when verifying the Nomad server certificate, must be\nx509 PEM encoded.\n" }, "clientCert": { "type": "string", "description": "Client certificate to provide to the Nomad server, must be x509 PEM encoded.\n", "secret": true }, "clientKey": { "type": "string", "description": "Client certificate key to provide to the Nomad server, must be x509 PEM encoded.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e.\n", "secret": true }, "clientKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only client key used for Nomad's TLS communication, must be x509 PEM encoded and if this is set you need to also set client_cert.", "secret": true }, "clientKeyWoVersion": { "type": "integer", "description": "Version counter for the write-only client key. This must be incremented\neach time the \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e value is changed to trigger an update. Required when using \u003cspan pulumi-lang-nodejs=\"`clientKeyWo`\" pulumi-lang-dotnet=\"`ClientKeyWo`\" pulumi-lang-go=\"`clientKeyWo`\" pulumi-lang-python=\"`client_key_wo`\" pulumi-lang-yaml=\"`clientKeyWo`\" pulumi-lang-java=\"`clientKeyWo`\" pulumi-lang-hcl=\"`client_key_wo`\"\u003e`clientKeyWo`\u003c/span\u003e.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds." }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Mark the secrets engine as local-only. Local engines are not replicated or removed by replication. Tolerance duration to use when checking the last rotation time." }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds." }, "maxTokenNameLength": { "type": "integer", "description": "Specifies the maximum length to use for the name of the Nomad token\ngenerated with Generate Credential. If omitted, 0 is used and ignored, defaulting to the max value allowed\nby the Nomad version.\n" }, "maxTtl": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "token": { "type": "string", "description": "Specifies the Nomad Management token to use. Conflicts with \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e.\n", "secret": true }, "tokenWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only Nomad Management token to use.", "secret": true }, "tokenWoVersion": { "type": "integer", "description": "Version counter for the write-only token. This must be incremented each time\nthe \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e value is changed to trigger an update. Required when using \u003cspan pulumi-lang-nodejs=\"`tokenWo`\" pulumi-lang-dotnet=\"`TokenWo`\" pulumi-lang-go=\"`tokenWo`\" pulumi-lang-python=\"`token_wo`\" pulumi-lang-yaml=\"`tokenWo`\" pulumi-lang-java=\"`tokenWo`\" pulumi-lang-hcl=\"`token_wo`\"\u003e`tokenWo`\u003c/span\u003e.\n" }, "ttl": { "type": "integer", "description": "Specifies the ttl of the lease for the generated token.\n" } }, "type": "object" } }, "vault:index/nomadSecretRole:NomadSecretRole": { "description": "Creates a Vault role for a Nomad token. This role configures how generated tokens \nwill function.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.NomadSecretBackend(\"config\", {\n backend: \"nomad\",\n description: \"test description\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 7200,\n address: \"https://127.0.0.1:4646\",\n token: \"ae20ceaa-...\",\n});\nconst test = new vault.NomadSecretRole(\"test\", {\n backend: config.backend,\n role: \"test\",\n type: \"client\",\n policies: [\"readonly\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.NomadSecretBackend(\"config\",\n backend=\"nomad\",\n description=\"test description\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=7200,\n address=\"https://127.0.0.1:4646\",\n token=\"ae20ceaa-...\")\ntest = vault.NomadSecretRole(\"test\",\n backend=config.backend,\n role=\"test\",\n type=\"client\",\n policies=[\"readonly\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.NomadSecretBackend(\"config\", new()\n {\n Backend = \"nomad\",\n Description = \"test description\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 7200,\n Address = \"https://127.0.0.1:4646\",\n Token = \"ae20ceaa-...\",\n });\n\n var test = new Vault.NomadSecretRole(\"test\", new()\n {\n Backend = config.Backend,\n Role = \"test\",\n Type = \"client\",\n Policies = new[]\n {\n \"readonly\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tconfig, err := vault.NewNomadSecretBackend(ctx, \"config\", \u0026vault.NomadSecretBackendArgs{\n\t\t\tBackend: pulumi.String(\"nomad\"),\n\t\t\tDescription: pulumi.String(\"test description\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(7200),\n\t\t\tAddress: pulumi.String(\"https://127.0.0.1:4646\"),\n\t\t\tToken: pulumi.String(\"ae20ceaa-...\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewNomadSecretRole(ctx, \"test\", \u0026vault.NomadSecretRoleArgs{\n\t\t\tBackend: config.Backend,\n\t\t\tRole: pulumi.String(\"test\"),\n\t\t\tType: pulumi.String(\"client\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"readonly\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_nomadsecretbackend\" \"config\" {\n backend = \"nomad\"\n description = \"test description\"\n default_lease_ttl_seconds = \"3600\"\n max_lease_ttl_seconds = \"7200\"\n address = \"https://127.0.0.1:4646\"\n token = \"ae20ceaa-...\"\n}\nresource \"vault_nomadsecretrole\" \"test\" {\n backend = vault_nomadsecretbackend.config.backend\n role = \"test\"\n type = \"client\"\n policies = [\"readonly\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.NomadSecretBackend;\nimport com.pulumi.vault.NomadSecretBackendArgs;\nimport com.pulumi.vault.NomadSecretRole;\nimport com.pulumi.vault.NomadSecretRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new NomadSecretBackend(\"config\", NomadSecretBackendArgs.builder()\n .backend(\"nomad\")\n .description(\"test description\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(7200)\n .address(\"https://127.0.0.1:4646\")\n .token(\"ae20ceaa-...\")\n .build());\n\n var test = new NomadSecretRole(\"test\", NomadSecretRoleArgs.builder()\n .backend(config.backend())\n .role(\"test\")\n .type(\"client\")\n .policies(\"readonly\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:NomadSecretBackend\n properties:\n backend: nomad\n description: test description\n defaultLeaseTtlSeconds: '3600'\n maxLeaseTtlSeconds: '7200'\n address: https://127.0.0.1:4646\n token: ae20ceaa-...\n test:\n type: vault:NomadSecretRole\n properties:\n backend: ${config.backend}\n role: test\n type: client\n policies:\n - readonly\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nNomad secret role can be imported using the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/nomadSecretRole:NomadSecretRole bob nomad/role/bob\n```\n\n", "properties": { "backend": { "type": "string", "description": "The unique path this backend should be mounted at.\n" }, "global": { "type": "boolean", "description": "Specifies if the generated token should be global. Defaults to \nfalse.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies attached to the generated token. This setting is only used \nwhen \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is 'client'.\n" }, "role": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n" }, "type": { "type": "string", "description": "Specifies the type of token to create when using this role. Valid \nsettings are 'client' and 'management'. Defaults to 'client'.\n" } }, "required": [ "backend", "global", "policies", "role", "type" ], "inputProperties": { "backend": { "type": "string", "description": "The unique path this backend should be mounted at.\n", "willReplaceOnChanges": true }, "global": { "type": "boolean", "description": "Specifies if the generated token should be global. Defaults to \nfalse.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies attached to the generated token. This setting is only used \nwhen \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is 'client'.\n" }, "role": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Specifies the type of token to create when using this role. Valid \nsettings are 'client' and 'management'. Defaults to 'client'.\n" } }, "requiredInputs": [ "backend", "role" ], "stateInputs": { "description": "Input properties used for looking up and filtering NomadSecretRole resources.\n", "properties": { "backend": { "type": "string", "description": "The unique path this backend should be mounted at.\n", "willReplaceOnChanges": true }, "global": { "type": "boolean", "description": "Specifies if the generated token should be global. Defaults to \nfalse.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies attached to the generated token. This setting is only used \nwhen \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is 'client'.\n" }, "role": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Specifies the type of token to create when using this role. Valid \nsettings are 'client' and 'management'. Defaults to 'client'.\n" } }, "type": "object" } }, "vault:index/oauthResourceServerConfigProfile:OauthResourceServerConfigProfile": { "description": "\u003e **Preview feature:** This feature is currently available as a preview and is possibly incomplete and subject to change. **We strongly discourage using preview or beta features with production workflows.**\n\n\nManages OAuth Resource Server Configuration profiles in Vault Enterprise. These profiles define how Vault validates JWT tokens from OAuth 2.0 resource servers, enabling JWT-based authentication for API requests.\n\n\u003e **Important** This resource is only available in Vault Enterprise and requires Vault 2.0.1 or later.\n\n## Example Usage\n\n### Enable the Feature\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst oauth = new vault.ActivationFlags(\"oauth\", {feature: \"oauth-resource-server\"});\nconst example = new vault.OauthResourceServerConfigProfile(\"example\", {\n profileName: \"example-profile\",\n issuerId: \"https://example.com\",\n useJwks: true,\n jwksUri: \"https://example.com/.well-known/jwks.json\",\n}, {\n dependsOn: [oauth],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\noauth = vault.ActivationFlags(\"oauth\", feature=\"oauth-resource-server\")\nexample = vault.OauthResourceServerConfigProfile(\"example\",\n profile_name=\"example-profile\",\n issuer_id=\"https://example.com\",\n use_jwks=True,\n jwks_uri=\"https://example.com/.well-known/jwks.json\",\n opts = pulumi.ResourceOptions(depends_on=[oauth]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var oauth = new Vault.ActivationFlags(\"oauth\", new()\n {\n Feature = \"oauth-resource-server\",\n });\n\n var example = new Vault.OauthResourceServerConfigProfile(\"example\", new()\n {\n ProfileName = \"example-profile\",\n IssuerId = \"https://example.com\",\n UseJwks = true,\n JwksUri = \"https://example.com/.well-known/jwks.json\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n oauth,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\toauth, err := vault.NewActivationFlags(ctx, \"oauth\", \u0026vault.ActivationFlagsArgs{\n\t\t\tFeature: pulumi.String(\"oauth-resource-server\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewOauthResourceServerConfigProfile(ctx, \"example\", \u0026vault.OauthResourceServerConfigProfileArgs{\n\t\t\tProfileName: pulumi.String(\"example-profile\"),\n\t\t\tIssuerId: pulumi.String(\"https://example.com\"),\n\t\t\tUseJwks: pulumi.Bool(true),\n\t\t\tJwksUri: pulumi.String(\"https://example.com/.well-known/jwks.json\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\toauth,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_activationflags\" \"oauth\" {\n feature = \"oauth-resource-server\"\n}\nresource \"vault_oauthresourceserverconfigprofile\" \"example\" {\n depends_on = [vault_activationflags.oauth]\n profile_name = \"example-profile\"\n issuer_id = \"https://example.com\"\n use_jwks = true\n jwks_uri = \"https://example.com/.well-known/jwks.json\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ActivationFlags;\nimport com.pulumi.vault.ActivationFlagsArgs;\nimport com.pulumi.vault.OauthResourceServerConfigProfile;\nimport com.pulumi.vault.OauthResourceServerConfigProfileArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var oauth = new ActivationFlags(\"oauth\", ActivationFlagsArgs.builder()\n .feature(\"oauth-resource-server\")\n .build());\n\n var example = new OauthResourceServerConfigProfile(\"example\", OauthResourceServerConfigProfileArgs.builder()\n .profileName(\"example-profile\")\n .issuerId(\"https://example.com\")\n .useJwks(true)\n .jwksUri(\"https://example.com/.well-known/jwks.json\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(oauth)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n oauth:\n type: vault:ActivationFlags\n properties:\n feature: oauth-resource-server\n example:\n type: vault:OauthResourceServerConfigProfile\n properties:\n profileName: example-profile\n issuerId: https://example.com\n useJwks: true\n jwksUri: https://example.com/.well-known/jwks.json\n options:\n dependsOn:\n - ${oauth}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### JWKS-Based Profile\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.OauthResourceServerConfigProfile(\"example\", {\n profileName: \"my-oauth-profile\",\n issuerId: \"https://auth.example.com\",\n useJwks: true,\n jwksUri: \"https://auth.example.com/.well-known/jwks.json\",\n audiences: [\n \"api.example.com\",\n \"vault.example.com\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.OauthResourceServerConfigProfile(\"example\",\n profile_name=\"my-oauth-profile\",\n issuer_id=\"https://auth.example.com\",\n use_jwks=True,\n jwks_uri=\"https://auth.example.com/.well-known/jwks.json\",\n audiences=[\n \"api.example.com\",\n \"vault.example.com\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.OauthResourceServerConfigProfile(\"example\", new()\n {\n ProfileName = \"my-oauth-profile\",\n IssuerId = \"https://auth.example.com\",\n UseJwks = true,\n JwksUri = \"https://auth.example.com/.well-known/jwks.json\",\n Audiences = new[]\n {\n \"api.example.com\",\n \"vault.example.com\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewOauthResourceServerConfigProfile(ctx, \"example\", \u0026vault.OauthResourceServerConfigProfileArgs{\n\t\t\tProfileName: pulumi.String(\"my-oauth-profile\"),\n\t\t\tIssuerId: pulumi.String(\"https://auth.example.com\"),\n\t\t\tUseJwks: pulumi.Bool(true),\n\t\t\tJwksUri: pulumi.String(\"https://auth.example.com/.well-known/jwks.json\"),\n\t\t\tAudiences: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"api.example.com\"),\n\t\t\t\tpulumi.String(\"vault.example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_oauthresourceserverconfigprofile\" \"example\" {\n profile_name = \"my-oauth-profile\"\n issuer_id = \"https://auth.example.com\"\n use_jwks = true\n jwks_uri = \"https://auth.example.com/.well-known/jwks.json\"\n audiences = [\"api.example.com\", \"vault.example.com\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.OauthResourceServerConfigProfile;\nimport com.pulumi.vault.OauthResourceServerConfigProfileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new OauthResourceServerConfigProfile(\"example\", OauthResourceServerConfigProfileArgs.builder()\n .profileName(\"my-oauth-profile\")\n .issuerId(\"https://auth.example.com\")\n .useJwks(true)\n .jwksUri(\"https://auth.example.com/.well-known/jwks.json\")\n .audiences( \n \"api.example.com\",\n \"vault.example.com\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:OauthResourceServerConfigProfile\n properties:\n profileName: my-oauth-profile\n issuerId: https://auth.example.com\n useJwks: true\n jwksUri: https://auth.example.com/.well-known/jwks.json\n audiences:\n - api.example.com\n - vault.example.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### PEM-Based Profile with Static Keys\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pemExample = new vault.OauthResourceServerConfigProfile(\"pem_example\", {\n profileName: \"my-pem-profile\",\n issuerId: \"https://auth.example.com\",\n useJwks: false,\n publicKeys: [\n {\n keyId: \"key-1\",\n pem: `-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n...\n-----END PUBLIC KEY-----\n`,\n },\n {\n keyId: \"key-2\",\n pem: `-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG\n...\n-----END PUBLIC KEY-----\n`,\n },\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npem_example = vault.OauthResourceServerConfigProfile(\"pem_example\",\n profile_name=\"my-pem-profile\",\n issuer_id=\"https://auth.example.com\",\n use_jwks=False,\n public_keys=[\n {\n \"key_id\": \"key-1\",\n \"pem\": \"\"\"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n...\n-----END PUBLIC KEY-----\n\"\"\",\n },\n {\n \"key_id\": \"key-2\",\n \"pem\": \"\"\"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG\n...\n-----END PUBLIC KEY-----\n\"\"\",\n },\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pemExample = new Vault.OauthResourceServerConfigProfile(\"pem_example\", new()\n {\n ProfileName = \"my-pem-profile\",\n IssuerId = \"https://auth.example.com\",\n UseJwks = false,\n PublicKeys = new[]\n {\n new Vault.Inputs.OauthResourceServerConfigProfilePublicKeyArgs\n {\n KeyId = \"key-1\",\n Pem = @\"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n...\n-----END PUBLIC KEY-----\n\",\n },\n new Vault.Inputs.OauthResourceServerConfigProfilePublicKeyArgs\n {\n KeyId = \"key-2\",\n Pem = @\"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG\n...\n-----END PUBLIC KEY-----\n\",\n },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewOauthResourceServerConfigProfile(ctx, \"pem_example\", \u0026vault.OauthResourceServerConfigProfileArgs{\n\t\t\tProfileName: pulumi.String(\"my-pem-profile\"),\n\t\t\tIssuerId: pulumi.String(\"https://auth.example.com\"),\n\t\t\tUseJwks: pulumi.Bool(false),\n\t\t\tPublicKeys: vault.OauthResourceServerConfigProfilePublicKeyArray{\n\t\t\t\t\u0026vault.OauthResourceServerConfigProfilePublicKeyArgs{\n\t\t\t\t\tKeyId: pulumi.String(\"key-1\"),\n\t\t\t\t\tPem: pulumi.String(`-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n...\n-----END PUBLIC KEY-----\n`),\n\t\t\t\t},\n\t\t\t\t\u0026vault.OauthResourceServerConfigProfilePublicKeyArgs{\n\t\t\t\t\tKeyId: pulumi.String(\"key-2\"),\n\t\t\t\t\tPem: pulumi.String(\"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG\\n...\\n-----END PUBLIC KEY-----\\n\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_oauthresourceserverconfigprofile\" \"pem_example\" {\n profile_name = \"my-pem-profile\"\n issuer_id = \"https://auth.example.com\"\n use_jwks = false\n public_keys {\n key_id = \"key-1\"\n pem = \"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\\n4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\\n...\\n-----END PUBLIC KEY-----\\n\"\n }\n public_keys {\n key_id = \"key-2\"\n pem = \"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG\\n...\\n-----END PUBLIC KEY-----\\n\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.OauthResourceServerConfigProfile;\nimport com.pulumi.vault.OauthResourceServerConfigProfileArgs;\nimport com.pulumi.vault.inputs.OauthResourceServerConfigProfilePublicKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pemExample = new OauthResourceServerConfigProfile(\"pemExample\", OauthResourceServerConfigProfileArgs.builder()\n .profileName(\"my-pem-profile\")\n .issuerId(\"https://auth.example.com\")\n .useJwks(false)\n .publicKeys( \n OauthResourceServerConfigProfilePublicKeyArgs.builder()\n .keyId(\"key-1\")\n .pem(\"\"\"\n-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n...\n-----END PUBLIC KEY-----\n \"\"\")\n .build(),\n OauthResourceServerConfigProfilePublicKeyArgs.builder()\n .keyId(\"key-2\")\n .pem(\"\"\"\n-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG\n...\n-----END PUBLIC KEY-----\n \"\"\")\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pemExample:\n type: vault:OauthResourceServerConfigProfile\n name: pem_example\n properties:\n profileName: my-pem-profile\n issuerId: https://auth.example.com\n useJwks: false\n publicKeys:\n - keyId: key-1\n pem: |\n -----BEGIN PUBLIC KEY-----\n MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n 4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n ...\n -----END PUBLIC KEY-----\n - keyId: key-2\n pem: |\n -----BEGIN PUBLIC KEY-----\n MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG\n ...\n -----END PUBLIC KEY-----\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Profile with RAR (Rich Authorization Requests) Support\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst rarOptional = new vault.OauthResourceServerConfigProfile(\"rar_optional\", {\n profileName: \"rar-optional-profile\",\n issuerId: \"https://auth.example.com\",\n useJwks: true,\n jwksUri: \"https://auth.example.com/.well-known/jwks.json\",\n optionalAuthorizationDetails: true,\n});\nconst rarMandatory = new vault.OauthResourceServerConfigProfile(\"rar_mandatory\", {\n profileName: \"rar-mandatory-profile\",\n issuerId: \"https://auth.example.com\",\n useJwks: true,\n jwksUri: \"https://auth.example.com/.well-known/jwks.json\",\n optionalAuthorizationDetails: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nrar_optional = vault.OauthResourceServerConfigProfile(\"rar_optional\",\n profile_name=\"rar-optional-profile\",\n issuer_id=\"https://auth.example.com\",\n use_jwks=True,\n jwks_uri=\"https://auth.example.com/.well-known/jwks.json\",\n optional_authorization_details=True)\nrar_mandatory = vault.OauthResourceServerConfigProfile(\"rar_mandatory\",\n profile_name=\"rar-mandatory-profile\",\n issuer_id=\"https://auth.example.com\",\n use_jwks=True,\n jwks_uri=\"https://auth.example.com/.well-known/jwks.json\",\n optional_authorization_details=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var rarOptional = new Vault.OauthResourceServerConfigProfile(\"rar_optional\", new()\n {\n ProfileName = \"rar-optional-profile\",\n IssuerId = \"https://auth.example.com\",\n UseJwks = true,\n JwksUri = \"https://auth.example.com/.well-known/jwks.json\",\n OptionalAuthorizationDetails = true,\n });\n\n var rarMandatory = new Vault.OauthResourceServerConfigProfile(\"rar_mandatory\", new()\n {\n ProfileName = \"rar-mandatory-profile\",\n IssuerId = \"https://auth.example.com\",\n UseJwks = true,\n JwksUri = \"https://auth.example.com/.well-known/jwks.json\",\n OptionalAuthorizationDetails = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewOauthResourceServerConfigProfile(ctx, \"rar_optional\", \u0026vault.OauthResourceServerConfigProfileArgs{\n\t\t\tProfileName: pulumi.String(\"rar-optional-profile\"),\n\t\t\tIssuerId: pulumi.String(\"https://auth.example.com\"),\n\t\t\tUseJwks: pulumi.Bool(true),\n\t\t\tJwksUri: pulumi.String(\"https://auth.example.com/.well-known/jwks.json\"),\n\t\t\tOptionalAuthorizationDetails: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewOauthResourceServerConfigProfile(ctx, \"rar_mandatory\", \u0026vault.OauthResourceServerConfigProfileArgs{\n\t\t\tProfileName: pulumi.String(\"rar-mandatory-profile\"),\n\t\t\tIssuerId: pulumi.String(\"https://auth.example.com\"),\n\t\t\tUseJwks: pulumi.Bool(true),\n\t\t\tJwksUri: pulumi.String(\"https://auth.example.com/.well-known/jwks.json\"),\n\t\t\tOptionalAuthorizationDetails: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_oauthresourceserverconfigprofile\" \"rar_optional\" {\n profile_name = \"rar-optional-profile\"\n issuer_id = \"https://auth.example.com\"\n use_jwks = true\n jwks_uri = \"https://auth.example.com/.well-known/jwks.json\"\n optional_authorization_details = true\n}\nresource \"vault_oauthresourceserverconfigprofile\" \"rar_mandatory\" {\n profile_name = \"rar-mandatory-profile\"\n issuer_id = \"https://auth.example.com\"\n use_jwks = true\n jwks_uri = \"https://auth.example.com/.well-known/jwks.json\"\n optional_authorization_details = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.OauthResourceServerConfigProfile;\nimport com.pulumi.vault.OauthResourceServerConfigProfileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var rarOptional = new OauthResourceServerConfigProfile(\"rarOptional\", OauthResourceServerConfigProfileArgs.builder()\n .profileName(\"rar-optional-profile\")\n .issuerId(\"https://auth.example.com\")\n .useJwks(true)\n .jwksUri(\"https://auth.example.com/.well-known/jwks.json\")\n .optionalAuthorizationDetails(true)\n .build());\n\n var rarMandatory = new OauthResourceServerConfigProfile(\"rarMandatory\", OauthResourceServerConfigProfileArgs.builder()\n .profileName(\"rar-mandatory-profile\")\n .issuerId(\"https://auth.example.com\")\n .useJwks(true)\n .jwksUri(\"https://auth.example.com/.well-known/jwks.json\")\n .optionalAuthorizationDetails(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n rarOptional:\n type: vault:OauthResourceServerConfigProfile\n name: rar_optional\n properties:\n profileName: rar-optional-profile\n issuerId: https://auth.example.com\n useJwks: true\n jwksUri: https://auth.example.com/.well-known/jwks.json\n optionalAuthorizationDetails: true\n rarMandatory:\n type: vault:OauthResourceServerConfigProfile\n name: rar_mandatory\n properties:\n profileName: rar-mandatory-profile\n issuerId: https://auth.example.com\n useJwks: true\n jwksUri: https://auth.example.com/.well-known/jwks.json\n optionalAuthorizationDetails: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Profile in a Namespace\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst app = new vault.Namespace(\"app\", {path: \"application\"});\nconst namespaced = new vault.OauthResourceServerConfigProfile(\"namespaced\", {\n namespace: app.path,\n profileName: \"app-oauth-profile\",\n issuerId: \"https://auth.example.com\",\n useJwks: true,\n jwksUri: \"https://auth.example.com/.well-known/jwks.json\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\napp = vault.Namespace(\"app\", path=\"application\")\nnamespaced = vault.OauthResourceServerConfigProfile(\"namespaced\",\n namespace=app.path,\n profile_name=\"app-oauth-profile\",\n issuer_id=\"https://auth.example.com\",\n use_jwks=True,\n jwks_uri=\"https://auth.example.com/.well-known/jwks.json\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var app = new Vault.Namespace(\"app\", new()\n {\n Path = \"application\",\n });\n\n var namespaced = new Vault.OauthResourceServerConfigProfile(\"namespaced\", new()\n {\n Namespace = app.Path,\n ProfileName = \"app-oauth-profile\",\n IssuerId = \"https://auth.example.com\",\n UseJwks = true,\n JwksUri = \"https://auth.example.com/.well-known/jwks.json\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tapp, err := vault.NewNamespace(ctx, \"app\", \u0026vault.NamespaceArgs{\n\t\t\tPath: pulumi.String(\"application\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewOauthResourceServerConfigProfile(ctx, \"namespaced\", \u0026vault.OauthResourceServerConfigProfileArgs{\n\t\t\tNamespace: app.Path,\n\t\t\tProfileName: pulumi.String(\"app-oauth-profile\"),\n\t\t\tIssuerId: pulumi.String(\"https://auth.example.com\"),\n\t\t\tUseJwks: pulumi.Bool(true),\n\t\t\tJwksUri: pulumi.String(\"https://auth.example.com/.well-known/jwks.json\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_namespace\" \"app\" {\n path = \"application\"\n}\nresource \"vault_oauthresourceserverconfigprofile\" \"namespaced\" {\n namespace = vault_namespace.app.path\n profile_name = \"app-oauth-profile\"\n issuer_id = \"https://auth.example.com\"\n use_jwks = true\n jwks_uri = \"https://auth.example.com/.well-known/jwks.json\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Namespace;\nimport com.pulumi.vault.NamespaceArgs;\nimport com.pulumi.vault.OauthResourceServerConfigProfile;\nimport com.pulumi.vault.OauthResourceServerConfigProfileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var app = new Namespace(\"app\", NamespaceArgs.builder()\n .path(\"application\")\n .build());\n\n var namespaced = new OauthResourceServerConfigProfile(\"namespaced\", OauthResourceServerConfigProfileArgs.builder()\n .namespace(app.path())\n .profileName(\"app-oauth-profile\")\n .issuerId(\"https://auth.example.com\")\n .useJwks(true)\n .jwksUri(\"https://auth.example.com/.well-known/jwks.json\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n app:\n type: vault:Namespace\n properties:\n path: application\n namespaced:\n type: vault:OauthResourceServerConfigProfile\n properties:\n namespace: ${app.path}\n profileName: app-oauth-profile\n issuerId: https://auth.example.com\n useJwks: true\n jwksUri: https://auth.example.com/.well-known/jwks.json\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Disabled Profile\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst disabled = new vault.OauthResourceServerConfigProfile(\"disabled\", {\n profileName: \"disabled-profile\",\n issuerId: \"https://auth.example.com\",\n useJwks: true,\n jwksUri: \"https://auth.example.com/.well-known/jwks.json\",\n enabled: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndisabled = vault.OauthResourceServerConfigProfile(\"disabled\",\n profile_name=\"disabled-profile\",\n issuer_id=\"https://auth.example.com\",\n use_jwks=True,\n jwks_uri=\"https://auth.example.com/.well-known/jwks.json\",\n enabled=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var disabled = new Vault.OauthResourceServerConfigProfile(\"disabled\", new()\n {\n ProfileName = \"disabled-profile\",\n IssuerId = \"https://auth.example.com\",\n UseJwks = true,\n JwksUri = \"https://auth.example.com/.well-known/jwks.json\",\n Enabled = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewOauthResourceServerConfigProfile(ctx, \"disabled\", \u0026vault.OauthResourceServerConfigProfileArgs{\n\t\t\tProfileName: pulumi.String(\"disabled-profile\"),\n\t\t\tIssuerId: pulumi.String(\"https://auth.example.com\"),\n\t\t\tUseJwks: pulumi.Bool(true),\n\t\t\tJwksUri: pulumi.String(\"https://auth.example.com/.well-known/jwks.json\"),\n\t\t\tEnabled: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_oauthresourceserverconfigprofile\" \"disabled\" {\n profile_name = \"disabled-profile\"\n issuer_id = \"https://auth.example.com\"\n use_jwks = true\n jwks_uri = \"https://auth.example.com/.well-known/jwks.json\"\n enabled = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.OauthResourceServerConfigProfile;\nimport com.pulumi.vault.OauthResourceServerConfigProfileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var disabled = new OauthResourceServerConfigProfile(\"disabled\", OauthResourceServerConfigProfileArgs.builder()\n .profileName(\"disabled-profile\")\n .issuerId(\"https://auth.example.com\")\n .useJwks(true)\n .jwksUri(\"https://auth.example.com/.well-known/jwks.json\")\n .enabled(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n disabled:\n type: vault:OauthResourceServerConfigProfile\n properties:\n profileName: disabled-profile\n issuerId: https://auth.example.com\n useJwks: true\n jwksUri: https://auth.example.com/.well-known/jwks.json\n enabled: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Notes\n\n* **Mutual Exclusivity**: The \u003cspan pulumi-lang-nodejs=\"`useJwks`\" pulumi-lang-dotnet=\"`UseJwks`\" pulumi-lang-go=\"`useJwks`\" pulumi-lang-python=\"`use_jwks`\" pulumi-lang-yaml=\"`useJwks`\" pulumi-lang-java=\"`useJwks`\" pulumi-lang-hcl=\"`use_jwks`\"\u003e`useJwks`\u003c/span\u003e flag determines which configuration mode is active:\n * When `use_jwks=true`: You must provide \u003cspan pulumi-lang-nodejs=\"`jwksUri`\" pulumi-lang-dotnet=\"`JwksUri`\" pulumi-lang-go=\"`jwksUri`\" pulumi-lang-python=\"`jwks_uri`\" pulumi-lang-yaml=\"`jwksUri`\" pulumi-lang-java=\"`jwksUri`\" pulumi-lang-hcl=\"`jwks_uri`\"\u003e`jwksUri`\u003c/span\u003e and cannot provide \u003cspan pulumi-lang-nodejs=\"`publicKeys`\" pulumi-lang-dotnet=\"`PublicKeys`\" pulumi-lang-go=\"`publicKeys`\" pulumi-lang-python=\"`public_keys`\" pulumi-lang-yaml=\"`publicKeys`\" pulumi-lang-java=\"`publicKeys`\" pulumi-lang-hcl=\"`public_keys`\"\u003e`publicKeys`\u003c/span\u003e\n * When `use_jwks=false`: You must provide \u003cspan pulumi-lang-nodejs=\"`publicKeys`\" pulumi-lang-dotnet=\"`PublicKeys`\" pulumi-lang-go=\"`publicKeys`\" pulumi-lang-python=\"`public_keys`\" pulumi-lang-yaml=\"`publicKeys`\" pulumi-lang-java=\"`publicKeys`\" pulumi-lang-hcl=\"`public_keys`\"\u003e`publicKeys`\u003c/span\u003e and cannot provide \u003cspan pulumi-lang-nodejs=\"`jwksUri`\" pulumi-lang-dotnet=\"`JwksUri`\" pulumi-lang-go=\"`jwksUri`\" pulumi-lang-python=\"`jwks_uri`\" pulumi-lang-yaml=\"`jwksUri`\" pulumi-lang-java=\"`jwksUri`\" pulumi-lang-hcl=\"`jwks_uri`\"\u003e`jwksUri`\u003c/span\u003e\n\n* **Issuer Uniqueness**: Each issuer ID must be unique within a namespace. You cannot have multiple profiles with the same issuer ID in the same namespace.\n\n* **Profile Name Immutability**: The \u003cspan pulumi-lang-nodejs=\"`profileName`\" pulumi-lang-dotnet=\"`ProfileName`\" pulumi-lang-go=\"`profileName`\" pulumi-lang-python=\"`profile_name`\" pulumi-lang-yaml=\"`profileName`\" pulumi-lang-java=\"`profileName`\" pulumi-lang-hcl=\"`profile_name`\"\u003e`profileName`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`issuerId`\" pulumi-lang-dotnet=\"`IssuerId`\" pulumi-lang-go=\"`issuerId`\" pulumi-lang-python=\"`issuer_id`\" pulumi-lang-yaml=\"`issuerId`\" pulumi-lang-java=\"`issuerId`\" pulumi-lang-hcl=\"`issuer_id`\"\u003e`issuerId`\u003c/span\u003e cannot be changed after creation. Changing these fields will force a new resource to be created.\n\n* **Key ID Uniqueness**: Within a profile, all key IDs must be unique. This applies to both JWKS keys and static PEM keys.\n\n* **JWKS Caching**: When using JWKS, Vault caches the public keys and refreshes them periodically. Unknown key IDs trigger a rate-limited refresh to prevent DoS attacks.\n\n* **Algorithm Validation**: The JWT's signing algorithm must be in the \u003cspan pulumi-lang-nodejs=\"`supportedAlgorithms`\" pulumi-lang-dotnet=\"`SupportedAlgorithms`\" pulumi-lang-go=\"`supportedAlgorithms`\" pulumi-lang-python=\"`supported_algorithms`\" pulumi-lang-yaml=\"`supportedAlgorithms`\" pulumi-lang-java=\"`supportedAlgorithms`\" pulumi-lang-hcl=\"`supported_algorithms`\"\u003e`supportedAlgorithms`\u003c/span\u003e list. This provides defense against algorithm confusion attacks.\n\n* **Audience Validation**: If \u003cspan pulumi-lang-nodejs=\"`audiences`\" pulumi-lang-dotnet=\"`Audiences`\" pulumi-lang-go=\"`audiences`\" pulumi-lang-python=\"`audiences`\" pulumi-lang-yaml=\"`audiences`\" pulumi-lang-java=\"`audiences`\" pulumi-lang-hcl=\"`audiences`\"\u003e`audiences`\u003c/span\u003e is specified, the JWT must contain at least one matching audience in its \u003cspan pulumi-lang-nodejs=\"`aud`\" pulumi-lang-dotnet=\"`Aud`\" pulumi-lang-go=\"`aud`\" pulumi-lang-python=\"`aud`\" pulumi-lang-yaml=\"`aud`\" pulumi-lang-java=\"`aud`\" pulumi-lang-hcl=\"`aud`\"\u003e`aud`\u003c/span\u003e claim. If not specified, audience validation is skipped.\n\n* **Clock Skew**: Use \u003cspan pulumi-lang-nodejs=\"`clockSkewLeeway`\" pulumi-lang-dotnet=\"`ClockSkewLeeway`\" pulumi-lang-go=\"`clockSkewLeeway`\" pulumi-lang-python=\"`clock_skew_leeway`\" pulumi-lang-yaml=\"`clockSkewLeeway`\" pulumi-lang-java=\"`clockSkewLeeway`\" pulumi-lang-hcl=\"`clock_skew_leeway`\"\u003e`clockSkewLeeway`\u003c/span\u003e to handle clock differences between systems. A value of 30-60 seconds is typically sufficient for most environments.\n\n* **Enterprise Feature**: OAuth Resource Server Configuration is only available in Vault Enterprise. Attempting to use this resource with Vault Community Edition will result in an error.\n\n* **Version Requirement**: This resource requires Vault 2.0.1 or later.\n\n## Security Considerations\n\n* **HTTPS for JWKS**: Always use HTTPS for \u003cspan pulumi-lang-nodejs=\"`jwksUri`\" pulumi-lang-dotnet=\"`JwksUri`\" pulumi-lang-go=\"`jwksUri`\" pulumi-lang-python=\"`jwks_uri`\" pulumi-lang-yaml=\"`jwksUri`\" pulumi-lang-java=\"`jwksUri`\" pulumi-lang-hcl=\"`jwks_uri`\"\u003e`jwksUri`\u003c/span\u003e to prevent man-in-the-middle attacks.\n\n* **CA Certificate Validation**: When using custom CA certificates, ensure they are properly validated and from trusted sources.\n\n* **Key Rotation**: When rotating keys, ensure the new keys are published to the JWKS endpoint before revoking old keys to prevent authentication failures.\n\n* **Disabled Profiles**: Disabled profiles are completely ignored during JWT validation. Use this feature carefully in production environments.\n\n* **Algorithm Selection**: Limit \u003cspan pulumi-lang-nodejs=\"`supportedAlgorithms`\" pulumi-lang-dotnet=\"`SupportedAlgorithms`\" pulumi-lang-go=\"`supportedAlgorithms`\" pulumi-lang-python=\"`supported_algorithms`\" pulumi-lang-yaml=\"`supportedAlgorithms`\" pulumi-lang-java=\"`supportedAlgorithms`\" pulumi-lang-hcl=\"`supported_algorithms`\"\u003e`supportedAlgorithms`\u003c/span\u003e to only those algorithms your authorization server uses. This reduces the attack surface.\n\n## Import\n\nYou can import OAuth Resource Server Configuration profiles using their \u003cspan pulumi-lang-nodejs=\"`profileName`\" pulumi-lang-dotnet=\"`ProfileName`\" pulumi-lang-go=\"`profileName`\" pulumi-lang-python=\"`profile_name`\" pulumi-lang-yaml=\"`profileName`\" pulumi-lang-java=\"`profileName`\" pulumi-lang-hcl=\"`profile_name`\"\u003e`profileName`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/oauthResourceServerConfigProfile:OauthResourceServerConfigProfile example my-oauth-profile\n```\n\nThe import string does not encode the namespace. To import a profile from a\nnamespace, set the `TERRAFORM_VAULT_NAMESPACE_IMPORT` environment variable:\n\n```sh\n$ TERRAFORM_VAULT_NAMESPACE_IMPORT=application terraform import vault_oauth_resource_server_config_profile.example my-oauth-profile\n```\n\n", "properties": { "audiences": { "type": "array", "items": { "type": "string" }, "description": "List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.\n" }, "clockSkewLeeway": { "type": "integer", "description": "Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e. Use this to account for clock differences between systems.\n" }, "enabled": { "type": "boolean", "description": "Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "issuerId": { "type": "string", "description": "The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.\n" }, "jwksCaPem": { "type": "string", "description": "CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.\n" }, "jwksUri": { "type": "string", "description": "The JWKS URI to fetch public keys from. Required when `use_jwks=true`. This should be the URL where the authorization server publishes its public keys in JWKS format.\n" }, "jwtType": { "type": "string", "description": "The JWT type: \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`transactionToken`\" pulumi-lang-dotnet=\"`TransactionToken`\" pulumi-lang-go=\"`transactionToken`\" pulumi-lang-python=\"`transaction_token`\" pulumi-lang-yaml=\"`transactionToken`\" pulumi-lang-java=\"`transactionToken`\" pulumi-lang-hcl=\"`transaction_token`\"\u003e`transactionToken`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "noDefaultPolicy": { "type": "boolean", "description": "If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "optionalAuthorizationDetails": { "type": "boolean", "description": "When \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, RAR (Rich Authorization Requests) is mandatory and\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003emust be present in the token. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e,\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003ein the JWT token are optional. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 2.0.3 or later.\n" }, "profileName": { "type": "string", "description": "The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.\n" }, "publicKeys": { "type": "array", "items": { "$ref": "#/types/vault:index/OauthResourceServerConfigProfilePublicKey:OauthResourceServerConfigProfilePublicKey" }, "description": "List of static public keys with \u003cspan pulumi-lang-nodejs=\"`keyId`\" pulumi-lang-dotnet=\"`KeyId`\" pulumi-lang-go=\"`keyId`\" pulumi-lang-python=\"`key_id`\" pulumi-lang-yaml=\"`keyId`\" pulumi-lang-java=\"`keyId`\" pulumi-lang-hcl=\"`key_id`\"\u003e`keyId`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`pem`\" pulumi-lang-dotnet=\"`Pem`\" pulumi-lang-go=\"`pem`\" pulumi-lang-python=\"`pem`\" pulumi-lang-yaml=\"`pem`\" pulumi-lang-java=\"`pem`\" pulumi-lang-hcl=\"`pem`\"\u003e`pem`\u003c/span\u003e fields. Required when `use_jwks=false`. Each public key must have:\n" }, "supportedAlgorithms": { "type": "array", "items": { "type": "string" }, "description": "List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: `[\"RS256\", \"RS384\", \"RS512\", \"ES256\", \"ES384\", \"ES512\", \"PS256\", \"PS384\", \"PS512\"]`. Valid values are:\n* `RS256`, `RS384`, `RS512` - RSA with SHA-256/384/512\n* `ES256`, `ES384`, `ES512` - ECDSA with SHA-256/384/512\n* `PS256`, `PS384`, `PS512` - RSA-PSS with SHA-256/384/512\n" }, "useJwks": { "type": "boolean", "description": "If true, use JWKS URI for key validation; if false, use static public keys. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. When set to true, \u003cspan pulumi-lang-nodejs=\"`jwksUri`\" pulumi-lang-dotnet=\"`JwksUri`\" pulumi-lang-go=\"`jwksUri`\" pulumi-lang-python=\"`jwks_uri`\" pulumi-lang-yaml=\"`jwksUri`\" pulumi-lang-java=\"`jwksUri`\" pulumi-lang-hcl=\"`jwks_uri`\"\u003e`jwksUri`\u003c/span\u003e is required. When set to false, \u003cspan pulumi-lang-nodejs=\"`publicKeys`\" pulumi-lang-dotnet=\"`PublicKeys`\" pulumi-lang-go=\"`publicKeys`\" pulumi-lang-python=\"`public_keys`\" pulumi-lang-yaml=\"`publicKeys`\" pulumi-lang-java=\"`publicKeys`\" pulumi-lang-hcl=\"`public_keys`\"\u003e`publicKeys`\u003c/span\u003e is required.\n" }, "userClaim": { "type": "string", "description": "The claim to use as the user identifier. Defaults to \u003cspan pulumi-lang-nodejs=\"`sub`\" pulumi-lang-dotnet=\"`Sub`\" pulumi-lang-go=\"`sub`\" pulumi-lang-python=\"`sub`\" pulumi-lang-yaml=\"`sub`\" pulumi-lang-java=\"`sub`\" pulumi-lang-hcl=\"`sub`\"\u003e`sub`\u003c/span\u003e. This determines which JWT claim is used to identify the user.\n" } }, "required": [ "clockSkewLeeway", "enabled", "issuerId", "jwtType", "noDefaultPolicy", "optionalAuthorizationDetails", "profileName", "supportedAlgorithms", "useJwks", "userClaim" ], "inputProperties": { "audiences": { "type": "array", "items": { "type": "string" }, "description": "List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.\n" }, "clockSkewLeeway": { "type": "integer", "description": "Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e. Use this to account for clock differences between systems.\n" }, "enabled": { "type": "boolean", "description": "Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "issuerId": { "type": "string", "description": "The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.\n" }, "jwksCaPem": { "type": "string", "description": "CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.\n" }, "jwksUri": { "type": "string", "description": "The JWKS URI to fetch public keys from. Required when `use_jwks=true`. This should be the URL where the authorization server publishes its public keys in JWKS format.\n" }, "jwtType": { "type": "string", "description": "The JWT type: \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`transactionToken`\" pulumi-lang-dotnet=\"`TransactionToken`\" pulumi-lang-go=\"`transactionToken`\" pulumi-lang-python=\"`transaction_token`\" pulumi-lang-yaml=\"`transactionToken`\" pulumi-lang-java=\"`transactionToken`\" pulumi-lang-hcl=\"`transaction_token`\"\u003e`transactionToken`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "noDefaultPolicy": { "type": "boolean", "description": "If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "optionalAuthorizationDetails": { "type": "boolean", "description": "When \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, RAR (Rich Authorization Requests) is mandatory and\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003emust be present in the token. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e,\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003ein the JWT token are optional. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 2.0.3 or later.\n" }, "profileName": { "type": "string", "description": "The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.\n" }, "publicKeys": { "type": "array", "items": { "$ref": "#/types/vault:index/OauthResourceServerConfigProfilePublicKey:OauthResourceServerConfigProfilePublicKey" }, "description": "List of static public keys with \u003cspan pulumi-lang-nodejs=\"`keyId`\" pulumi-lang-dotnet=\"`KeyId`\" pulumi-lang-go=\"`keyId`\" pulumi-lang-python=\"`key_id`\" pulumi-lang-yaml=\"`keyId`\" pulumi-lang-java=\"`keyId`\" pulumi-lang-hcl=\"`key_id`\"\u003e`keyId`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`pem`\" pulumi-lang-dotnet=\"`Pem`\" pulumi-lang-go=\"`pem`\" pulumi-lang-python=\"`pem`\" pulumi-lang-yaml=\"`pem`\" pulumi-lang-java=\"`pem`\" pulumi-lang-hcl=\"`pem`\"\u003e`pem`\u003c/span\u003e fields. Required when `use_jwks=false`. Each public key must have:\n" }, "supportedAlgorithms": { "type": "array", "items": { "type": "string" }, "description": "List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: `[\"RS256\", \"RS384\", \"RS512\", \"ES256\", \"ES384\", \"ES512\", \"PS256\", \"PS384\", \"PS512\"]`. Valid values are:\n* `RS256`, `RS384`, `RS512` - RSA with SHA-256/384/512\n* `ES256`, `ES384`, `ES512` - ECDSA with SHA-256/384/512\n* `PS256`, `PS384`, `PS512` - RSA-PSS with SHA-256/384/512\n" }, "useJwks": { "type": "boolean", "description": "If true, use JWKS URI for key validation; if false, use static public keys. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. When set to true, \u003cspan pulumi-lang-nodejs=\"`jwksUri`\" pulumi-lang-dotnet=\"`JwksUri`\" pulumi-lang-go=\"`jwksUri`\" pulumi-lang-python=\"`jwks_uri`\" pulumi-lang-yaml=\"`jwksUri`\" pulumi-lang-java=\"`jwksUri`\" pulumi-lang-hcl=\"`jwks_uri`\"\u003e`jwksUri`\u003c/span\u003e is required. When set to false, \u003cspan pulumi-lang-nodejs=\"`publicKeys`\" pulumi-lang-dotnet=\"`PublicKeys`\" pulumi-lang-go=\"`publicKeys`\" pulumi-lang-python=\"`public_keys`\" pulumi-lang-yaml=\"`publicKeys`\" pulumi-lang-java=\"`publicKeys`\" pulumi-lang-hcl=\"`public_keys`\"\u003e`publicKeys`\u003c/span\u003e is required.\n" }, "userClaim": { "type": "string", "description": "The claim to use as the user identifier. Defaults to \u003cspan pulumi-lang-nodejs=\"`sub`\" pulumi-lang-dotnet=\"`Sub`\" pulumi-lang-go=\"`sub`\" pulumi-lang-python=\"`sub`\" pulumi-lang-yaml=\"`sub`\" pulumi-lang-java=\"`sub`\" pulumi-lang-hcl=\"`sub`\"\u003e`sub`\u003c/span\u003e. This determines which JWT claim is used to identify the user.\n" } }, "requiredInputs": [ "issuerId", "profileName" ], "stateInputs": { "description": "Input properties used for looking up and filtering OauthResourceServerConfigProfile resources.\n", "properties": { "audiences": { "type": "array", "items": { "type": "string" }, "description": "List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.\n" }, "clockSkewLeeway": { "type": "integer", "description": "Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e. Use this to account for clock differences between systems.\n" }, "enabled": { "type": "boolean", "description": "Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" }, "issuerId": { "type": "string", "description": "The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.\n" }, "jwksCaPem": { "type": "string", "description": "CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.\n" }, "jwksUri": { "type": "string", "description": "The JWKS URI to fetch public keys from. Required when `use_jwks=true`. This should be the URL where the authorization server publishes its public keys in JWKS format.\n" }, "jwtType": { "type": "string", "description": "The JWT type: \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`transactionToken`\" pulumi-lang-dotnet=\"`TransactionToken`\" pulumi-lang-go=\"`transactionToken`\" pulumi-lang-python=\"`transaction_token`\" pulumi-lang-yaml=\"`transactionToken`\" pulumi-lang-java=\"`transactionToken`\" pulumi-lang-hcl=\"`transaction_token`\"\u003e`transactionToken`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`accessToken`\" pulumi-lang-dotnet=\"`AccessToken`\" pulumi-lang-go=\"`accessToken`\" pulumi-lang-python=\"`access_token`\" pulumi-lang-yaml=\"`accessToken`\" pulumi-lang-java=\"`accessToken`\" pulumi-lang-hcl=\"`access_token`\"\u003e`accessToken`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "noDefaultPolicy": { "type": "boolean", "description": "If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "optionalAuthorizationDetails": { "type": "boolean", "description": "When \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, RAR (Rich Authorization Requests) is mandatory and\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003emust be present in the token. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e,\u003cspan pulumi-lang-nodejs=\" authorizationDetails \" pulumi-lang-dotnet=\" AuthorizationDetails \" pulumi-lang-go=\" authorizationDetails \" pulumi-lang-python=\" authorization_details \" pulumi-lang-yaml=\" authorizationDetails \" pulumi-lang-java=\" authorizationDetails \" pulumi-lang-hcl=\" authorization_details \"\u003e authorizationDetails \u003c/span\u003ein the JWT token are optional. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 2.0.3 or later.\n" }, "profileName": { "type": "string", "description": "The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.\n" }, "publicKeys": { "type": "array", "items": { "$ref": "#/types/vault:index/OauthResourceServerConfigProfilePublicKey:OauthResourceServerConfigProfilePublicKey" }, "description": "List of static public keys with \u003cspan pulumi-lang-nodejs=\"`keyId`\" pulumi-lang-dotnet=\"`KeyId`\" pulumi-lang-go=\"`keyId`\" pulumi-lang-python=\"`key_id`\" pulumi-lang-yaml=\"`keyId`\" pulumi-lang-java=\"`keyId`\" pulumi-lang-hcl=\"`key_id`\"\u003e`keyId`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`pem`\" pulumi-lang-dotnet=\"`Pem`\" pulumi-lang-go=\"`pem`\" pulumi-lang-python=\"`pem`\" pulumi-lang-yaml=\"`pem`\" pulumi-lang-java=\"`pem`\" pulumi-lang-hcl=\"`pem`\"\u003e`pem`\u003c/span\u003e fields. Required when `use_jwks=false`. Each public key must have:\n" }, "supportedAlgorithms": { "type": "array", "items": { "type": "string" }, "description": "List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: `[\"RS256\", \"RS384\", \"RS512\", \"ES256\", \"ES384\", \"ES512\", \"PS256\", \"PS384\", \"PS512\"]`. Valid values are:\n* `RS256`, `RS384`, `RS512` - RSA with SHA-256/384/512\n* `ES256`, `ES384`, `ES512` - ECDSA with SHA-256/384/512\n* `PS256`, `PS384`, `PS512` - RSA-PSS with SHA-256/384/512\n" }, "useJwks": { "type": "boolean", "description": "If true, use JWKS URI for key validation; if false, use static public keys. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. When set to true, \u003cspan pulumi-lang-nodejs=\"`jwksUri`\" pulumi-lang-dotnet=\"`JwksUri`\" pulumi-lang-go=\"`jwksUri`\" pulumi-lang-python=\"`jwks_uri`\" pulumi-lang-yaml=\"`jwksUri`\" pulumi-lang-java=\"`jwksUri`\" pulumi-lang-hcl=\"`jwks_uri`\"\u003e`jwksUri`\u003c/span\u003e is required. When set to false, \u003cspan pulumi-lang-nodejs=\"`publicKeys`\" pulumi-lang-dotnet=\"`PublicKeys`\" pulumi-lang-go=\"`publicKeys`\" pulumi-lang-python=\"`public_keys`\" pulumi-lang-yaml=\"`publicKeys`\" pulumi-lang-java=\"`publicKeys`\" pulumi-lang-hcl=\"`public_keys`\"\u003e`publicKeys`\u003c/span\u003e is required.\n" }, "userClaim": { "type": "string", "description": "The claim to use as the user identifier. Defaults to \u003cspan pulumi-lang-nodejs=\"`sub`\" pulumi-lang-dotnet=\"`Sub`\" pulumi-lang-go=\"`sub`\" pulumi-lang-python=\"`sub`\" pulumi-lang-yaml=\"`sub`\" pulumi-lang-java=\"`sub`\" pulumi-lang-hcl=\"`sub`\"\u003e`sub`\u003c/span\u003e. This determines which JWT claim is used to identify the user.\n" } }, "type": "object" } }, "vault:index/ociAuthBackend:OciAuthBackend": { "description": "Configures the OCI (Oracle Cloud Infrastructure) Auth Backend in Vault.\n\nThis resource sets the home tenancy id that Vault will use when making\nAPI requests on behalf of an OCI Auth Backend.\n\nFor more information, see the\n[Vault docs](https://developer.hashicorp.com/vault/api-docs/auth/oci#configure-home-tenancy-method).\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.OciAuthBackend(\"example\", {\n path: exampleVaultAuthBackend.path,\n homeTenancyId: \"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.OciAuthBackend(\"example\",\n path=example_vault_auth_backend[\"path\"],\n home_tenancy_id=\"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.OciAuthBackend(\"example\", new()\n {\n Path = exampleVaultAuthBackend.Path,\n HomeTenancyId = \"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewOciAuthBackend(ctx, \"example\", \u0026vault.OciAuthBackendArgs{\n\t\t\tPath: pulumi.Any(exampleVaultAuthBackend.Path),\n\t\t\tHomeTenancyId: pulumi.String(\"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ociauthbackend\" \"example\" {\n path = exampleVaultAuthBackend.path\n home_tenancy_id = \"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.OciAuthBackend;\nimport com.pulumi.vault.OciAuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new OciAuthBackend(\"example\", OciAuthBackendArgs.builder()\n .path(exampleVaultAuthBackend.path())\n .homeTenancyId(\"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:OciAuthBackend\n properties:\n path: ${exampleVaultAuthBackend.path}\n homeTenancyId: ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nOCI auth backends can be imported using the backend's \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/ociAuthBackend:OciAuthBackend example oci\n```\n\n", "properties": { "accessor": { "type": "string", "description": "The accessor of the auth backend" }, "description": { "type": "string", "description": "A description of the auth backend.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Stops rotation of the root credential until set to false." }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates." }, "homeTenancyId": { "type": "string", "description": "The Tenancy OCID of your OCI account.\n", "secret": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Unique name of the auth backend to configure." }, "rotationPeriod": { "type": "integer", "description": "The period of time in seconds between each rotation of the root credential. Cannot be used with rotation_schedule." }, "rotationSchedule": { "type": "string", "description": "The cron-style schedule for the root credential to be rotated on. Cannot be used with rotation_period." }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds Vault is allowed to complete a rotation once a scheduled rotation is triggered. Can only be used with rotation_schedule." }, "tune": { "$ref": "#/types/vault:index/OciAuthBackendTune:OciAuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" } }, "required": [ "accessor", "homeTenancyId", "tune" ], "inputProperties": { "description": { "type": "string", "description": "A description of the auth backend.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Stops rotation of the root credential until set to false." }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates." }, "homeTenancyId": { "type": "string", "description": "The Tenancy OCID of your OCI account.\n", "secret": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Unique name of the auth backend to configure." }, "rotationPeriod": { "type": "integer", "description": "The period of time in seconds between each rotation of the root credential. Cannot be used with rotation_schedule." }, "rotationSchedule": { "type": "string", "description": "The cron-style schedule for the root credential to be rotated on. Cannot be used with rotation_period." }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds Vault is allowed to complete a rotation once a scheduled rotation is triggered. Can only be used with rotation_schedule." }, "tune": { "$ref": "#/types/vault:index/OciAuthBackendTune:OciAuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" } }, "requiredInputs": [ "homeTenancyId" ], "stateInputs": { "description": "Input properties used for looking up and filtering OciAuthBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "The accessor of the auth backend" }, "description": { "type": "string", "description": "A description of the auth backend.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Stops rotation of the root credential until set to false." }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates." }, "homeTenancyId": { "type": "string", "description": "The Tenancy OCID of your OCI account.\n", "secret": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Unique name of the auth backend to configure." }, "rotationPeriod": { "type": "integer", "description": "The period of time in seconds between each rotation of the root credential. Cannot be used with rotation_schedule." }, "rotationSchedule": { "type": "string", "description": "The cron-style schedule for the root credential to be rotated on. Cannot be used with rotation_period." }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds Vault is allowed to complete a rotation once a scheduled rotation is triggered. Can only be used with rotation_schedule." }, "tune": { "$ref": "#/types/vault:index/OciAuthBackendTune:OciAuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" } }, "type": "object" } }, "vault:index/ociAuthBackendRole:OciAuthBackendRole": { "description": "Manages an OCI (Oracle Cloud Infrastructure) auth backend role in a \nVault server. Roles constrain the instances or principals that can\nperform the login operation against the backend. See the [Vault\ndocumentation](https://developer.hashicorp.com/vault/docs/auth/oci) for\nmore information.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst oci = new vault.OciAuthBackend(\"oci\", {\n path: \"oci\",\n homeTenancyId: \"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\",\n});\nconst example = new vault.OciAuthBackendRole(\"example\", {\n backend: oci.path,\n name: \"test-role\",\n ocidLists: [\n \"ocid1.group.oc1..aaaaaaaabmyiinfq32y5aha3r2yo4exampleo4yg3fjk2sbne4567tropaa\",\n \"ocid1.dynamicgroup.oc1..aaaaaaaabvfwct33xri5examplegov4zyjp3rd5d7sk9jjdggxijhco56hrq\",\n ],\n tokenTtl: 60,\n tokenMaxTtl: 120,\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\noci = vault.OciAuthBackend(\"oci\",\n path=\"oci\",\n home_tenancy_id=\"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\")\nexample = vault.OciAuthBackendRole(\"example\",\n backend=oci.path,\n name=\"test-role\",\n ocid_lists=[\n \"ocid1.group.oc1..aaaaaaaabmyiinfq32y5aha3r2yo4exampleo4yg3fjk2sbne4567tropaa\",\n \"ocid1.dynamicgroup.oc1..aaaaaaaabvfwct33xri5examplegov4zyjp3rd5d7sk9jjdggxijhco56hrq\",\n ],\n token_ttl=60,\n token_max_ttl=120,\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var oci = new Vault.OciAuthBackend(\"oci\", new()\n {\n Path = \"oci\",\n HomeTenancyId = \"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\",\n });\n\n var example = new Vault.OciAuthBackendRole(\"example\", new()\n {\n Backend = oci.Path,\n Name = \"test-role\",\n OcidLists = new[]\n {\n \"ocid1.group.oc1..aaaaaaaabmyiinfq32y5aha3r2yo4exampleo4yg3fjk2sbne4567tropaa\",\n \"ocid1.dynamicgroup.oc1..aaaaaaaabvfwct33xri5examplegov4zyjp3rd5d7sk9jjdggxijhco56hrq\",\n },\n TokenTtl = 60,\n TokenMaxTtl = 120,\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\toci, err := vault.NewOciAuthBackend(ctx, \"oci\", \u0026vault.OciAuthBackendArgs{\n\t\t\tPath: pulumi.String(\"oci\"),\n\t\t\tHomeTenancyId: pulumi.String(\"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewOciAuthBackendRole(ctx, \"example\", \u0026vault.OciAuthBackendRoleArgs{\n\t\t\tBackend: oci.Path,\n\t\t\tName: pulumi.String(\"test-role\"),\n\t\t\tOcidLists: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"ocid1.group.oc1..aaaaaaaabmyiinfq32y5aha3r2yo4exampleo4yg3fjk2sbne4567tropaa\"),\n\t\t\t\tpulumi.String(\"ocid1.dynamicgroup.oc1..aaaaaaaabvfwct33xri5examplegov4zyjp3rd5d7sk9jjdggxijhco56hrq\"),\n\t\t\t},\n\t\t\tTokenTtl: pulumi.Int(60),\n\t\t\tTokenMaxTtl: pulumi.Int(120),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ociauthbackend\" \"oci\" {\n path = \"oci\"\n home_tenancy_id = \"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\"\n}\nresource \"vault_ociauthbackendrole\" \"example\" {\n backend = vault_ociauthbackend.oci.path\n name = \"test-role\"\n ocid_lists = [\"ocid1.group.oc1..aaaaaaaabmyiinfq32y5aha3r2yo4exampleo4yg3fjk2sbne4567tropaa\", \"ocid1.dynamicgroup.oc1..aaaaaaaabvfwct33xri5examplegov4zyjp3rd5d7sk9jjdggxijhco56hrq\"]\n token_ttl = 60\n token_max_ttl = 120\n token_policies = [\"default\", \"dev\", \"prod\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.OciAuthBackend;\nimport com.pulumi.vault.OciAuthBackendArgs;\nimport com.pulumi.vault.OciAuthBackendRole;\nimport com.pulumi.vault.OciAuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var oci = new OciAuthBackend(\"oci\", OciAuthBackendArgs.builder()\n .path(\"oci\")\n .homeTenancyId(\"ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\")\n .build());\n\n var example = new OciAuthBackendRole(\"example\", OciAuthBackendRoleArgs.builder()\n .backend(oci.path())\n .name(\"test-role\")\n .ocidLists( \n \"ocid1.group.oc1..aaaaaaaabmyiinfq32y5aha3r2yo4exampleo4yg3fjk2sbne4567tropaa\",\n \"ocid1.dynamicgroup.oc1..aaaaaaaabvfwct33xri5examplegov4zyjp3rd5d7sk9jjdggxijhco56hrq\")\n .tokenTtl(60)\n .tokenMaxTtl(120)\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n oci:\n type: vault:OciAuthBackend\n properties:\n path: oci\n homeTenancyId: ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq\n example:\n type: vault:OciAuthBackendRole\n properties:\n backend: ${oci.path}\n name: test-role\n ocidLists:\n - ocid1.group.oc1..aaaaaaaabmyiinfq32y5aha3r2yo4exampleo4yg3fjk2sbne4567tropaa\n - ocid1.dynamicgroup.oc1..aaaaaaaabvfwct33xri5examplegov4zyjp3rd5d7sk9jjdggxijhco56hrq\n tokenTtl: 60\n tokenMaxTtl: 120\n tokenPolicies:\n - default\n - dev\n - prod\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nOCI auth backend roles can be imported using `auth/`, the \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e path, `/role/`, and the \u003cspan pulumi-lang-nodejs=\"`role`\" pulumi-lang-dotnet=\"`Role`\" pulumi-lang-go=\"`role`\" pulumi-lang-python=\"`role`\" pulumi-lang-yaml=\"`role`\" pulumi-lang-java=\"`role`\" pulumi-lang-hcl=\"`role`\"\u003e`role`\u003c/span\u003e name e.g.\n\n```sh\n$ pulumi import vault:index/ociAuthBackendRole:OciAuthBackendRole example auth/oci/role/test-role\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "backend": { "type": "string", "description": "Unique name of the auth backend to configure." }, "name": { "type": "string", "description": "The name of the role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n" }, "ocidLists": { "type": "array", "items": { "type": "string" }, "description": "The list of Group or Dynamic Group OCIDs that can take this role.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "name" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "backend": { "type": "string", "description": "Unique name of the auth backend to configure.", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocidLists": { "type": "array", "items": { "type": "string" }, "description": "The list of Group or Dynamic Group OCIDs that can take this role.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "stateInputs": { "description": "Input properties used for looking up and filtering OciAuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "backend": { "type": "string", "description": "Unique name of the auth backend to configure.", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocidLists": { "type": "array", "items": { "type": "string" }, "description": "The list of Group or Dynamic Group OCIDs that can take this role.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:index/passwordPolicy:PasswordPolicy": { "description": "Provides a resource to manage Password Policies \n\n**Note** this feature is available only Vault 1.5+ \n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst alphanumeric = new vault.PasswordPolicy(\"alphanumeric\", {\n name: \"alphanumeric\",\n policy: ` length = 20\n rule \\\\\"charset\\\\\" {\n charset = \\\\\"abcdefghijklmnopqrstuvwxyz0123456789\\\\\"\n }\n`,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nalphanumeric = vault.PasswordPolicy(\"alphanumeric\",\n name=\"alphanumeric\",\n policy=\"\"\" length = 20\n rule \\\"charset\\\" {\n charset = \\\"abcdefghijklmnopqrstuvwxyz0123456789\\\"\n }\n\"\"\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var alphanumeric = new Vault.PasswordPolicy(\"alphanumeric\", new()\n {\n Name = \"alphanumeric\",\n Policy = @\" length = 20\n rule \\\"\"charset\\\"\" {\n charset = \\\"\"abcdefghijklmnopqrstuvwxyz0123456789\\\"\"\n }\n\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewPasswordPolicy(ctx, \"alphanumeric\", \u0026vault.PasswordPolicyArgs{\n\t\t\tName: pulumi.String(\"alphanumeric\"),\n\t\t\tPolicy: pulumi.String(\" length = 20\\n rule \\\\\\\"charset\\\\\\\" {\\n charset = \\\\\\\"abcdefghijklmnopqrstuvwxyz0123456789\\\\\\\"\\n }\\n\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_passwordpolicy\" \"alphanumeric\" {\n name = \"alphanumeric\"\n policy = \" length = 20\\n rule \\\\\\\"charset\\\\\\\" {\\n charset = \\\\\\\"abcdefghijklmnopqrstuvwxyz0123456789\\\\\\\"\\n }\\n\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.PasswordPolicy;\nimport com.pulumi.vault.PasswordPolicyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var alphanumeric = new PasswordPolicy(\"alphanumeric\", PasswordPolicyArgs.builder()\n .name(\"alphanumeric\")\n .policy(\"\"\"\n length = 20\n rule \\\"charset\\\" {\n charset = \\\"abcdefghijklmnopqrstuvwxyz0123456789\\\"\n }\n \"\"\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n alphanumeric:\n type: vault:PasswordPolicy\n properties:\n name: alphanumeric\n policy: |2\n length = 20\n rule \\\"charset\\\" {\n charset = \\\"abcdefghijklmnopqrstuvwxyz0123456789\\\"\n }\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPassword policies can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/passwordPolicy:PasswordPolicy alphanumeric alphanumeric\n```\n\n", "properties": { "entropySource": { "type": "string", "description": "Specifies an override to the default source of entropy (randomness) used to generate the passwords. Must be one of: `\"\"`, `\"platform\"`, or `\"seal\"` (Vault Enterprise only). Requires Vault 1.21+.\n" }, "name": { "type": "string", "description": "The name of the password policy.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policy": { "type": "string", "description": "String containing a password policy.\n" } }, "required": [ "name", "policy" ], "inputProperties": { "entropySource": { "type": "string", "description": "Specifies an override to the default source of entropy (randomness) used to generate the passwords. Must be one of: `\"\"`, `\"platform\"`, or `\"seal\"` (Vault Enterprise only). Requires Vault 1.21+.\n" }, "name": { "type": "string", "description": "The name of the password policy.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policy": { "type": "string", "description": "String containing a password policy.\n" } }, "requiredInputs": [ "policy" ], "stateInputs": { "description": "Input properties used for looking up and filtering PasswordPolicy resources.\n", "properties": { "entropySource": { "type": "string", "description": "Specifies an override to the default source of entropy (randomness) used to generate the passwords. Must be one of: `\"\"`, `\"platform\"`, or `\"seal\"` (Vault Enterprise only). Requires Vault 1.21+.\n" }, "name": { "type": "string", "description": "The name of the password policy.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policy": { "type": "string", "description": "String containing a password policy.\n" } }, "type": "object" } }, "vault:index/plugin:Plugin": { "description": "Manages external plugins registered in the plugin catalog.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\nFor more information on managing external plugins, please refer to the Vault\n[documentation](https://developer.hashicorp.com/vault/docs/plugins).\n\n## Example Usage\n\n### Register an Official Enterprise plugin (version vX.Y.Z+ent)\n\nThe \u003cspan pulumi-lang-nodejs=\"`version`\" pulumi-lang-dotnet=\"`Version`\" pulumi-lang-go=\"`version`\" pulumi-lang-python=\"`version`\" pulumi-lang-yaml=\"`version`\" pulumi-lang-java=\"`version`\" pulumi-lang-hcl=\"`version`\"\u003e`version`\u003c/span\u003e is required for enterprise plugins.\nThe \u003cspan pulumi-lang-nodejs=\"`sha256`\" pulumi-lang-dotnet=\"`Sha256`\" pulumi-lang-go=\"`sha256`\" pulumi-lang-python=\"`sha256`\" pulumi-lang-yaml=\"`sha256`\" pulumi-lang-java=\"`sha256`\" pulumi-lang-hcl=\"`sha256`\"\u003e`sha256`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`command`\" pulumi-lang-dotnet=\"`Command`\" pulumi-lang-go=\"`command`\" pulumi-lang-python=\"`command`\" pulumi-lang-yaml=\"`command`\" pulumi-lang-java=\"`command`\" pulumi-lang-hcl=\"`command`\"\u003e`command`\u003c/span\u003e shoud not be set for an enterprise plugin.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst oracle = new vault.Plugin(\"oracle\", {\n type: \"database\",\n name: \"vault-plugin-database-oracle\",\n version: \"v0.13.0+ent\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\noracle = vault.Plugin(\"oracle\",\n type=\"database\",\n name=\"vault-plugin-database-oracle\",\n version=\"v0.13.0+ent\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var oracle = new Vault.Plugin(\"oracle\", new()\n {\n Type = \"database\",\n Name = \"vault-plugin-database-oracle\",\n Version = \"v0.13.0+ent\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewPlugin(ctx, \"oracle\", \u0026vault.PluginArgs{\n\t\t\tType: pulumi.String(\"database\"),\n\t\t\tName: pulumi.String(\"vault-plugin-database-oracle\"),\n\t\t\tVersion: pulumi.String(\"v0.13.0+ent\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_plugin\" \"oracle\" {\n type = \"database\"\n name = \"vault-plugin-database-oracle\"\n version = \"v0.13.0+ent\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Plugin;\nimport com.pulumi.vault.PluginArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var oracle = new Plugin(\"oracle\", PluginArgs.builder()\n .type(\"database\")\n .name(\"vault-plugin-database-oracle\")\n .version(\"v0.13.0+ent\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n oracle:\n type: vault:Plugin\n properties:\n type: database\n name: vault-plugin-database-oracle\n version: v0.13.0+ent\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Register a CE plugin (version vX.Y.Z)\n\nThe \u003cspan pulumi-lang-nodejs=\"`sha256`\" pulumi-lang-dotnet=\"`Sha256`\" pulumi-lang-go=\"`sha256`\" pulumi-lang-python=\"`sha256`\" pulumi-lang-yaml=\"`sha256`\" pulumi-lang-java=\"`sha256`\" pulumi-lang-hcl=\"`sha256`\"\u003e`sha256`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`command`\" pulumi-lang-dotnet=\"`Command`\" pulumi-lang-go=\"`command`\" pulumi-lang-python=\"`command`\" pulumi-lang-yaml=\"`command`\" pulumi-lang-java=\"`command`\" pulumi-lang-hcl=\"`command`\"\u003e`command`\u003c/span\u003e are required to register a CE plugin.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst jwt = new vault.Plugin(\"jwt\", {\n type: \"auth\",\n name: \"jwt\",\n command: \"vault-plugin-auth-jwt\",\n version: \"v0.17.0\",\n sha256: \"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\",\n envs: [\"HTTP_PROXY=http://proxy.example.com:8080\"],\n});\nconst jwtAuth = new vault.AuthBackend(\"jwt_auth\", {type: jwt.name});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\njwt = vault.Plugin(\"jwt\",\n type=\"auth\",\n name=\"jwt\",\n command=\"vault-plugin-auth-jwt\",\n version=\"v0.17.0\",\n sha256=\"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\",\n envs=[\"HTTP_PROXY=http://proxy.example.com:8080\"])\njwt_auth = vault.AuthBackend(\"jwt_auth\", type=jwt.name)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var jwt = new Vault.Plugin(\"jwt\", new()\n {\n Type = \"auth\",\n Name = \"jwt\",\n Command = \"vault-plugin-auth-jwt\",\n Version = \"v0.17.0\",\n Sha256 = \"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\",\n Envs = new[]\n {\n \"HTTP_PROXY=http://proxy.example.com:8080\",\n },\n });\n\n var jwtAuth = new Vault.AuthBackend(\"jwt_auth\", new()\n {\n Type = jwt.Name,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tjwt, err := vault.NewPlugin(ctx, \"jwt\", \u0026vault.PluginArgs{\n\t\t\tType: pulumi.String(\"auth\"),\n\t\t\tName: pulumi.String(\"jwt\"),\n\t\t\tCommand: pulumi.String(\"vault-plugin-auth-jwt\"),\n\t\t\tVersion: pulumi.String(\"v0.17.0\"),\n\t\t\tSha256: pulumi.String(\"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\"),\n\t\t\tEnvs: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"HTTP_PROXY=http://proxy.example.com:8080\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewAuthBackend(ctx, \"jwt_auth\", \u0026vault.AuthBackendArgs{\n\t\t\tType: jwt.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_plugin\" \"jwt\" {\n type = \"auth\"\n name = \"jwt\"\n command = \"vault-plugin-auth-jwt\"\n version = \"v0.17.0\"\n sha256 = \"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\"\n envs = [\"HTTP_PROXY=http://proxy.example.com:8080\"]\n}\nresource \"vault_authbackend\" \"jwt_auth\" {\n type = vault_plugin.jwt.name\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Plugin;\nimport com.pulumi.vault.PluginArgs;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var jwt = new Plugin(\"jwt\", PluginArgs.builder()\n .type(\"auth\")\n .name(\"jwt\")\n .command(\"vault-plugin-auth-jwt\")\n .version(\"v0.17.0\")\n .sha256(\"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\")\n .envs(\"HTTP_PROXY=http://proxy.example.com:8080\")\n .build());\n\n var jwtAuth = new AuthBackend(\"jwtAuth\", AuthBackendArgs.builder()\n .type(jwt.name())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n jwt:\n type: vault:Plugin\n properties:\n type: auth\n name: jwt\n command: vault-plugin-auth-jwt\n version: v0.17.0\n sha256: 6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\n envs:\n - HTTP_PROXY=http://proxy.example.com:8080\n jwtAuth:\n type: vault:AuthBackend\n name: jwt_auth\n properties:\n type: ${jwt.name}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPlugins can be imported using `:type/name/:name` or `:type/version/:version/name/:name` as the ID if the version is non-empty, e.g.\n\n```sh\n$ pulumi import vault:index/plugin:Plugin jwt auth/name/jwt\n```\n\n```sh\n$ pulumi import vault:index/plugin:Plugin jwt auth/version/v0.17.0/name/jwt\n```\n\n", "properties": { "args": { "type": "array", "items": { "type": "string" }, "description": "List of additional args to pass to the plugin.\n" }, "command": { "type": "string", "description": "Command to execute the plugin, relative to the server's configured \u003cspan pulumi-lang-nodejs=\"`pluginDirectory`\" pulumi-lang-dotnet=\"`PluginDirectory`\" pulumi-lang-go=\"`pluginDirectory`\" pulumi-lang-python=\"`plugin_directory`\" pulumi-lang-yaml=\"`pluginDirectory`\" pulumi-lang-java=\"`pluginDirectory`\" pulumi-lang-hcl=\"`plugin_directory`\"\u003e`pluginDirectory`\u003c/span\u003e. Need to be set for non-enterprise plugin.\n" }, "envs": { "type": "array", "items": { "type": "string" }, "description": "List of additional environment variables to run the plugin with in KEY=VALUE form.\n", "secret": true }, "name": { "type": "string", "description": "Name of the plugin.\n" }, "ociImage": { "type": "string", "description": "Specifies OCI image to run. If specified, setting\n\u003cspan pulumi-lang-nodejs=\"`command`\" pulumi-lang-dotnet=\"`Command`\" pulumi-lang-go=\"`command`\" pulumi-lang-python=\"`command`\" pulumi-lang-yaml=\"`command`\" pulumi-lang-java=\"`command`\" pulumi-lang-hcl=\"`command`\"\u003e`command`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`args`\" pulumi-lang-dotnet=\"`Args`\" pulumi-lang-go=\"`args`\" pulumi-lang-python=\"`args`\" pulumi-lang-yaml=\"`args`\" pulumi-lang-java=\"`args`\" pulumi-lang-hcl=\"`args`\"\u003e`args`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`env`\" pulumi-lang-dotnet=\"`Env`\" pulumi-lang-go=\"`env`\" pulumi-lang-python=\"`env`\" pulumi-lang-yaml=\"`env`\" pulumi-lang-java=\"`env`\" pulumi-lang-hcl=\"`env`\"\u003e`env`\u003c/span\u003e will update the container's entrypoint, args, and\nenvironment variables (append-only) respectively.\n" }, "runtime": { "type": "string", "description": "Vault plugin runtime to use if \u003cspan pulumi-lang-nodejs=\"`ociImage`\" pulumi-lang-dotnet=\"`OciImage`\" pulumi-lang-go=\"`ociImage`\" pulumi-lang-python=\"`oci_image`\" pulumi-lang-yaml=\"`ociImage`\" pulumi-lang-java=\"`ociImage`\" pulumi-lang-hcl=\"`oci_image`\"\u003e`ociImage`\u003c/span\u003e is specified.\n" }, "sha256": { "type": "string", "description": "SHA256 sum of the plugin binary. Need to be set for non-enterprise plugin.\n" }, "type": { "type": "string", "description": "Type of plugin; one of \"auth\", \"secret\", or \"database\".\n" }, "version": { "type": "string", "description": "Semantic version of the plugin. Required for official enterprise plugins.\n" } }, "required": [ "name", "type" ], "inputProperties": { "args": { "type": "array", "items": { "type": "string" }, "description": "List of additional args to pass to the plugin.\n" }, "command": { "type": "string", "description": "Command to execute the plugin, relative to the server's configured \u003cspan pulumi-lang-nodejs=\"`pluginDirectory`\" pulumi-lang-dotnet=\"`PluginDirectory`\" pulumi-lang-go=\"`pluginDirectory`\" pulumi-lang-python=\"`plugin_directory`\" pulumi-lang-yaml=\"`pluginDirectory`\" pulumi-lang-java=\"`pluginDirectory`\" pulumi-lang-hcl=\"`plugin_directory`\"\u003e`pluginDirectory`\u003c/span\u003e. Need to be set for non-enterprise plugin.\n" }, "envs": { "type": "array", "items": { "type": "string" }, "description": "List of additional environment variables to run the plugin with in KEY=VALUE form.\n", "secret": true }, "name": { "type": "string", "description": "Name of the plugin.\n", "willReplaceOnChanges": true }, "ociImage": { "type": "string", "description": "Specifies OCI image to run. If specified, setting\n\u003cspan pulumi-lang-nodejs=\"`command`\" pulumi-lang-dotnet=\"`Command`\" pulumi-lang-go=\"`command`\" pulumi-lang-python=\"`command`\" pulumi-lang-yaml=\"`command`\" pulumi-lang-java=\"`command`\" pulumi-lang-hcl=\"`command`\"\u003e`command`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`args`\" pulumi-lang-dotnet=\"`Args`\" pulumi-lang-go=\"`args`\" pulumi-lang-python=\"`args`\" pulumi-lang-yaml=\"`args`\" pulumi-lang-java=\"`args`\" pulumi-lang-hcl=\"`args`\"\u003e`args`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`env`\" pulumi-lang-dotnet=\"`Env`\" pulumi-lang-go=\"`env`\" pulumi-lang-python=\"`env`\" pulumi-lang-yaml=\"`env`\" pulumi-lang-java=\"`env`\" pulumi-lang-hcl=\"`env`\"\u003e`env`\u003c/span\u003e will update the container's entrypoint, args, and\nenvironment variables (append-only) respectively.\n" }, "runtime": { "type": "string", "description": "Vault plugin runtime to use if \u003cspan pulumi-lang-nodejs=\"`ociImage`\" pulumi-lang-dotnet=\"`OciImage`\" pulumi-lang-go=\"`ociImage`\" pulumi-lang-python=\"`oci_image`\" pulumi-lang-yaml=\"`ociImage`\" pulumi-lang-java=\"`ociImage`\" pulumi-lang-hcl=\"`oci_image`\"\u003e`ociImage`\u003c/span\u003e is specified.\n" }, "sha256": { "type": "string", "description": "SHA256 sum of the plugin binary. Need to be set for non-enterprise plugin.\n" }, "type": { "type": "string", "description": "Type of plugin; one of \"auth\", \"secret\", or \"database\".\n", "willReplaceOnChanges": true }, "version": { "type": "string", "description": "Semantic version of the plugin. Required for official enterprise plugins.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering Plugin resources.\n", "properties": { "args": { "type": "array", "items": { "type": "string" }, "description": "List of additional args to pass to the plugin.\n" }, "command": { "type": "string", "description": "Command to execute the plugin, relative to the server's configured \u003cspan pulumi-lang-nodejs=\"`pluginDirectory`\" pulumi-lang-dotnet=\"`PluginDirectory`\" pulumi-lang-go=\"`pluginDirectory`\" pulumi-lang-python=\"`plugin_directory`\" pulumi-lang-yaml=\"`pluginDirectory`\" pulumi-lang-java=\"`pluginDirectory`\" pulumi-lang-hcl=\"`plugin_directory`\"\u003e`pluginDirectory`\u003c/span\u003e. Need to be set for non-enterprise plugin.\n" }, "envs": { "type": "array", "items": { "type": "string" }, "description": "List of additional environment variables to run the plugin with in KEY=VALUE form.\n", "secret": true }, "name": { "type": "string", "description": "Name of the plugin.\n", "willReplaceOnChanges": true }, "ociImage": { "type": "string", "description": "Specifies OCI image to run. If specified, setting\n\u003cspan pulumi-lang-nodejs=\"`command`\" pulumi-lang-dotnet=\"`Command`\" pulumi-lang-go=\"`command`\" pulumi-lang-python=\"`command`\" pulumi-lang-yaml=\"`command`\" pulumi-lang-java=\"`command`\" pulumi-lang-hcl=\"`command`\"\u003e`command`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`args`\" pulumi-lang-dotnet=\"`Args`\" pulumi-lang-go=\"`args`\" pulumi-lang-python=\"`args`\" pulumi-lang-yaml=\"`args`\" pulumi-lang-java=\"`args`\" pulumi-lang-hcl=\"`args`\"\u003e`args`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`env`\" pulumi-lang-dotnet=\"`Env`\" pulumi-lang-go=\"`env`\" pulumi-lang-python=\"`env`\" pulumi-lang-yaml=\"`env`\" pulumi-lang-java=\"`env`\" pulumi-lang-hcl=\"`env`\"\u003e`env`\u003c/span\u003e will update the container's entrypoint, args, and\nenvironment variables (append-only) respectively.\n" }, "runtime": { "type": "string", "description": "Vault plugin runtime to use if \u003cspan pulumi-lang-nodejs=\"`ociImage`\" pulumi-lang-dotnet=\"`OciImage`\" pulumi-lang-go=\"`ociImage`\" pulumi-lang-python=\"`oci_image`\" pulumi-lang-yaml=\"`ociImage`\" pulumi-lang-java=\"`ociImage`\" pulumi-lang-hcl=\"`oci_image`\"\u003e`ociImage`\u003c/span\u003e is specified.\n" }, "sha256": { "type": "string", "description": "SHA256 sum of the plugin binary. Need to be set for non-enterprise plugin.\n" }, "type": { "type": "string", "description": "Type of plugin; one of \"auth\", \"secret\", or \"database\".\n", "willReplaceOnChanges": true }, "version": { "type": "string", "description": "Semantic version of the plugin. Required for official enterprise plugins.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:index/pluginPinnedVersion:PluginPinnedVersion": { "description": "Manages pinned plugin versions registered in the plugin catalog.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\nFor more information on managing external plugins, please refer to the Vault\n[documentation](https://developer.hashicorp.com/vault/docs/plugins).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst jwt = new vault.Plugin(\"jwt\", {\n type: \"auth\",\n name: \"jwt\",\n command: \"vault-plugin-auth-jwt\",\n version: \"v0.17.0\",\n sha256: \"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\",\n envs: [\"HTTP_PROXY=http://proxy.example.com:8080\"],\n});\nconst jwtPin = new vault.PluginPinnedVersion(\"jwt_pin\", {\n type: jwt.type,\n name: jwt.name,\n version: jwt.version,\n});\nconst jwtAuth = new vault.AuthBackend(\"jwt_auth\", {type: jwtPin.name});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\njwt = vault.Plugin(\"jwt\",\n type=\"auth\",\n name=\"jwt\",\n command=\"vault-plugin-auth-jwt\",\n version=\"v0.17.0\",\n sha256=\"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\",\n envs=[\"HTTP_PROXY=http://proxy.example.com:8080\"])\njwt_pin = vault.PluginPinnedVersion(\"jwt_pin\",\n type=jwt.type,\n name=jwt.name,\n version=jwt.version)\njwt_auth = vault.AuthBackend(\"jwt_auth\", type=jwt_pin.name)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var jwt = new Vault.Plugin(\"jwt\", new()\n {\n Type = \"auth\",\n Name = \"jwt\",\n Command = \"vault-plugin-auth-jwt\",\n Version = \"v0.17.0\",\n Sha256 = \"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\",\n Envs = new[]\n {\n \"HTTP_PROXY=http://proxy.example.com:8080\",\n },\n });\n\n var jwtPin = new Vault.PluginPinnedVersion(\"jwt_pin\", new()\n {\n Type = jwt.Type,\n Name = jwt.Name,\n Version = jwt.Version,\n });\n\n var jwtAuth = new Vault.AuthBackend(\"jwt_auth\", new()\n {\n Type = jwtPin.Name,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tjwt, err := vault.NewPlugin(ctx, \"jwt\", \u0026vault.PluginArgs{\n\t\t\tType: pulumi.String(\"auth\"),\n\t\t\tName: pulumi.String(\"jwt\"),\n\t\t\tCommand: pulumi.String(\"vault-plugin-auth-jwt\"),\n\t\t\tVersion: pulumi.String(\"v0.17.0\"),\n\t\t\tSha256: pulumi.String(\"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\"),\n\t\t\tEnvs: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"HTTP_PROXY=http://proxy.example.com:8080\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjwtPin, err := vault.NewPluginPinnedVersion(ctx, \"jwt_pin\", \u0026vault.PluginPinnedVersionArgs{\n\t\t\tType: jwt.Type,\n\t\t\tName: jwt.Name,\n\t\t\tVersion: jwt.Version,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewAuthBackend(ctx, \"jwt_auth\", \u0026vault.AuthBackendArgs{\n\t\t\tType: jwtPin.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_plugin\" \"jwt\" {\n type = \"auth\"\n name = \"jwt\"\n command = \"vault-plugin-auth-jwt\"\n version = \"v0.17.0\"\n sha256 = \"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\"\n envs = [\"HTTP_PROXY=http://proxy.example.com:8080\"]\n}\nresource \"vault_pluginpinnedversion\" \"jwt_pin\" {\n type = vault_plugin.jwt.type\n name = vault_plugin.jwt.name\n version = vault_plugin.jwt.version\n}\nresource \"vault_authbackend\" \"jwt_auth\" {\n type = vault_pluginpinnedversion.jwt_pin.name\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Plugin;\nimport com.pulumi.vault.PluginArgs;\nimport com.pulumi.vault.PluginPinnedVersion;\nimport com.pulumi.vault.PluginPinnedVersionArgs;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var jwt = new Plugin(\"jwt\", PluginArgs.builder()\n .type(\"auth\")\n .name(\"jwt\")\n .command(\"vault-plugin-auth-jwt\")\n .version(\"v0.17.0\")\n .sha256(\"6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\")\n .envs(\"HTTP_PROXY=http://proxy.example.com:8080\")\n .build());\n\n var jwtPin = new PluginPinnedVersion(\"jwtPin\", PluginPinnedVersionArgs.builder()\n .type(jwt.type())\n .name(jwt.name())\n .version(jwt.version())\n .build());\n\n var jwtAuth = new AuthBackend(\"jwtAuth\", AuthBackendArgs.builder()\n .type(jwtPin.name())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n jwt:\n type: vault:Plugin\n properties:\n type: auth\n name: jwt\n command: vault-plugin-auth-jwt\n version: v0.17.0\n sha256: 6bd0a803ed742aa3ce35e4fa23d2c8d550e6c1567bf63410cec489c28b68b0fc\n envs:\n - HTTP_PROXY=http://proxy.example.com:8080\n jwtPin:\n type: vault:PluginPinnedVersion\n name: jwt_pin\n properties:\n type: ${jwt.type}\n name: ${jwt.name}\n version: ${jwt.version}\n jwtAuth:\n type: vault:AuthBackend\n name: jwt_auth\n properties:\n type: ${jwtPin.name}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPinned plugin versions can be imported using `type/name` as the ID, e.g.\n\n```sh\n$ pulumi import vault:index/pluginPinnedVersion:PluginPinnedVersion jwt_pin auth/jwt\n```\n\n", "properties": { "name": { "type": "string", "description": "Name of the plugin.\n" }, "type": { "type": "string", "description": "Type of plugin; one of \"auth\", \"secret\", or \"database\".\n" }, "version": { "type": "string", "description": "Semantic version of the plugin to pin.\n" } }, "required": [ "name", "type", "version" ], "inputProperties": { "name": { "type": "string", "description": "Name of the plugin.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Type of plugin; one of \"auth\", \"secret\", or \"database\".\n", "willReplaceOnChanges": true }, "version": { "type": "string", "description": "Semantic version of the plugin to pin.\n" } }, "requiredInputs": [ "type", "version" ], "stateInputs": { "description": "Input properties used for looking up and filtering PluginPinnedVersion resources.\n", "properties": { "name": { "type": "string", "description": "Name of the plugin.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Type of plugin; one of \"auth\", \"secret\", or \"database\".\n", "willReplaceOnChanges": true }, "version": { "type": "string", "description": "Semantic version of the plugin to pin.\n" } }, "type": "object" } }, "vault:index/pluginRuntime:PluginRuntime": { "description": "Manages a plugin runtime in Vault's plugin runtime catalog. Plugin runtimes allow Vault to run plugins in isolated environments with resource constraints.\n\n\u003e **Important** This resource requires Vault 1.15 or later.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.PluginRuntime(\"example\", {\n type: \"container\",\n name: \"example-runtime\",\n ociRuntime: \"runc\",\n rootless: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.PluginRuntime(\"example\",\n type=\"container\",\n name=\"example-runtime\",\n oci_runtime=\"runc\",\n rootless=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.PluginRuntime(\"example\", new()\n {\n Type = \"container\",\n Name = \"example-runtime\",\n OciRuntime = \"runc\",\n Rootless = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewPluginRuntime(ctx, \"example\", \u0026vault.PluginRuntimeArgs{\n\t\t\tType: pulumi.String(\"container\"),\n\t\t\tName: pulumi.String(\"example-runtime\"),\n\t\t\tOciRuntime: pulumi.String(\"runc\"),\n\t\t\tRootless: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pluginruntime\" \"example\" {\n type = \"container\"\n name = \"example-runtime\"\n oci_runtime = \"runc\"\n rootless = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.PluginRuntime;\nimport com.pulumi.vault.PluginRuntimeArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new PluginRuntime(\"example\", PluginRuntimeArgs.builder()\n .type(\"container\")\n .name(\"example-runtime\")\n .ociRuntime(\"runc\")\n .rootless(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:PluginRuntime\n properties:\n type: container\n name: example-runtime\n ociRuntime: runc\n rootless: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Resource Limits\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst constrained = new vault.PluginRuntime(\"constrained\", {\n type: \"container\",\n name: \"constrained-runtime\",\n ociRuntime: \"runc\",\n cpuNanos: 1000000000,\n memoryBytes: 536870912,\n rootless: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconstrained = vault.PluginRuntime(\"constrained\",\n type=\"container\",\n name=\"constrained-runtime\",\n oci_runtime=\"runc\",\n cpu_nanos=1000000000,\n memory_bytes=536870912,\n rootless=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var constrained = new Vault.PluginRuntime(\"constrained\", new()\n {\n Type = \"container\",\n Name = \"constrained-runtime\",\n OciRuntime = \"runc\",\n CpuNanos = 1000000000,\n MemoryBytes = 536870912,\n Rootless = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewPluginRuntime(ctx, \"constrained\", \u0026vault.PluginRuntimeArgs{\n\t\t\tType: pulumi.String(\"container\"),\n\t\t\tName: pulumi.String(\"constrained-runtime\"),\n\t\t\tOciRuntime: pulumi.String(\"runc\"),\n\t\t\tCpuNanos: pulumi.Int(1000000000),\n\t\t\tMemoryBytes: pulumi.Int(536870912),\n\t\t\tRootless: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pluginruntime\" \"constrained\" {\n type = \"container\"\n name = \"constrained-runtime\"\n oci_runtime = \"runc\"\n cpu_nanos = 1000000000 # 1 CPU core\n memory_bytes = 536870912 # 512 MB\n rootless = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.PluginRuntime;\nimport com.pulumi.vault.PluginRuntimeArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var constrained = new PluginRuntime(\"constrained\", PluginRuntimeArgs.builder()\n .type(\"container\")\n .name(\"constrained-runtime\")\n .ociRuntime(\"runc\")\n .cpuNanos(1000000000)\n .memoryBytes(536870912)\n .rootless(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n constrained:\n type: vault:PluginRuntime\n properties:\n type: container\n name: constrained-runtime\n ociRuntime: runc\n cpuNanos: 1e+09 # 1 CPU core\n memoryBytes: 5.36870912e+08 # 512 MB\n rootless: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Custom Cgroup\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst customCgroup = new vault.PluginRuntime(\"custom_cgroup\", {\n type: \"container\",\n name: \"custom-cgroup-runtime\",\n ociRuntime: \"runc\",\n cgroupParent: \"/vault/plugins\",\n cpuNanos: 2000000000,\n memoryBytes: 1073741824,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ncustom_cgroup = vault.PluginRuntime(\"custom_cgroup\",\n type=\"container\",\n name=\"custom-cgroup-runtime\",\n oci_runtime=\"runc\",\n cgroup_parent=\"/vault/plugins\",\n cpu_nanos=2000000000,\n memory_bytes=1073741824)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var customCgroup = new Vault.PluginRuntime(\"custom_cgroup\", new()\n {\n Type = \"container\",\n Name = \"custom-cgroup-runtime\",\n OciRuntime = \"runc\",\n CgroupParent = \"/vault/plugins\",\n CpuNanos = 2000000000,\n MemoryBytes = 1073741824,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewPluginRuntime(ctx, \"custom_cgroup\", \u0026vault.PluginRuntimeArgs{\n\t\t\tType: pulumi.String(\"container\"),\n\t\t\tName: pulumi.String(\"custom-cgroup-runtime\"),\n\t\t\tOciRuntime: pulumi.String(\"runc\"),\n\t\t\tCgroupParent: pulumi.String(\"/vault/plugins\"),\n\t\t\tCpuNanos: pulumi.Int(2000000000),\n\t\t\tMemoryBytes: pulumi.Int(1073741824),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pluginruntime\" \"custom_cgroup\" {\n type = \"container\"\n name = \"custom-cgroup-runtime\"\n oci_runtime = \"runc\"\n cgroup_parent = \"/vault/plugins\"\n cpu_nanos = 2000000000 # 2 CPU cores\n memory_bytes = 1073741824 # 1 GB\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.PluginRuntime;\nimport com.pulumi.vault.PluginRuntimeArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var customCgroup = new PluginRuntime(\"customCgroup\", PluginRuntimeArgs.builder()\n .type(\"container\")\n .name(\"custom-cgroup-runtime\")\n .ociRuntime(\"runc\")\n .cgroupParent(\"/vault/plugins\")\n .cpuNanos(2000000000)\n .memoryBytes(1073741824)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n customCgroup:\n type: vault:PluginRuntime\n name: custom_cgroup\n properties:\n type: container\n name: custom-cgroup-runtime\n ociRuntime: runc\n cgroupParent: /vault/plugins\n cpuNanos: 2e+09 # 2 CPU cores\n memoryBytes: 1.073741824e+09 # 1 GB\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Notes\n\n* Plugin runtimes require Vault 1.15 or later\n* The \u003cspan pulumi-lang-nodejs=\"`container`\" pulumi-lang-dotnet=\"`Container`\" pulumi-lang-go=\"`container`\" pulumi-lang-python=\"`container`\" pulumi-lang-yaml=\"`container`\" pulumi-lang-java=\"`container`\" pulumi-lang-hcl=\"`container`\"\u003e`container`\u003c/span\u003e runtime type requires a properly configured container runtime (e.g., Docker, containerd) on the Vault server\n* Resource limits (\u003cspan pulumi-lang-nodejs=\"`cpuNanos`\" pulumi-lang-dotnet=\"`CpuNanos`\" pulumi-lang-go=\"`cpuNanos`\" pulumi-lang-python=\"`cpu_nanos`\" pulumi-lang-yaml=\"`cpuNanos`\" pulumi-lang-java=\"`cpuNanos`\" pulumi-lang-hcl=\"`cpu_nanos`\"\u003e`cpuNanos`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`memoryBytes`\" pulumi-lang-dotnet=\"`MemoryBytes`\" pulumi-lang-go=\"`memoryBytes`\" pulumi-lang-python=\"`memory_bytes`\" pulumi-lang-yaml=\"`memoryBytes`\" pulumi-lang-java=\"`memoryBytes`\" pulumi-lang-hcl=\"`memory_bytes`\"\u003e`memoryBytes`\u003c/span\u003e) help prevent plugins from consuming excessive resources\n* The \u003cspan pulumi-lang-nodejs=\"`rootless`\" pulumi-lang-dotnet=\"`Rootless`\" pulumi-lang-go=\"`rootless`\" pulumi-lang-python=\"`rootless`\" pulumi-lang-yaml=\"`rootless`\" pulumi-lang-java=\"`rootless`\" pulumi-lang-hcl=\"`rootless`\"\u003e`rootless`\u003c/span\u003e option provides additional security isolation but may have compatibility limitations with some plugins\n* Deleting a plugin runtime that is in use by registered plugins will fail; you must first unregister or update those plugins\n\n## Import\n\nPlugin runtimes can be imported using the `{type}/{name}` format, e.g.\n\n```sh\n$ pulumi import vault:index/pluginRuntime:PluginRuntime example container/example-runtime\n```\n\n\u003e **Note on Import Behavior** The Vault API returns all configuration fields when reading a plugin runtime. However, fields that were not explicitly set (\u003cspan pulumi-lang-nodejs=\"`ociRuntime`\" pulumi-lang-dotnet=\"`OciRuntime`\" pulumi-lang-go=\"`ociRuntime`\" pulumi-lang-python=\"`oci_runtime`\" pulumi-lang-yaml=\"`ociRuntime`\" pulumi-lang-java=\"`ociRuntime`\" pulumi-lang-hcl=\"`oci_runtime`\"\u003e`ociRuntime`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`cgroupParent`\" pulumi-lang-dotnet=\"`CgroupParent`\" pulumi-lang-go=\"`cgroupParent`\" pulumi-lang-python=\"`cgroup_parent`\" pulumi-lang-yaml=\"`cgroupParent`\" pulumi-lang-java=\"`cgroupParent`\" pulumi-lang-hcl=\"`cgroup_parent`\"\u003e`cgroupParent`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`cpuNanos`\" pulumi-lang-dotnet=\"`CpuNanos`\" pulumi-lang-go=\"`cpuNanos`\" pulumi-lang-python=\"`cpu_nanos`\" pulumi-lang-yaml=\"`cpuNanos`\" pulumi-lang-java=\"`cpuNanos`\" pulumi-lang-hcl=\"`cpu_nanos`\"\u003e`cpuNanos`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`memoryBytes`\" pulumi-lang-dotnet=\"`MemoryBytes`\" pulumi-lang-go=\"`memoryBytes`\" pulumi-lang-python=\"`memory_bytes`\" pulumi-lang-yaml=\"`memoryBytes`\" pulumi-lang-java=\"`memoryBytes`\" pulumi-lang-hcl=\"`memory_bytes`\"\u003e`memoryBytes`\u003c/span\u003e) will have default values (empty string for strings, 0 for integers). The provider treats these default values as \"not set\" (null in Terraform state) to match configurations where these fields are omitted. After import, if your configuration includes these fields with non-default values, they will be properly populated in state.\n\n**Import Workflow:**\n1. Import the resource: `terraform import vault_plugin_runtime.example container/example-runtime`\n2. Verify the import: `pulumi preview` (should show no changes if config matches what's in Vault)\n\n", "properties": { "cgroupParent": { "type": "string", "description": "The parent cgroup to set for each container.\nIf not specified, defaults to the cgroup of the Vault process.\n" }, "cpuNanos": { "type": "integer", "description": "CPU time in nanoseconds that the plugin can use per second.\nFor example, \u003cspan pulumi-lang-nodejs=\"`1000000000`\" pulumi-lang-dotnet=\"`1000000000`\" pulumi-lang-go=\"`1000000000`\" pulumi-lang-python=\"`1000000000`\" pulumi-lang-yaml=\"`1000000000`\" pulumi-lang-java=\"`1000000000`\" pulumi-lang-hcl=\"`1000000000`\"\u003e`1000000000`\u003c/span\u003e equals 1 CPU core. This sets a CPU quota for the container.\n" }, "memoryBytes": { "type": "integer", "description": "Maximum memory in bytes that the plugin can use.\nFor example, \u003cspan pulumi-lang-nodejs=\"`536870912`\" pulumi-lang-dotnet=\"`536870912`\" pulumi-lang-go=\"`536870912`\" pulumi-lang-python=\"`536870912`\" pulumi-lang-yaml=\"`536870912`\" pulumi-lang-java=\"`536870912`\" pulumi-lang-hcl=\"`536870912`\"\u003e`536870912`\u003c/span\u003e equals 512 MB. This sets a memory limit for the container.\n" }, "name": { "type": "string", "description": "The name of the plugin runtime.\nChanging this forces a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n" }, "ociRuntime": { "type": "string", "description": "The OCI-compliant runtime to use for running plugin containers.\nCommon values include \u003cspan pulumi-lang-nodejs=\"`runc`\" pulumi-lang-dotnet=\"`Runc`\" pulumi-lang-go=\"`runc`\" pulumi-lang-python=\"`runc`\" pulumi-lang-yaml=\"`runc`\" pulumi-lang-java=\"`runc`\" pulumi-lang-hcl=\"`runc`\"\u003e`runc`\u003c/span\u003e (default) and \u003cspan pulumi-lang-nodejs=\"`runsc`\" pulumi-lang-dotnet=\"`Runsc`\" pulumi-lang-go=\"`runsc`\" pulumi-lang-python=\"`runsc`\" pulumi-lang-yaml=\"`runsc`\" pulumi-lang-java=\"`runsc`\" pulumi-lang-hcl=\"`runsc`\"\u003e`runsc`\u003c/span\u003e (gVisor).\n" }, "rootless": { "type": "boolean", "description": "Whether the runtime should run the plugin as a non-root user.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, enhances security by running containers without root privileges.\n" }, "type": { "type": "string", "description": "The type of plugin runtime. Currently only \u003cspan pulumi-lang-nodejs=\"`container`\" pulumi-lang-dotnet=\"`Container`\" pulumi-lang-go=\"`container`\" pulumi-lang-python=\"`container`\" pulumi-lang-yaml=\"`container`\" pulumi-lang-java=\"`container`\" pulumi-lang-hcl=\"`container`\"\u003e`container`\u003c/span\u003e is supported.\nChanging this forces a new resource to be created.\n" } }, "required": [ "cgroupParent", "cpuNanos", "memoryBytes", "name", "ociRuntime", "rootless", "type" ], "inputProperties": { "cgroupParent": { "type": "string", "description": "The parent cgroup to set for each container.\nIf not specified, defaults to the cgroup of the Vault process.\n" }, "cpuNanos": { "type": "integer", "description": "CPU time in nanoseconds that the plugin can use per second.\nFor example, \u003cspan pulumi-lang-nodejs=\"`1000000000`\" pulumi-lang-dotnet=\"`1000000000`\" pulumi-lang-go=\"`1000000000`\" pulumi-lang-python=\"`1000000000`\" pulumi-lang-yaml=\"`1000000000`\" pulumi-lang-java=\"`1000000000`\" pulumi-lang-hcl=\"`1000000000`\"\u003e`1000000000`\u003c/span\u003e equals 1 CPU core. This sets a CPU quota for the container.\n" }, "memoryBytes": { "type": "integer", "description": "Maximum memory in bytes that the plugin can use.\nFor example, \u003cspan pulumi-lang-nodejs=\"`536870912`\" pulumi-lang-dotnet=\"`536870912`\" pulumi-lang-go=\"`536870912`\" pulumi-lang-python=\"`536870912`\" pulumi-lang-yaml=\"`536870912`\" pulumi-lang-java=\"`536870912`\" pulumi-lang-hcl=\"`536870912`\"\u003e`536870912`\u003c/span\u003e equals 512 MB. This sets a memory limit for the container.\n" }, "name": { "type": "string", "description": "The name of the plugin runtime.\nChanging this forces a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n" }, "ociRuntime": { "type": "string", "description": "The OCI-compliant runtime to use for running plugin containers.\nCommon values include \u003cspan pulumi-lang-nodejs=\"`runc`\" pulumi-lang-dotnet=\"`Runc`\" pulumi-lang-go=\"`runc`\" pulumi-lang-python=\"`runc`\" pulumi-lang-yaml=\"`runc`\" pulumi-lang-java=\"`runc`\" pulumi-lang-hcl=\"`runc`\"\u003e`runc`\u003c/span\u003e (default) and \u003cspan pulumi-lang-nodejs=\"`runsc`\" pulumi-lang-dotnet=\"`Runsc`\" pulumi-lang-go=\"`runsc`\" pulumi-lang-python=\"`runsc`\" pulumi-lang-yaml=\"`runsc`\" pulumi-lang-java=\"`runsc`\" pulumi-lang-hcl=\"`runsc`\"\u003e`runsc`\u003c/span\u003e (gVisor).\n" }, "rootless": { "type": "boolean", "description": "Whether the runtime should run the plugin as a non-root user.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, enhances security by running containers without root privileges.\n" }, "type": { "type": "string", "description": "The type of plugin runtime. Currently only \u003cspan pulumi-lang-nodejs=\"`container`\" pulumi-lang-dotnet=\"`Container`\" pulumi-lang-go=\"`container`\" pulumi-lang-python=\"`container`\" pulumi-lang-yaml=\"`container`\" pulumi-lang-java=\"`container`\" pulumi-lang-hcl=\"`container`\"\u003e`container`\u003c/span\u003e is supported.\nChanging this forces a new resource to be created.\n" } }, "requiredInputs": [ "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering PluginRuntime resources.\n", "properties": { "cgroupParent": { "type": "string", "description": "The parent cgroup to set for each container.\nIf not specified, defaults to the cgroup of the Vault process.\n" }, "cpuNanos": { "type": "integer", "description": "CPU time in nanoseconds that the plugin can use per second.\nFor example, \u003cspan pulumi-lang-nodejs=\"`1000000000`\" pulumi-lang-dotnet=\"`1000000000`\" pulumi-lang-go=\"`1000000000`\" pulumi-lang-python=\"`1000000000`\" pulumi-lang-yaml=\"`1000000000`\" pulumi-lang-java=\"`1000000000`\" pulumi-lang-hcl=\"`1000000000`\"\u003e`1000000000`\u003c/span\u003e equals 1 CPU core. This sets a CPU quota for the container.\n" }, "memoryBytes": { "type": "integer", "description": "Maximum memory in bytes that the plugin can use.\nFor example, \u003cspan pulumi-lang-nodejs=\"`536870912`\" pulumi-lang-dotnet=\"`536870912`\" pulumi-lang-go=\"`536870912`\" pulumi-lang-python=\"`536870912`\" pulumi-lang-yaml=\"`536870912`\" pulumi-lang-java=\"`536870912`\" pulumi-lang-hcl=\"`536870912`\"\u003e`536870912`\u003c/span\u003e equals 512 MB. This sets a memory limit for the container.\n" }, "name": { "type": "string", "description": "The name of the plugin runtime.\nChanging this forces a new resource to be created.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n" }, "ociRuntime": { "type": "string", "description": "The OCI-compliant runtime to use for running plugin containers.\nCommon values include \u003cspan pulumi-lang-nodejs=\"`runc`\" pulumi-lang-dotnet=\"`Runc`\" pulumi-lang-go=\"`runc`\" pulumi-lang-python=\"`runc`\" pulumi-lang-yaml=\"`runc`\" pulumi-lang-java=\"`runc`\" pulumi-lang-hcl=\"`runc`\"\u003e`runc`\u003c/span\u003e (default) and \u003cspan pulumi-lang-nodejs=\"`runsc`\" pulumi-lang-dotnet=\"`Runsc`\" pulumi-lang-go=\"`runsc`\" pulumi-lang-python=\"`runsc`\" pulumi-lang-yaml=\"`runsc`\" pulumi-lang-java=\"`runsc`\" pulumi-lang-hcl=\"`runsc`\"\u003e`runsc`\u003c/span\u003e (gVisor).\n" }, "rootless": { "type": "boolean", "description": "Whether the runtime should run the plugin as a non-root user.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, enhances security by running containers without root privileges.\n" }, "type": { "type": "string", "description": "The type of plugin runtime. Currently only \u003cspan pulumi-lang-nodejs=\"`container`\" pulumi-lang-dotnet=\"`Container`\" pulumi-lang-go=\"`container`\" pulumi-lang-python=\"`container`\" pulumi-lang-yaml=\"`container`\" pulumi-lang-java=\"`container`\" pulumi-lang-hcl=\"`container`\"\u003e`container`\u003c/span\u003e is supported.\nChanging this forces a new resource to be created.\n" } }, "type": "object" } }, "vault:index/policy:Policy": { "description": "## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.Policy(\"example\", {\n name: \"dev-team\",\n allowOverwrite: false,\n policy: `path \\\\\"secret/my_app\\\\\" {\n capabilities = [\\\\\"update\\\\\"]\n}\n`,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.Policy(\"example\",\n name=\"dev-team\",\n allow_overwrite=False,\n policy=\"\"\"path \\\"secret/my_app\\\" {\n capabilities = [\\\"update\\\"]\n}\n\"\"\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Policy(\"example\", new()\n {\n Name = \"dev-team\",\n AllowOverwrite = false,\n PolicyContents = @\"path \\\"\"secret/my_app\\\"\" {\n capabilities = [\\\"\"update\\\"\"]\n}\n\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewPolicy(ctx, \"example\", \u0026vault.PolicyArgs{\n\t\t\tName: pulumi.String(\"dev-team\"),\n\t\t\tAllowOverwrite: pulumi.Bool(false),\n\t\t\tPolicy: pulumi.String(\"path \\\\\\\"secret/my_app\\\\\\\" {\\n capabilities = [\\\\\\\"update\\\\\\\"]\\n}\\n\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_policy\" \"example\" {\n name = \"dev-team\"\n allow_overwrite = false\n policy = \"path \\\\\\\"secret/my_app\\\\\\\" {\\n capabilities = [\\\\\\\"update\\\\\\\"]\\n}\\n\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Policy;\nimport com.pulumi.vault.PolicyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new Policy(\"example\", PolicyArgs.builder()\n .name(\"dev-team\")\n .allowOverwrite(false)\n .policy(\"\"\"\npath \\\"secret/my_app\\\" {\n capabilities = [\\\"update\\\"]\n}\n \"\"\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:Policy\n properties:\n name: dev-team\n allowOverwrite: false\n policy: |\n path \\\"secret/my_app\\\" {\n capabilities = [\\\"update\\\"]\n }\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Tutorials \n\nRefer to the following tutorials for additional usage examples:\n\n- [Codify Management of Vault Enterprise Using Terraform](https://learn.hashicorp.com/tutorials/vault/codify-mgmt-enterprise)\n\n- [Codify Management of Vault Using Terraform](https://learn.hashicorp.com/tutorials/vault/codify-mgmt-oss)\n\n## Import\n\nPolicies can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/policy:Policy example dev-team\n```\n\n", "properties": { "allowOverwrite": { "type": "boolean", "description": "Allow overwriting policies with the same name. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. This will be removed in the next major release and the default behavior will be not overwrite policies.\n", "deprecationMessage": "Deprecated. Overwriting pre-existing policies will soon be removed. Use 'terraform import' to manage existing policies." }, "name": { "type": "string", "description": "The name of the policy\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policy": { "type": "string", "description": "String containing a Vault policy\n", "language": { "csharp": { "name": "PolicyContents" } } } }, "required": [ "allowOverwrite", "name", "policy" ], "inputProperties": { "allowOverwrite": { "type": "boolean", "description": "Allow overwriting policies with the same name. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. This will be removed in the next major release and the default behavior will be not overwrite policies.\n", "deprecationMessage": "Deprecated. Overwriting pre-existing policies will soon be removed. Use 'terraform import' to manage existing policies." }, "name": { "type": "string", "description": "The name of the policy\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policy": { "type": "string", "description": "String containing a Vault policy\n", "language": { "csharp": { "name": "PolicyContents" } } } }, "requiredInputs": [ "policy" ], "stateInputs": { "description": "Input properties used for looking up and filtering Policy resources.\n", "properties": { "allowOverwrite": { "type": "boolean", "description": "Allow overwriting policies with the same name. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. This will be removed in the next major release and the default behavior will be not overwrite policies.\n", "deprecationMessage": "Deprecated. Overwriting pre-existing policies will soon be removed. Use 'terraform import' to manage existing policies." }, "name": { "type": "string", "description": "The name of the policy\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policy": { "type": "string", "description": "String containing a Vault policy\n", "language": { "csharp": { "name": "PolicyContents" } } } }, "type": "object" } }, "vault:index/quotaConfig:QuotaConfig": { "description": "Manages the singleton quota configuration at `/sys/quotas/config`.\n\n\u003e **Important** This is a global singleton configuration. Do not define this resource multiple times for the same Vault server, because each instance targets the same remote configuration.\n\n\u003e **Important** Vault Enterprise allows `/sys/quotas/config` to be called from the root or an administrative namespace, but that support is asymmetric. Administrative namespaces can read the configuration and update the boolean flags, while the exempt-path fields remain effectively root-managed.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst global = new vault.QuotaConfig(\"global\", {\n namespace: \"ns_admin\",\n enableRateLimitAuditLogging: true,\n enableRateLimitResponseHeaders: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nglobal_ = vault.QuotaConfig(\"global\",\n namespace=\"ns_admin\",\n enable_rate_limit_audit_logging=True,\n enable_rate_limit_response_headers=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @global = new Vault.QuotaConfig(\"global\", new()\n {\n Namespace = \"ns_admin\",\n EnableRateLimitAuditLogging = true,\n EnableRateLimitResponseHeaders = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewQuotaConfig(ctx, \"global\", \u0026vault.QuotaConfigArgs{\n\t\t\tNamespace: pulumi.String(\"ns_admin\"),\n\t\t\tEnableRateLimitAuditLogging: pulumi.Bool(true),\n\t\t\tEnableRateLimitResponseHeaders: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_quotaconfig\" \"global\" {\n namespace = \"ns_admin\"\n enable_rate_limit_audit_logging = true\n enable_rate_limit_response_headers = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.QuotaConfig;\nimport com.pulumi.vault.QuotaConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var global = new QuotaConfig(\"global\", QuotaConfigArgs.builder()\n .namespace(\"ns_admin\")\n .enableRateLimitAuditLogging(true)\n .enableRateLimitResponseHeaders(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n global:\n type: vault:QuotaConfig\n properties:\n namespace: ns_admin\n enableRateLimitAuditLogging: true\n enableRateLimitResponseHeaders: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Delete Behavior\n\nVault does not expose a DELETE operation for `/sys/quotas/config`. Destroying this resource resets the configuration to the Vault defaults by writing:\n\n* \u003cspan pulumi-lang-nodejs=\"`rateLimitExemptPaths \" pulumi-lang-dotnet=\"`RateLimitExemptPaths \" pulumi-lang-go=\"`rateLimitExemptPaths \" pulumi-lang-python=\"`rate_limit_exempt_paths \" pulumi-lang-yaml=\"`rateLimitExemptPaths \" pulumi-lang-java=\"`rateLimitExemptPaths \" pulumi-lang-hcl=\"`rate_limit_exempt_paths \"\u003e`rateLimitExemptPaths \u003c/span\u003e= []`\n* \u003cspan pulumi-lang-nodejs=\"`absoluteRateLimitExemptPaths \" pulumi-lang-dotnet=\"`AbsoluteRateLimitExemptPaths \" pulumi-lang-go=\"`absoluteRateLimitExemptPaths \" pulumi-lang-python=\"`absolute_rate_limit_exempt_paths \" pulumi-lang-yaml=\"`absoluteRateLimitExemptPaths \" pulumi-lang-java=\"`absoluteRateLimitExemptPaths \" pulumi-lang-hcl=\"`absolute_rate_limit_exempt_paths \"\u003e`absoluteRateLimitExemptPaths \u003c/span\u003e= []`\n* \u003cspan pulumi-lang-nodejs=\"`enableRateLimitAuditLogging \" pulumi-lang-dotnet=\"`EnableRateLimitAuditLogging \" pulumi-lang-go=\"`enableRateLimitAuditLogging \" pulumi-lang-python=\"`enable_rate_limit_audit_logging \" pulumi-lang-yaml=\"`enableRateLimitAuditLogging \" pulumi-lang-java=\"`enableRateLimitAuditLogging \" pulumi-lang-hcl=\"`enable_rate_limit_audit_logging \"\u003e`enableRateLimitAuditLogging \u003c/span\u003e= false`\n* \u003cspan pulumi-lang-nodejs=\"`enableRateLimitResponseHeaders \" pulumi-lang-dotnet=\"`EnableRateLimitResponseHeaders \" pulumi-lang-go=\"`enableRateLimitResponseHeaders \" pulumi-lang-python=\"`enable_rate_limit_response_headers \" pulumi-lang-yaml=\"`enableRateLimitResponseHeaders \" pulumi-lang-java=\"`enableRateLimitResponseHeaders \" pulumi-lang-hcl=\"`enable_rate_limit_response_headers \"\u003e`enableRateLimitResponseHeaders \u003c/span\u003e= false`\n\nThis reset behavior is supported only when the resource is managed from the root namespace. Destroying a namespaced \u003cspan pulumi-lang-nodejs=\"`vault.QuotaConfig`\" pulumi-lang-dotnet=\"`vault.QuotaConfig`\" pulumi-lang-go=\"`QuotaConfig`\" pulumi-lang-python=\"`QuotaConfig`\" pulumi-lang-yaml=\"`vault.QuotaConfig`\" pulumi-lang-java=\"`vault.QuotaConfig`\" pulumi-lang-hcl=\"`vault_quota_config`\"\u003e`vault.QuotaConfig`\u003c/span\u003e resource is not supported, because administrative namespaces cannot reset the root-managed exempt-path fields. To remove a namespaced instance from Terraform, first reset the quota configuration from the root namespace if needed, then remove the resource from state.\n\n## Import\n\nImport the singleton configuration with the fixed endpoint identifier:\n\n```sh\n$ pulumi import vault:index/quotaConfig:QuotaConfig global sys/quotas/config\n```\n\nWhen importing a namespaced instance, set `TERRAFORM_VAULT_NAMESPACE_IMPORT` so Terraform records the namespace in state:\n\n```sh\n$ TERRAFORM_VAULT_NAMESPACE_IMPORT=ns_admin terraform import vault_quota_config.global sys/quotas/config\n```\n\n", "properties": { "absoluteRateLimitExemptPaths": { "type": "array", "items": { "type": "string" }, "description": "Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.\n" }, "enableRateLimitAuditLogging": { "type": "boolean", "description": "Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.\n" }, "enableRateLimitResponseHeaders": { "type": "boolean", "description": "Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\nVault Enterprise allows `/sys/quotas/config` to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only.\n*Available only for Vault Enterprise*.\n" }, "rateLimitExemptPaths": { "type": "array", "items": { "type": "string" }, "description": "Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.\n" } }, "required": [ "absoluteRateLimitExemptPaths", "enableRateLimitAuditLogging", "enableRateLimitResponseHeaders", "rateLimitExemptPaths" ], "inputProperties": { "absoluteRateLimitExemptPaths": { "type": "array", "items": { "type": "string" }, "description": "Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.\n" }, "enableRateLimitAuditLogging": { "type": "boolean", "description": "Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.\n" }, "enableRateLimitResponseHeaders": { "type": "boolean", "description": "Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\nVault Enterprise allows `/sys/quotas/config` to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only.\n*Available only for Vault Enterprise*.\n" }, "rateLimitExemptPaths": { "type": "array", "items": { "type": "string" }, "description": "Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering QuotaConfig resources.\n", "properties": { "absoluteRateLimitExemptPaths": { "type": "array", "items": { "type": "string" }, "description": "Set of absolute paths exempt from all rate limit quotas, qualified from the root of the namespace hierarchy. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, this field is effectively root-managed; administrative namespaces can read returned values but cannot reliably manage them.\n" }, "enableRateLimitAuditLogging": { "type": "boolean", "description": "Enables audit logging for requests rejected by rate limit quotas. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.\n" }, "enableRateLimitResponseHeaders": { "type": "boolean", "description": "Enables rate limit response headers on HTTP responses. Terraform only sends this field when it is explicitly configured. If omitted, Vault keeps its current value.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\nVault Enterprise allows `/sys/quotas/config` to be called from the root or an administrative namespace, but support is asymmetric: administrative namespaces can update the boolean fields, while exempt-path management is effectively root-only.\n*Available only for Vault Enterprise*.\n" }, "rateLimitExemptPaths": { "type": "array", "items": { "type": "string" }, "description": "Set of paths exempt from rate limit quotas relative to the current namespace context. Ordering is ignored. Terraform only sends this field when it is explicitly configured. In practice, exempt-path management is effectively root-only for this endpoint.\n" } }, "type": "object" } }, "vault:index/quotaLeaseCount:QuotaLeaseCount": { "description": "Manage lease count quotas which enforce the number of leases that can be created.\nA lease count quota can be created at the root level or defined on a namespace or mount by\nspecifying a path when creating the quota.\n\nSee [Vault's Documentation](https://www.vaultproject.io/docs/enterprise/lease-count-quotas) for more\ninformation. \n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst global = new vault.QuotaLeaseCount(\"global\", {\n name: \"global\",\n path: \"\",\n maxLeases: 100,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nglobal_ = vault.QuotaLeaseCount(\"global\",\n name=\"global\",\n path=\"\",\n max_leases=100)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @global = new Vault.QuotaLeaseCount(\"global\", new()\n {\n Name = \"global\",\n Path = \"\",\n MaxLeases = 100,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewQuotaLeaseCount(ctx, \"global\", \u0026vault.QuotaLeaseCountArgs{\n\t\t\tName: pulumi.String(\"global\"),\n\t\t\tPath: pulumi.String(\"\"),\n\t\t\tMaxLeases: pulumi.Int(100),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_quotaleasecount\" \"global\" {\n name = \"global\"\n path = \"\"\n max_leases = 100\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.QuotaLeaseCount;\nimport com.pulumi.vault.QuotaLeaseCountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var global = new QuotaLeaseCount(\"global\", QuotaLeaseCountArgs.builder()\n .name(\"global\")\n .path(\"\")\n .maxLeases(100)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n global:\n type: vault:QuotaLeaseCount\n properties:\n name: global\n path: \"\"\n maxLeases: 100\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nLease count quotas can be imported using their names\n\n```sh\n$ pulumi import vault:index/quotaLeaseCount:QuotaLeaseCount global global\n```\n\n", "properties": { "inheritable": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.\n" }, "maxLeases": { "type": "integer", "description": "The maximum number of leases to be allowed by the quota\nrule. The \u003cspan pulumi-lang-nodejs=\"`maxLeases`\" pulumi-lang-dotnet=\"`MaxLeases`\" pulumi-lang-go=\"`maxLeases`\" pulumi-lang-python=\"`max_leases`\" pulumi-lang-yaml=\"`maxLeases`\" pulumi-lang-java=\"`maxLeases`\" pulumi-lang-hcl=\"`max_leases`\"\u003e`maxLeases`\u003c/span\u003e must be positive.\n" }, "name": { "type": "string", "description": "Name of the rate limit quota\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Path of the mount or namespace to apply the quota. A blank path configures a\nglobal rate limit quota. For example `namespace1/` adds a quota to a full namespace,\n`namespace1/auth/userpass` adds a \u003cspan pulumi-lang-nodejs=\"`quota`\" pulumi-lang-dotnet=\"`Quota`\" pulumi-lang-go=\"`quota`\" pulumi-lang-python=\"`quota`\" pulumi-lang-yaml=\"`quota`\" pulumi-lang-java=\"`quota`\" pulumi-lang-hcl=\"`quota`\"\u003e`quota`\u003c/span\u003e to \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e in \u003cspan pulumi-lang-nodejs=\"`namespace1`\" pulumi-lang-dotnet=\"`Namespace1`\" pulumi-lang-go=\"`namespace1`\" pulumi-lang-python=\"`namespace1`\" pulumi-lang-yaml=\"`namespace1`\" pulumi-lang-java=\"`namespace1`\" pulumi-lang-hcl=\"`namespace1`\"\u003e`namespace1`\u003c/span\u003e.\nUpdating this field on an existing quota can have \"moving\" effects. For example, updating\n`auth/userpass` to `namespace1/auth/userpass` moves this quota from being a global mount quota to\na namespace specific mount quota. **Note, namespaces are supported in Enterprise only.**\n" }, "role": { "type": "string", "description": "If set on a quota where \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.\n" } }, "required": [ "maxLeases", "name" ], "inputProperties": { "inheritable": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.\n" }, "maxLeases": { "type": "integer", "description": "The maximum number of leases to be allowed by the quota\nrule. The \u003cspan pulumi-lang-nodejs=\"`maxLeases`\" pulumi-lang-dotnet=\"`MaxLeases`\" pulumi-lang-go=\"`maxLeases`\" pulumi-lang-python=\"`max_leases`\" pulumi-lang-yaml=\"`maxLeases`\" pulumi-lang-java=\"`maxLeases`\" pulumi-lang-hcl=\"`max_leases`\"\u003e`maxLeases`\u003c/span\u003e must be positive.\n" }, "name": { "type": "string", "description": "Name of the rate limit quota\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path of the mount or namespace to apply the quota. A blank path configures a\nglobal rate limit quota. For example `namespace1/` adds a quota to a full namespace,\n`namespace1/auth/userpass` adds a \u003cspan pulumi-lang-nodejs=\"`quota`\" pulumi-lang-dotnet=\"`Quota`\" pulumi-lang-go=\"`quota`\" pulumi-lang-python=\"`quota`\" pulumi-lang-yaml=\"`quota`\" pulumi-lang-java=\"`quota`\" pulumi-lang-hcl=\"`quota`\"\u003e`quota`\u003c/span\u003e to \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e in \u003cspan pulumi-lang-nodejs=\"`namespace1`\" pulumi-lang-dotnet=\"`Namespace1`\" pulumi-lang-go=\"`namespace1`\" pulumi-lang-python=\"`namespace1`\" pulumi-lang-yaml=\"`namespace1`\" pulumi-lang-java=\"`namespace1`\" pulumi-lang-hcl=\"`namespace1`\"\u003e`namespace1`\u003c/span\u003e.\nUpdating this field on an existing quota can have \"moving\" effects. For example, updating\n`auth/userpass` to `namespace1/auth/userpass` moves this quota from being a global mount quota to\na namespace specific mount quota. **Note, namespaces are supported in Enterprise only.**\n" }, "role": { "type": "string", "description": "If set on a quota where \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.\n" } }, "requiredInputs": [ "maxLeases" ], "stateInputs": { "description": "Input properties used for looking up and filtering QuotaLeaseCount resources.\n", "properties": { "inheritable": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.\n" }, "maxLeases": { "type": "integer", "description": "The maximum number of leases to be allowed by the quota\nrule. The \u003cspan pulumi-lang-nodejs=\"`maxLeases`\" pulumi-lang-dotnet=\"`MaxLeases`\" pulumi-lang-go=\"`maxLeases`\" pulumi-lang-python=\"`max_leases`\" pulumi-lang-yaml=\"`maxLeases`\" pulumi-lang-java=\"`maxLeases`\" pulumi-lang-hcl=\"`max_leases`\"\u003e`maxLeases`\u003c/span\u003e must be positive.\n" }, "name": { "type": "string", "description": "Name of the rate limit quota\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path of the mount or namespace to apply the quota. A blank path configures a\nglobal rate limit quota. For example `namespace1/` adds a quota to a full namespace,\n`namespace1/auth/userpass` adds a \u003cspan pulumi-lang-nodejs=\"`quota`\" pulumi-lang-dotnet=\"`Quota`\" pulumi-lang-go=\"`quota`\" pulumi-lang-python=\"`quota`\" pulumi-lang-yaml=\"`quota`\" pulumi-lang-java=\"`quota`\" pulumi-lang-hcl=\"`quota`\"\u003e`quota`\u003c/span\u003e to \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e in \u003cspan pulumi-lang-nodejs=\"`namespace1`\" pulumi-lang-dotnet=\"`Namespace1`\" pulumi-lang-go=\"`namespace1`\" pulumi-lang-python=\"`namespace1`\" pulumi-lang-yaml=\"`namespace1`\" pulumi-lang-java=\"`namespace1`\" pulumi-lang-hcl=\"`namespace1`\"\u003e`namespace1`\u003c/span\u003e.\nUpdating this field on an existing quota can have \"moving\" effects. For example, updating\n`auth/userpass` to `namespace1/auth/userpass` moves this quota from being a global mount quota to\na namespace specific mount quota. **Note, namespaces are supported in Enterprise only.**\n" }, "role": { "type": "string", "description": "If set on a quota where \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.\n" } }, "type": "object" } }, "vault:index/quotaRateLimit:QuotaRateLimit": { "description": "Manage rate limit quotas which enforce API rate limiting using a token bucket algorithm.\nA rate limit quota can be created at the root level or defined on a namespace or mount by\nspecifying a path when creating the quota.\n\nSee [Vault's Documentation](https://www.vaultproject.io/docs/concepts/resource-quotas) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst global = new vault.QuotaRateLimit(\"global\", {\n name: \"global\",\n path: \"\",\n rate: 100,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nglobal_ = vault.QuotaRateLimit(\"global\",\n name=\"global\",\n path=\"\",\n rate=float(100))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @global = new Vault.QuotaRateLimit(\"global\", new()\n {\n Name = \"global\",\n Path = \"\",\n Rate = 100,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewQuotaRateLimit(ctx, \"global\", \u0026vault.QuotaRateLimitArgs{\n\t\t\tName: pulumi.String(\"global\"),\n\t\t\tPath: pulumi.String(\"\"),\n\t\t\tRate: pulumi.Float64(100),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_quotaratelimit\" \"global\" {\n name = \"global\"\n path = \"\"\n rate = 100\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.QuotaRateLimit;\nimport com.pulumi.vault.QuotaRateLimitArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var global = new QuotaRateLimit(\"global\", QuotaRateLimitArgs.builder()\n .name(\"global\")\n .path(\"\")\n .rate(100.0)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n global:\n type: vault:QuotaRateLimit\n properties:\n name: global\n path: \"\"\n rate: 100\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nRate limit quotas can be imported using their names\n\n```sh\n$ pulumi import vault:index/quotaRateLimit:QuotaRateLimit global global\n```\n\n", "properties": { "blockInterval": { "type": "integer", "description": "If set, when a client reaches a rate limit threshold, the client will\nbe prohibited from any further requests until after the 'block_interval' in seconds has elapsed.\n" }, "groupBy": { "type": "string", "description": "Attribute used to group requests for rate limiting. Limits are enforced independently for each\ngroup. Valid \u003cspan pulumi-lang-nodejs=\"`groupBy`\" pulumi-lang-dotnet=\"`GroupBy`\" pulumi-lang-go=\"`groupBy`\" pulumi-lang-python=\"`group_by`\" pulumi-lang-yaml=\"`groupBy`\" pulumi-lang-java=\"`groupBy`\" pulumi-lang-hcl=\"`group_by`\"\u003e`groupBy`\u003c/span\u003e modes are: 1) \u003cspan pulumi-lang-nodejs=\"`ip`\" pulumi-lang-dotnet=\"`Ip`\" pulumi-lang-go=\"`ip`\" pulumi-lang-python=\"`ip`\" pulumi-lang-yaml=\"`ip`\" pulumi-lang-java=\"`ip`\" pulumi-lang-hcl=\"`ip`\"\u003e`ip`\u003c/span\u003e that groups requests by their source IP address (**\u003cspan pulumi-lang-nodejs=\"`groupBy`\" pulumi-lang-dotnet=\"`GroupBy`\" pulumi-lang-go=\"`groupBy`\" pulumi-lang-python=\"`group_by`\" pulumi-lang-yaml=\"`groupBy`\" pulumi-lang-java=\"`groupBy`\" pulumi-lang-hcl=\"`group_by`\"\u003e`groupBy`\u003c/span\u003e defaults to\n\u003cspan pulumi-lang-nodejs=\"`ip`\" pulumi-lang-dotnet=\"`Ip`\" pulumi-lang-go=\"`ip`\" pulumi-lang-python=\"`ip`\" pulumi-lang-yaml=\"`ip`\" pulumi-lang-java=\"`ip`\" pulumi-lang-hcl=\"`ip`\"\u003e`ip`\u003c/span\u003e if unset, which is the only supported mode in community edition**); 2) \u003cspan pulumi-lang-nodejs=\"`none`\" pulumi-lang-dotnet=\"`None`\" pulumi-lang-go=\"`none`\" pulumi-lang-python=\"`none`\" pulumi-lang-yaml=\"`none`\" pulumi-lang-java=\"`none`\" pulumi-lang-hcl=\"`none`\"\u003e`none`\u003c/span\u003e that groups together all requests\nthat match the rate limit quota rule; 3) \u003cspan pulumi-lang-nodejs=\"`entityThenIp`\" pulumi-lang-dotnet=\"`EntityThenIp`\" pulumi-lang-go=\"`entityThenIp`\" pulumi-lang-python=\"`entity_then_ip`\" pulumi-lang-yaml=\"`entityThenIp`\" pulumi-lang-java=\"`entityThenIp`\" pulumi-lang-hcl=\"`entity_then_ip`\"\u003e`entityThenIp`\u003c/span\u003e that groups requests by their entity ID for authenticated\nrequests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not\nconnected to an entity); and 4) \u003cspan pulumi-lang-nodejs=\"`entityThenNone`\" pulumi-lang-dotnet=\"`EntityThenNone`\" pulumi-lang-go=\"`entityThenNone`\" pulumi-lang-python=\"`entity_then_none`\" pulumi-lang-yaml=\"`entityThenNone`\" pulumi-lang-java=\"`entityThenNone`\" pulumi-lang-hcl=\"`entity_then_none`\"\u003e`entityThenNone`\u003c/span\u003e which also groups requests by their entity ID when available, but\nthe rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).\n" }, "inheritable": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.\n" }, "interval": { "type": "integer", "description": "The duration in seconds to enforce rate limiting for.\n" }, "name": { "type": "string", "description": "Name of the rate limit quota\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Path of the mount or namespace to apply the quota. A blank path configures a\nglobal rate limit quota. For example `namespace1/` adds a quota to a full namespace,\n`namespace1/auth/userpass` adds a \u003cspan pulumi-lang-nodejs=\"`quota`\" pulumi-lang-dotnet=\"`Quota`\" pulumi-lang-go=\"`quota`\" pulumi-lang-python=\"`quota`\" pulumi-lang-yaml=\"`quota`\" pulumi-lang-java=\"`quota`\" pulumi-lang-hcl=\"`quota`\"\u003e`quota`\u003c/span\u003e to \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e in \u003cspan pulumi-lang-nodejs=\"`namespace1`\" pulumi-lang-dotnet=\"`Namespace1`\" pulumi-lang-go=\"`namespace1`\" pulumi-lang-python=\"`namespace1`\" pulumi-lang-yaml=\"`namespace1`\" pulumi-lang-java=\"`namespace1`\" pulumi-lang-hcl=\"`namespace1`\"\u003e`namespace1`\u003c/span\u003e.\nUpdating this field on an existing quota can have \"moving\" effects. For example, updating\n`auth/userpass` to `namespace1/auth/userpass` moves this quota from being a global mount quota to\na namespace specific mount quota. **Note, namespaces are supported in Enterprise only.**\n" }, "rate": { "type": "number", "description": "The maximum number of requests at any given second to be allowed by the quota\nrule. The \u003cspan pulumi-lang-nodejs=\"`rate`\" pulumi-lang-dotnet=\"`Rate`\" pulumi-lang-go=\"`rate`\" pulumi-lang-python=\"`rate`\" pulumi-lang-yaml=\"`rate`\" pulumi-lang-java=\"`rate`\" pulumi-lang-hcl=\"`rate`\"\u003e`rate`\u003c/span\u003e must be positive.\n" }, "role": { "type": "string", "description": "If set on a quota where \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.\n" }, "secondaryRate": { "type": "number", "description": "Can only be set for the \u003cspan pulumi-lang-nodejs=\"`groupBy`\" pulumi-lang-dotnet=\"`GroupBy`\" pulumi-lang-go=\"`groupBy`\" pulumi-lang-python=\"`group_by`\" pulumi-lang-yaml=\"`groupBy`\" pulumi-lang-java=\"`groupBy`\" pulumi-lang-hcl=\"`group_by`\"\u003e`groupBy`\u003c/span\u003e modes \u003cspan pulumi-lang-nodejs=\"`entityThenIp`\" pulumi-lang-dotnet=\"`EntityThenIp`\" pulumi-lang-go=\"`entityThenIp`\" pulumi-lang-python=\"`entity_then_ip`\" pulumi-lang-yaml=\"`entityThenIp`\" pulumi-lang-java=\"`entityThenIp`\" pulumi-lang-hcl=\"`entity_then_ip`\"\u003e`entityThenIp`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`entityThenNone`\" pulumi-lang-dotnet=\"`EntityThenNone`\" pulumi-lang-go=\"`entityThenNone`\" pulumi-lang-python=\"`entity_then_none`\" pulumi-lang-yaml=\"`entityThenNone`\" pulumi-lang-java=\"`entityThenNone`\" pulumi-lang-hcl=\"`entity_then_none`\"\u003e`entityThenNone`\u003c/span\u003e. This is\nthe rate limit applied to the requests that fall under the \"ip\" or \"none\" groupings, while the authenticated requests\nthat contain an entity ID are subject to the \u003cspan pulumi-lang-nodejs=\"`rate`\" pulumi-lang-dotnet=\"`Rate`\" pulumi-lang-go=\"`rate`\" pulumi-lang-python=\"`rate`\" pulumi-lang-yaml=\"`rate`\" pulumi-lang-java=\"`rate`\" pulumi-lang-hcl=\"`rate`\"\u003e`rate`\u003c/span\u003e field instead. Defaults to the same value as \u003cspan pulumi-lang-nodejs=\"`rate`\" pulumi-lang-dotnet=\"`Rate`\" pulumi-lang-go=\"`rate`\" pulumi-lang-python=\"`rate`\" pulumi-lang-yaml=\"`rate`\" pulumi-lang-java=\"`rate`\" pulumi-lang-hcl=\"`rate`\"\u003e`rate`\u003c/span\u003e.\n" } }, "required": [ "groupBy", "interval", "name", "rate", "secondaryRate" ], "inputProperties": { "blockInterval": { "type": "integer", "description": "If set, when a client reaches a rate limit threshold, the client will\nbe prohibited from any further requests until after the 'block_interval' in seconds has elapsed.\n" }, "groupBy": { "type": "string", "description": "Attribute used to group requests for rate limiting. Limits are enforced independently for each\ngroup. Valid \u003cspan pulumi-lang-nodejs=\"`groupBy`\" pulumi-lang-dotnet=\"`GroupBy`\" pulumi-lang-go=\"`groupBy`\" pulumi-lang-python=\"`group_by`\" pulumi-lang-yaml=\"`groupBy`\" pulumi-lang-java=\"`groupBy`\" pulumi-lang-hcl=\"`group_by`\"\u003e`groupBy`\u003c/span\u003e modes are: 1) \u003cspan pulumi-lang-nodejs=\"`ip`\" pulumi-lang-dotnet=\"`Ip`\" pulumi-lang-go=\"`ip`\" pulumi-lang-python=\"`ip`\" pulumi-lang-yaml=\"`ip`\" pulumi-lang-java=\"`ip`\" pulumi-lang-hcl=\"`ip`\"\u003e`ip`\u003c/span\u003e that groups requests by their source IP address (**\u003cspan pulumi-lang-nodejs=\"`groupBy`\" pulumi-lang-dotnet=\"`GroupBy`\" pulumi-lang-go=\"`groupBy`\" pulumi-lang-python=\"`group_by`\" pulumi-lang-yaml=\"`groupBy`\" pulumi-lang-java=\"`groupBy`\" pulumi-lang-hcl=\"`group_by`\"\u003e`groupBy`\u003c/span\u003e defaults to\n\u003cspan pulumi-lang-nodejs=\"`ip`\" pulumi-lang-dotnet=\"`Ip`\" pulumi-lang-go=\"`ip`\" pulumi-lang-python=\"`ip`\" pulumi-lang-yaml=\"`ip`\" pulumi-lang-java=\"`ip`\" pulumi-lang-hcl=\"`ip`\"\u003e`ip`\u003c/span\u003e if unset, which is the only supported mode in community edition**); 2) \u003cspan pulumi-lang-nodejs=\"`none`\" pulumi-lang-dotnet=\"`None`\" pulumi-lang-go=\"`none`\" pulumi-lang-python=\"`none`\" pulumi-lang-yaml=\"`none`\" pulumi-lang-java=\"`none`\" pulumi-lang-hcl=\"`none`\"\u003e`none`\u003c/span\u003e that groups together all requests\nthat match the rate limit quota rule; 3) \u003cspan pulumi-lang-nodejs=\"`entityThenIp`\" pulumi-lang-dotnet=\"`EntityThenIp`\" pulumi-lang-go=\"`entityThenIp`\" pulumi-lang-python=\"`entity_then_ip`\" pulumi-lang-yaml=\"`entityThenIp`\" pulumi-lang-java=\"`entityThenIp`\" pulumi-lang-hcl=\"`entity_then_ip`\"\u003e`entityThenIp`\u003c/span\u003e that groups requests by their entity ID for authenticated\nrequests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not\nconnected to an entity); and 4) \u003cspan pulumi-lang-nodejs=\"`entityThenNone`\" pulumi-lang-dotnet=\"`EntityThenNone`\" pulumi-lang-go=\"`entityThenNone`\" pulumi-lang-python=\"`entity_then_none`\" pulumi-lang-yaml=\"`entityThenNone`\" pulumi-lang-java=\"`entityThenNone`\" pulumi-lang-hcl=\"`entity_then_none`\"\u003e`entityThenNone`\u003c/span\u003e which also groups requests by their entity ID when available, but\nthe rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).\n" }, "inheritable": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.\n" }, "interval": { "type": "integer", "description": "The duration in seconds to enforce rate limiting for.\n" }, "name": { "type": "string", "description": "Name of the rate limit quota\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path of the mount or namespace to apply the quota. A blank path configures a\nglobal rate limit quota. For example `namespace1/` adds a quota to a full namespace,\n`namespace1/auth/userpass` adds a \u003cspan pulumi-lang-nodejs=\"`quota`\" pulumi-lang-dotnet=\"`Quota`\" pulumi-lang-go=\"`quota`\" pulumi-lang-python=\"`quota`\" pulumi-lang-yaml=\"`quota`\" pulumi-lang-java=\"`quota`\" pulumi-lang-hcl=\"`quota`\"\u003e`quota`\u003c/span\u003e to \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e in \u003cspan pulumi-lang-nodejs=\"`namespace1`\" pulumi-lang-dotnet=\"`Namespace1`\" pulumi-lang-go=\"`namespace1`\" pulumi-lang-python=\"`namespace1`\" pulumi-lang-yaml=\"`namespace1`\" pulumi-lang-java=\"`namespace1`\" pulumi-lang-hcl=\"`namespace1`\"\u003e`namespace1`\u003c/span\u003e.\nUpdating this field on an existing quota can have \"moving\" effects. For example, updating\n`auth/userpass` to `namespace1/auth/userpass` moves this quota from being a global mount quota to\na namespace specific mount quota. **Note, namespaces are supported in Enterprise only.**\n", "willReplaceOnChanges": true }, "rate": { "type": "number", "description": "The maximum number of requests at any given second to be allowed by the quota\nrule. The \u003cspan pulumi-lang-nodejs=\"`rate`\" pulumi-lang-dotnet=\"`Rate`\" pulumi-lang-go=\"`rate`\" pulumi-lang-python=\"`rate`\" pulumi-lang-yaml=\"`rate`\" pulumi-lang-java=\"`rate`\" pulumi-lang-hcl=\"`rate`\"\u003e`rate`\u003c/span\u003e must be positive.\n" }, "role": { "type": "string", "description": "If set on a quota where \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.\n" }, "secondaryRate": { "type": "number", "description": "Can only be set for the \u003cspan pulumi-lang-nodejs=\"`groupBy`\" pulumi-lang-dotnet=\"`GroupBy`\" pulumi-lang-go=\"`groupBy`\" pulumi-lang-python=\"`group_by`\" pulumi-lang-yaml=\"`groupBy`\" pulumi-lang-java=\"`groupBy`\" pulumi-lang-hcl=\"`group_by`\"\u003e`groupBy`\u003c/span\u003e modes \u003cspan pulumi-lang-nodejs=\"`entityThenIp`\" pulumi-lang-dotnet=\"`EntityThenIp`\" pulumi-lang-go=\"`entityThenIp`\" pulumi-lang-python=\"`entity_then_ip`\" pulumi-lang-yaml=\"`entityThenIp`\" pulumi-lang-java=\"`entityThenIp`\" pulumi-lang-hcl=\"`entity_then_ip`\"\u003e`entityThenIp`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`entityThenNone`\" pulumi-lang-dotnet=\"`EntityThenNone`\" pulumi-lang-go=\"`entityThenNone`\" pulumi-lang-python=\"`entity_then_none`\" pulumi-lang-yaml=\"`entityThenNone`\" pulumi-lang-java=\"`entityThenNone`\" pulumi-lang-hcl=\"`entity_then_none`\"\u003e`entityThenNone`\u003c/span\u003e. This is\nthe rate limit applied to the requests that fall under the \"ip\" or \"none\" groupings, while the authenticated requests\nthat contain an entity ID are subject to the \u003cspan pulumi-lang-nodejs=\"`rate`\" pulumi-lang-dotnet=\"`Rate`\" pulumi-lang-go=\"`rate`\" pulumi-lang-python=\"`rate`\" pulumi-lang-yaml=\"`rate`\" pulumi-lang-java=\"`rate`\" pulumi-lang-hcl=\"`rate`\"\u003e`rate`\u003c/span\u003e field instead. Defaults to the same value as \u003cspan pulumi-lang-nodejs=\"`rate`\" pulumi-lang-dotnet=\"`Rate`\" pulumi-lang-go=\"`rate`\" pulumi-lang-python=\"`rate`\" pulumi-lang-yaml=\"`rate`\" pulumi-lang-java=\"`rate`\" pulumi-lang-hcl=\"`rate`\"\u003e`rate`\u003c/span\u003e.\n" } }, "requiredInputs": [ "rate" ], "stateInputs": { "description": "Input properties used for looking up and filtering QuotaRateLimit resources.\n", "properties": { "blockInterval": { "type": "integer", "description": "If set, when a client reaches a rate limit threshold, the client will\nbe prohibited from any further requests until after the 'block_interval' in seconds has elapsed.\n" }, "groupBy": { "type": "string", "description": "Attribute used to group requests for rate limiting. Limits are enforced independently for each\ngroup. Valid \u003cspan pulumi-lang-nodejs=\"`groupBy`\" pulumi-lang-dotnet=\"`GroupBy`\" pulumi-lang-go=\"`groupBy`\" pulumi-lang-python=\"`group_by`\" pulumi-lang-yaml=\"`groupBy`\" pulumi-lang-java=\"`groupBy`\" pulumi-lang-hcl=\"`group_by`\"\u003e`groupBy`\u003c/span\u003e modes are: 1) \u003cspan pulumi-lang-nodejs=\"`ip`\" pulumi-lang-dotnet=\"`Ip`\" pulumi-lang-go=\"`ip`\" pulumi-lang-python=\"`ip`\" pulumi-lang-yaml=\"`ip`\" pulumi-lang-java=\"`ip`\" pulumi-lang-hcl=\"`ip`\"\u003e`ip`\u003c/span\u003e that groups requests by their source IP address (**\u003cspan pulumi-lang-nodejs=\"`groupBy`\" pulumi-lang-dotnet=\"`GroupBy`\" pulumi-lang-go=\"`groupBy`\" pulumi-lang-python=\"`group_by`\" pulumi-lang-yaml=\"`groupBy`\" pulumi-lang-java=\"`groupBy`\" pulumi-lang-hcl=\"`group_by`\"\u003e`groupBy`\u003c/span\u003e defaults to\n\u003cspan pulumi-lang-nodejs=\"`ip`\" pulumi-lang-dotnet=\"`Ip`\" pulumi-lang-go=\"`ip`\" pulumi-lang-python=\"`ip`\" pulumi-lang-yaml=\"`ip`\" pulumi-lang-java=\"`ip`\" pulumi-lang-hcl=\"`ip`\"\u003e`ip`\u003c/span\u003e if unset, which is the only supported mode in community edition**); 2) \u003cspan pulumi-lang-nodejs=\"`none`\" pulumi-lang-dotnet=\"`None`\" pulumi-lang-go=\"`none`\" pulumi-lang-python=\"`none`\" pulumi-lang-yaml=\"`none`\" pulumi-lang-java=\"`none`\" pulumi-lang-hcl=\"`none`\"\u003e`none`\u003c/span\u003e that groups together all requests\nthat match the rate limit quota rule; 3) \u003cspan pulumi-lang-nodejs=\"`entityThenIp`\" pulumi-lang-dotnet=\"`EntityThenIp`\" pulumi-lang-go=\"`entityThenIp`\" pulumi-lang-python=\"`entity_then_ip`\" pulumi-lang-yaml=\"`entityThenIp`\" pulumi-lang-java=\"`entityThenIp`\" pulumi-lang-hcl=\"`entity_then_ip`\"\u003e`entityThenIp`\u003c/span\u003e that groups requests by their entity ID for authenticated\nrequests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not\nconnected to an entity); and 4) \u003cspan pulumi-lang-nodejs=\"`entityThenNone`\" pulumi-lang-dotnet=\"`EntityThenNone`\" pulumi-lang-go=\"`entityThenNone`\" pulumi-lang-python=\"`entity_then_none`\" pulumi-lang-yaml=\"`entityThenNone`\" pulumi-lang-java=\"`entityThenNone`\" pulumi-lang-hcl=\"`entity_then_none`\"\u003e`entityThenNone`\u003c/span\u003e which also groups requests by their entity ID when available, but\nthe rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).\n" }, "inheritable": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.\n" }, "interval": { "type": "integer", "description": "The duration in seconds to enforce rate limiting for.\n" }, "name": { "type": "string", "description": "Name of the rate limit quota\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path of the mount or namespace to apply the quota. A blank path configures a\nglobal rate limit quota. For example `namespace1/` adds a quota to a full namespace,\n`namespace1/auth/userpass` adds a \u003cspan pulumi-lang-nodejs=\"`quota`\" pulumi-lang-dotnet=\"`Quota`\" pulumi-lang-go=\"`quota`\" pulumi-lang-python=\"`quota`\" pulumi-lang-yaml=\"`quota`\" pulumi-lang-java=\"`quota`\" pulumi-lang-hcl=\"`quota`\"\u003e`quota`\u003c/span\u003e to \u003cspan pulumi-lang-nodejs=\"`userpass`\" pulumi-lang-dotnet=\"`Userpass`\" pulumi-lang-go=\"`userpass`\" pulumi-lang-python=\"`userpass`\" pulumi-lang-yaml=\"`userpass`\" pulumi-lang-java=\"`userpass`\" pulumi-lang-hcl=\"`userpass`\"\u003e`userpass`\u003c/span\u003e in \u003cspan pulumi-lang-nodejs=\"`namespace1`\" pulumi-lang-dotnet=\"`Namespace1`\" pulumi-lang-go=\"`namespace1`\" pulumi-lang-python=\"`namespace1`\" pulumi-lang-yaml=\"`namespace1`\" pulumi-lang-java=\"`namespace1`\" pulumi-lang-hcl=\"`namespace1`\"\u003e`namespace1`\u003c/span\u003e.\nUpdating this field on an existing quota can have \"moving\" effects. For example, updating\n`auth/userpass` to `namespace1/auth/userpass` moves this quota from being a global mount quota to\na namespace specific mount quota. **Note, namespaces are supported in Enterprise only.**\n", "willReplaceOnChanges": true }, "rate": { "type": "number", "description": "The maximum number of requests at any given second to be allowed by the quota\nrule. The \u003cspan pulumi-lang-nodejs=\"`rate`\" pulumi-lang-dotnet=\"`Rate`\" pulumi-lang-go=\"`rate`\" pulumi-lang-python=\"`rate`\" pulumi-lang-yaml=\"`rate`\" pulumi-lang-java=\"`rate`\" pulumi-lang-hcl=\"`rate`\"\u003e`rate`\u003c/span\u003e must be positive.\n" }, "role": { "type": "string", "description": "If set on a quota where \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.\n" }, "secondaryRate": { "type": "number", "description": "Can only be set for the \u003cspan pulumi-lang-nodejs=\"`groupBy`\" pulumi-lang-dotnet=\"`GroupBy`\" pulumi-lang-go=\"`groupBy`\" pulumi-lang-python=\"`group_by`\" pulumi-lang-yaml=\"`groupBy`\" pulumi-lang-java=\"`groupBy`\" pulumi-lang-hcl=\"`group_by`\"\u003e`groupBy`\u003c/span\u003e modes \u003cspan pulumi-lang-nodejs=\"`entityThenIp`\" pulumi-lang-dotnet=\"`EntityThenIp`\" pulumi-lang-go=\"`entityThenIp`\" pulumi-lang-python=\"`entity_then_ip`\" pulumi-lang-yaml=\"`entityThenIp`\" pulumi-lang-java=\"`entityThenIp`\" pulumi-lang-hcl=\"`entity_then_ip`\"\u003e`entityThenIp`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`entityThenNone`\" pulumi-lang-dotnet=\"`EntityThenNone`\" pulumi-lang-go=\"`entityThenNone`\" pulumi-lang-python=\"`entity_then_none`\" pulumi-lang-yaml=\"`entityThenNone`\" pulumi-lang-java=\"`entityThenNone`\" pulumi-lang-hcl=\"`entity_then_none`\"\u003e`entityThenNone`\u003c/span\u003e. This is\nthe rate limit applied to the requests that fall under the \"ip\" or \"none\" groupings, while the authenticated requests\nthat contain an entity ID are subject to the \u003cspan pulumi-lang-nodejs=\"`rate`\" pulumi-lang-dotnet=\"`Rate`\" pulumi-lang-go=\"`rate`\" pulumi-lang-python=\"`rate`\" pulumi-lang-yaml=\"`rate`\" pulumi-lang-java=\"`rate`\" pulumi-lang-hcl=\"`rate`\"\u003e`rate`\u003c/span\u003e field instead. Defaults to the same value as \u003cspan pulumi-lang-nodejs=\"`rate`\" pulumi-lang-dotnet=\"`Rate`\" pulumi-lang-go=\"`rate`\" pulumi-lang-python=\"`rate`\" pulumi-lang-yaml=\"`rate`\" pulumi-lang-java=\"`rate`\" pulumi-lang-hcl=\"`rate`\"\u003e`rate`\u003c/span\u003e.\n" } }, "type": "object" } }, "vault:index/raftAutopilot:RaftAutopilot": { "description": "Autopilot enables automated workflows for managing Raft clusters. The \ncurrent feature set includes 3 main features: Server Stabilization, Dead \nServer Cleanup and State API. **These three features are introduced in \nVault 1.7.**\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst autopilot = new vault.RaftAutopilot(\"autopilot\", {\n cleanupDeadServers: true,\n deadServerLastContactThreshold: \"24h0m0s\",\n lastContactThreshold: \"10s\",\n maxTrailingLogs: 1000,\n minQuorum: 3,\n serverStabilizationTime: \"10s\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nautopilot = vault.RaftAutopilot(\"autopilot\",\n cleanup_dead_servers=True,\n dead_server_last_contact_threshold=\"24h0m0s\",\n last_contact_threshold=\"10s\",\n max_trailing_logs=1000,\n min_quorum=3,\n server_stabilization_time=\"10s\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var autopilot = new Vault.RaftAutopilot(\"autopilot\", new()\n {\n CleanupDeadServers = true,\n DeadServerLastContactThreshold = \"24h0m0s\",\n LastContactThreshold = \"10s\",\n MaxTrailingLogs = 1000,\n MinQuorum = 3,\n ServerStabilizationTime = \"10s\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewRaftAutopilot(ctx, \"autopilot\", \u0026vault.RaftAutopilotArgs{\n\t\t\tCleanupDeadServers: pulumi.Bool(true),\n\t\t\tDeadServerLastContactThreshold: pulumi.String(\"24h0m0s\"),\n\t\t\tLastContactThreshold: pulumi.String(\"10s\"),\n\t\t\tMaxTrailingLogs: pulumi.Int(1000),\n\t\t\tMinQuorum: pulumi.Int(3),\n\t\t\tServerStabilizationTime: pulumi.String(\"10s\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_raftautopilot\" \"autopilot\" {\n cleanup_dead_servers = true\n dead_server_last_contact_threshold = \"24h0m0s\"\n last_contact_threshold = \"10s\"\n max_trailing_logs = 1000\n min_quorum = 3\n server_stabilization_time = \"10s\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.RaftAutopilot;\nimport com.pulumi.vault.RaftAutopilotArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var autopilot = new RaftAutopilot(\"autopilot\", RaftAutopilotArgs.builder()\n .cleanupDeadServers(true)\n .deadServerLastContactThreshold(\"24h0m0s\")\n .lastContactThreshold(\"10s\")\n .maxTrailingLogs(1000)\n .minQuorum(3)\n .serverStabilizationTime(\"10s\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n autopilot:\n type: vault:RaftAutopilot\n properties:\n cleanupDeadServers: true\n deadServerLastContactThreshold: 24h0m0s\n lastContactThreshold: 10s\n maxTrailingLogs: 1000\n minQuorum: 3\n serverStabilizationTime: 10s\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nRaft Autopilot config can be imported using the ID, e.g.\n\n```sh\n$ pulumi import vault:index/raftAutopilot:RaftAutopilot autopilot sys/storage/raft/autopilot/configuration\n```\n\n", "properties": { "cleanupDeadServers": { "type": "boolean", "description": "Specifies whether to remove dead server nodes\nperiodically or when a new server joins. This requires that `min-quorum` is also set.\n" }, "deadServerLastContactThreshold": { "type": "string", "description": "Limit the amount of time a \nserver can go without leader contact before being considered failed. This only takes\neffect when \u003cspan pulumi-lang-nodejs=\"`cleanupDeadServers`\" pulumi-lang-dotnet=\"`CleanupDeadServers`\" pulumi-lang-go=\"`cleanupDeadServers`\" pulumi-lang-python=\"`cleanup_dead_servers`\" pulumi-lang-yaml=\"`cleanupDeadServers`\" pulumi-lang-java=\"`cleanupDeadServers`\" pulumi-lang-hcl=\"`cleanup_dead_servers`\"\u003e`cleanupDeadServers`\u003c/span\u003e is set.\n" }, "disableUpgradeMigration": { "type": "boolean", "description": "Disables automatically upgrading Vault using autopilot. (Enterprise-only)\n" }, "lastContactThreshold": { "type": "string", "description": "Limit the amount of time a server can go \nwithout leader contact before being considered unhealthy.\n" }, "maxTrailingLogs": { "type": "integer", "description": "Maximum number of log entries in the Raft log \nthat a server can be behind its leader before being considered unhealthy.\n" }, "minQuorum": { "type": "integer", "description": "Minimum number of servers allowed in a cluster before \nautopilot can prune dead servers. This should at least be 3. Applicable only for\nvoting nodes.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "serverStabilizationTime": { "type": "string", "description": "Minimum amount of time a server must be \nstable in the 'healthy' state before being added to the cluster.\n" } }, "inputProperties": { "cleanupDeadServers": { "type": "boolean", "description": "Specifies whether to remove dead server nodes\nperiodically or when a new server joins. This requires that `min-quorum` is also set.\n" }, "deadServerLastContactThreshold": { "type": "string", "description": "Limit the amount of time a \nserver can go without leader contact before being considered failed. This only takes\neffect when \u003cspan pulumi-lang-nodejs=\"`cleanupDeadServers`\" pulumi-lang-dotnet=\"`CleanupDeadServers`\" pulumi-lang-go=\"`cleanupDeadServers`\" pulumi-lang-python=\"`cleanup_dead_servers`\" pulumi-lang-yaml=\"`cleanupDeadServers`\" pulumi-lang-java=\"`cleanupDeadServers`\" pulumi-lang-hcl=\"`cleanup_dead_servers`\"\u003e`cleanupDeadServers`\u003c/span\u003e is set.\n" }, "disableUpgradeMigration": { "type": "boolean", "description": "Disables automatically upgrading Vault using autopilot. (Enterprise-only)\n" }, "lastContactThreshold": { "type": "string", "description": "Limit the amount of time a server can go \nwithout leader contact before being considered unhealthy.\n" }, "maxTrailingLogs": { "type": "integer", "description": "Maximum number of log entries in the Raft log \nthat a server can be behind its leader before being considered unhealthy.\n" }, "minQuorum": { "type": "integer", "description": "Minimum number of servers allowed in a cluster before \nautopilot can prune dead servers. This should at least be 3. Applicable only for\nvoting nodes.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "serverStabilizationTime": { "type": "string", "description": "Minimum amount of time a server must be \nstable in the 'healthy' state before being added to the cluster.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering RaftAutopilot resources.\n", "properties": { "cleanupDeadServers": { "type": "boolean", "description": "Specifies whether to remove dead server nodes\nperiodically or when a new server joins. This requires that `min-quorum` is also set.\n" }, "deadServerLastContactThreshold": { "type": "string", "description": "Limit the amount of time a \nserver can go without leader contact before being considered failed. This only takes\neffect when \u003cspan pulumi-lang-nodejs=\"`cleanupDeadServers`\" pulumi-lang-dotnet=\"`CleanupDeadServers`\" pulumi-lang-go=\"`cleanupDeadServers`\" pulumi-lang-python=\"`cleanup_dead_servers`\" pulumi-lang-yaml=\"`cleanupDeadServers`\" pulumi-lang-java=\"`cleanupDeadServers`\" pulumi-lang-hcl=\"`cleanup_dead_servers`\"\u003e`cleanupDeadServers`\u003c/span\u003e is set.\n" }, "disableUpgradeMigration": { "type": "boolean", "description": "Disables automatically upgrading Vault using autopilot. (Enterprise-only)\n" }, "lastContactThreshold": { "type": "string", "description": "Limit the amount of time a server can go \nwithout leader contact before being considered unhealthy.\n" }, "maxTrailingLogs": { "type": "integer", "description": "Maximum number of log entries in the Raft log \nthat a server can be behind its leader before being considered unhealthy.\n" }, "minQuorum": { "type": "integer", "description": "Minimum number of servers allowed in a cluster before \nautopilot can prune dead servers. This should at least be 3. Applicable only for\nvoting nodes.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "serverStabilizationTime": { "type": "string", "description": "Minimum amount of time a server must be \nstable in the 'healthy' state before being added to the cluster.\n" } }, "type": "object" } }, "vault:index/raftSnapshotAgentConfig:RaftSnapshotAgentConfig": { "description": "Creates a Raft Snapshot Agent Configuration for Vault. This configures Vault\nto take regular snapshots of its Raft storage backend and store them in a \nconfigurable location.\n\n**Note** this feature is available only with Vault Enterprise.\n\n\u003e **Important** Most data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Use write-only\narguments for sensitive values when available (for example,\n\u003cspan pulumi-lang-nodejs=\"`awsSecretAccessKeyWo`\" pulumi-lang-dotnet=\"`AwsSecretAccessKeyWo`\" pulumi-lang-go=\"`awsSecretAccessKeyWo`\" pulumi-lang-python=\"`aws_secret_access_key_wo`\" pulumi-lang-yaml=\"`awsSecretAccessKeyWo`\" pulumi-lang-java=\"`awsSecretAccessKeyWo`\" pulumi-lang-hcl=\"`aws_secret_access_key_wo`\"\u003e`awsSecretAccessKeyWo`\u003c/span\u003e) to avoid storing those values in state. Protect\nthese artifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n### Local Storage\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst localBackups = new vault.RaftSnapshotAgentConfig(\"local_backups\", {\n name: \"local\",\n intervalSeconds: 86400,\n retain: 7,\n pathPrefix: \"/opt/vault/snapshots/\",\n storageType: \"local\",\n localMaxSpace: 10000000,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nlocal_backups = vault.RaftSnapshotAgentConfig(\"local_backups\",\n name=\"local\",\n interval_seconds=86400,\n retain=7,\n path_prefix=\"/opt/vault/snapshots/\",\n storage_type=\"local\",\n local_max_space=10000000)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var localBackups = new Vault.RaftSnapshotAgentConfig(\"local_backups\", new()\n {\n Name = \"local\",\n IntervalSeconds = 86400,\n Retain = 7,\n PathPrefix = \"/opt/vault/snapshots/\",\n StorageType = \"local\",\n LocalMaxSpace = 10000000,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewRaftSnapshotAgentConfig(ctx, \"local_backups\", \u0026vault.RaftSnapshotAgentConfigArgs{\n\t\t\tName: pulumi.String(\"local\"),\n\t\t\tIntervalSeconds: pulumi.Int(86400),\n\t\t\tRetain: pulumi.Int(7),\n\t\t\tPathPrefix: pulumi.String(\"/opt/vault/snapshots/\"),\n\t\t\tStorageType: pulumi.String(\"local\"),\n\t\t\tLocalMaxSpace: pulumi.Int(10000000),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_raftsnapshotagentconfig\" \"local_backups\" {\n name = \"local\"\n interval_seconds = 86400 # 24h\n retain = 7\n path_prefix = \"/opt/vault/snapshots/\"\n storage_type = \"local\"\n local_max_space = 10000000\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.RaftSnapshotAgentConfig;\nimport com.pulumi.vault.RaftSnapshotAgentConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var localBackups = new RaftSnapshotAgentConfig(\"localBackups\", RaftSnapshotAgentConfigArgs.builder()\n .name(\"local\")\n .intervalSeconds(86400)\n .retain(7)\n .pathPrefix(\"/opt/vault/snapshots/\")\n .storageType(\"local\")\n .localMaxSpace(10000000)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n localBackups:\n type: vault:RaftSnapshotAgentConfig\n name: local_backups\n properties:\n name: local\n intervalSeconds: 86400 # 24h\n retain: 7\n pathPrefix: /opt/vault/snapshots/\n storageType: local\n localMaxSpace: 1e+07\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Azure BLOB (Shared Key Authentication)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new pulumi.Config();\nconst azureAccountName = config.requireObject\u003cany\u003e(\"azureAccountName\");\nconst azureAccountKey = config.requireObject\u003cany\u003e(\"azureAccountKey\");\nconst azureBackups = new vault.RaftSnapshotAgentConfig(\"azure_backups\", {\n name: \"azure_backup\",\n intervalSeconds: 86400,\n retain: 7,\n pathPrefix: \"/\",\n storageType: \"azure-blob\",\n autoloadEnabled: true,\n azureContainerName: \"vault-blob\",\n azureAccountName: azureAccountName,\n azureAccountKey: azureAccountKey,\n azureAuthMode: \"shared\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = pulumi.Config()\nazure_account_name = config.require_object(\"azureAccountName\")\nazure_account_key = config.require_object(\"azureAccountKey\")\nazure_backups = vault.RaftSnapshotAgentConfig(\"azure_backups\",\n name=\"azure_backup\",\n interval_seconds=86400,\n retain=7,\n path_prefix=\"/\",\n storage_type=\"azure-blob\",\n autoload_enabled=True,\n azure_container_name=\"vault-blob\",\n azure_account_name=azure_account_name,\n azure_account_key=azure_account_key,\n azure_auth_mode=\"shared\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Config();\n var azureAccountName = config.RequireObject\u003cdynamic\u003e(\"azureAccountName\");\n var azureAccountKey = config.RequireObject\u003cdynamic\u003e(\"azureAccountKey\");\n var azureBackups = new Vault.RaftSnapshotAgentConfig(\"azure_backups\", new()\n {\n Name = \"azure_backup\",\n IntervalSeconds = 86400,\n Retain = 7,\n PathPrefix = \"/\",\n StorageType = \"azure-blob\",\n AutoloadEnabled = true,\n AzureContainerName = \"vault-blob\",\n AzureAccountName = azureAccountName,\n AzureAccountKey = azureAccountKey,\n AzureAuthMode = \"shared\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tcfg := config.New(ctx, \"\")\n\t\tvar azureAccountName interface{}\n\t\tcfg.RequireObject(\"azureAccountName\", \u0026azureAccountName)\n\t\tvar azureAccountKey interface{}\n\t\tcfg.RequireObject(\"azureAccountKey\", \u0026azureAccountKey)\n\t\t_, err := vault.NewRaftSnapshotAgentConfig(ctx, \"azure_backups\", \u0026vault.RaftSnapshotAgentConfigArgs{\n\t\t\tName: pulumi.String(\"azure_backup\"),\n\t\t\tIntervalSeconds: pulumi.Int(86400),\n\t\t\tRetain: pulumi.Int(7),\n\t\t\tPathPrefix: pulumi.String(\"/\"),\n\t\t\tStorageType: pulumi.String(\"azure-blob\"),\n\t\t\tAutoloadEnabled: pulumi.Bool(true),\n\t\t\tAzureContainerName: pulumi.String(\"vault-blob\"),\n\t\t\tAzureAccountName: pulumi.Any(azureAccountName),\n\t\t\tAzureAccountKey: pulumi.Any(azureAccountKey),\n\t\t\tAzureAuthMode: pulumi.String(\"shared\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_raftsnapshotagentconfig\" \"azure_backups\" {\n name = \"azure_backup\"\n interval_seconds = 86400 # 24h\n retain = 7\n path_prefix = \"/\"\n storage_type = \"azure-blob\"\n autoload_enabled = true\n # Storage Type Configuration\n azure_container_name = \"vault-blob\"\n azure_account_name = var.azureAccountName\n azure_account_key = var.azureAccountKey\n azure_auth_mode = \"shared\"\n}\nvariable \"azureAccountName\" {\n}\nvariable \"azureAccountKey\" {\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.RaftSnapshotAgentConfig;\nimport com.pulumi.vault.RaftSnapshotAgentConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n final var config = ctx.config();\n final var azureAccountName = config.require(\"azureAccountName\");\n final var azureAccountKey = config.require(\"azureAccountKey\");\n var azureBackups = new RaftSnapshotAgentConfig(\"azureBackups\", RaftSnapshotAgentConfigArgs.builder()\n .name(\"azure_backup\")\n .intervalSeconds(86400)\n .retain(7)\n .pathPrefix(\"/\")\n .storageType(\"azure-blob\")\n .autoloadEnabled(true)\n .azureContainerName(\"vault-blob\")\n .azureAccountName(azureAccountName)\n .azureAccountKey(azureAccountKey)\n .azureAuthMode(\"shared\")\n .build());\n\n }\n}\n```\n```yaml\nconfiguration:\n azureAccountName:\n type: object\n azureAccountKey:\n type: object\nresources:\n azureBackups:\n type: vault:RaftSnapshotAgentConfig\n name: azure_backups\n properties:\n name: azure_backup\n intervalSeconds: 86400 # 24h\n retain: 7\n pathPrefix: /\n storageType: azure-blob\n autoloadEnabled: true # Storage Type Configuration\n azureContainerName: vault-blob\n azureAccountName: ${azureAccountName}\n azureAccountKey: ${azureAccountKey}\n azureAuthMode: shared\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Azure BLOB (Managed Identity Authentication)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new pulumi.Config();\nconst azureAccountName = config.requireObject\u003cany\u003e(\"azureAccountName\");\nconst azureClientId = config.requireObject\u003cany\u003e(\"azureClientId\");\nconst azureManagedIdentity = new vault.RaftSnapshotAgentConfig(\"azure_managed_identity\", {\n name: \"azure_managed\",\n intervalSeconds: 86400,\n retain: 7,\n pathPrefix: \"/\",\n storageType: \"azure-blob\",\n autoloadEnabled: true,\n azureContainerName: \"vault-blob\",\n azureAccountName: azureAccountName,\n azureAuthMode: \"managed\",\n azureClientId: azureClientId,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = pulumi.Config()\nazure_account_name = config.require_object(\"azureAccountName\")\nazure_client_id = config.require_object(\"azureClientId\")\nazure_managed_identity = vault.RaftSnapshotAgentConfig(\"azure_managed_identity\",\n name=\"azure_managed\",\n interval_seconds=86400,\n retain=7,\n path_prefix=\"/\",\n storage_type=\"azure-blob\",\n autoload_enabled=True,\n azure_container_name=\"vault-blob\",\n azure_account_name=azure_account_name,\n azure_auth_mode=\"managed\",\n azure_client_id=azure_client_id)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Config();\n var azureAccountName = config.RequireObject\u003cdynamic\u003e(\"azureAccountName\");\n var azureClientId = config.RequireObject\u003cdynamic\u003e(\"azureClientId\");\n var azureManagedIdentity = new Vault.RaftSnapshotAgentConfig(\"azure_managed_identity\", new()\n {\n Name = \"azure_managed\",\n IntervalSeconds = 86400,\n Retain = 7,\n PathPrefix = \"/\",\n StorageType = \"azure-blob\",\n AutoloadEnabled = true,\n AzureContainerName = \"vault-blob\",\n AzureAccountName = azureAccountName,\n AzureAuthMode = \"managed\",\n AzureClientId = azureClientId,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tcfg := config.New(ctx, \"\")\n\t\tvar azureAccountName interface{}\n\t\tcfg.RequireObject(\"azureAccountName\", \u0026azureAccountName)\n\t\tvar azureClientId interface{}\n\t\tcfg.RequireObject(\"azureClientId\", \u0026azureClientId)\n\t\t_, err := vault.NewRaftSnapshotAgentConfig(ctx, \"azure_managed_identity\", \u0026vault.RaftSnapshotAgentConfigArgs{\n\t\t\tName: pulumi.String(\"azure_managed\"),\n\t\t\tIntervalSeconds: pulumi.Int(86400),\n\t\t\tRetain: pulumi.Int(7),\n\t\t\tPathPrefix: pulumi.String(\"/\"),\n\t\t\tStorageType: pulumi.String(\"azure-blob\"),\n\t\t\tAutoloadEnabled: pulumi.Bool(true),\n\t\t\tAzureContainerName: pulumi.String(\"vault-blob\"),\n\t\t\tAzureAccountName: pulumi.Any(azureAccountName),\n\t\t\tAzureAuthMode: pulumi.String(\"managed\"),\n\t\t\tAzureClientId: pulumi.Any(azureClientId),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_raftsnapshotagentconfig\" \"azure_managed_identity\" {\n name = \"azure_managed\"\n interval_seconds = 86400 # 24h\n retain = 7\n path_prefix = \"/\"\n storage_type = \"azure-blob\"\n autoload_enabled = true\n # Storage Type Configuration\n azure_container_name = \"vault-blob\"\n azure_account_name = var.azureAccountName\n azure_auth_mode = \"managed\"\n azure_client_id = var.azureClientId\n}\nvariable \"azureAccountName\" {\n}\nvariable \"azureClientId\" {\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.RaftSnapshotAgentConfig;\nimport com.pulumi.vault.RaftSnapshotAgentConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n final var config = ctx.config();\n final var azureAccountName = config.require(\"azureAccountName\");\n final var azureClientId = config.require(\"azureClientId\");\n var azureManagedIdentity = new RaftSnapshotAgentConfig(\"azureManagedIdentity\", RaftSnapshotAgentConfigArgs.builder()\n .name(\"azure_managed\")\n .intervalSeconds(86400)\n .retain(7)\n .pathPrefix(\"/\")\n .storageType(\"azure-blob\")\n .autoloadEnabled(true)\n .azureContainerName(\"vault-blob\")\n .azureAccountName(azureAccountName)\n .azureAuthMode(\"managed\")\n .azureClientId(azureClientId)\n .build());\n\n }\n}\n```\n```yaml\nconfiguration:\n azureAccountName:\n type: object\n azureClientId:\n type: object\nresources:\n azureManagedIdentity:\n type: vault:RaftSnapshotAgentConfig\n name: azure_managed_identity\n properties:\n name: azure_managed\n intervalSeconds: 86400 # 24h\n retain: 7\n pathPrefix: /\n storageType: azure-blob\n autoloadEnabled: true # Storage Type Configuration\n azureContainerName: vault-blob\n azureAccountName: ${azureAccountName}\n azureAuthMode: managed\n azureClientId: ${azureClientId}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nRaft Snapshot Agent Configurations can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/raftSnapshotAgentConfig:RaftSnapshotAgentConfig local local\n```\n\n", "properties": { "autoloadEnabled": { "type": "boolean", "description": "Have Vault automatically load the latest snapshot after it is written. This will replace the previously loaded snapshot. Note that this does not mean the snapshot is automatically applied to the cluster, it is just loaded and available for recovery operations.\n**Note:** Not supported with \u003cspan pulumi-lang-nodejs=\"`storageType \" pulumi-lang-dotnet=\"`StorageType \" pulumi-lang-go=\"`storageType \" pulumi-lang-python=\"`storage_type \" pulumi-lang-yaml=\"`storageType \" pulumi-lang-java=\"`storageType \" pulumi-lang-hcl=\"`storage_type \"\u003e`storageType \u003c/span\u003e= \"local\"`.\n\n*Requires Vault Enterprise 1.21.0+*.\n" }, "awsAccessKeyId": { "type": "string", "description": "AWS access key ID." }, "awsS3Bucket": { "type": "string", "description": "S3 bucket to write snapshots to." }, "awsS3DisableTls": { "type": "boolean", "description": "Disable TLS for the S3 endpoint. This should only be used for testing purposes." }, "awsS3EnableKms": { "type": "boolean", "description": "Use KMS to encrypt bucket contents." }, "awsS3Endpoint": { "type": "string", "description": "AWS endpoint. This is typically only set when using a non-AWS S3 implementation like Minio." }, "awsS3ForcePathStyle": { "type": "boolean", "description": "Use the endpoint/bucket URL style instead of bucket.endpoint." }, "awsS3KmsKey": { "type": "string", "description": "Use named KMS key, when aws_s3_enable_kms=true" }, "awsS3Region": { "type": "string", "description": "AWS region bucket is in." }, "awsS3ServerSideEncryption": { "type": "boolean", "description": "Use AES256 to encrypt bucket contents." }, "awsSecretAccessKey": { "type": "string", "description": "AWS secret access key.", "deprecationMessage": "Use\u003cspan pulumi-lang-nodejs=\" awsSecretAccessKeyWo \" pulumi-lang-dotnet=\" AwsSecretAccessKeyWo \" pulumi-lang-go=\" awsSecretAccessKeyWo \" pulumi-lang-python=\" aws_secret_access_key_wo \" pulumi-lang-yaml=\" awsSecretAccessKeyWo \" pulumi-lang-java=\" awsSecretAccessKeyWo \" pulumi-lang-hcl=\" aws_secret_access_key_wo \"\u003e awsSecretAccessKeyWo \u003c/span\u003einstead, which is a write-only attribute that is never stored in state.", "secret": true }, "awsSecretAccessKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nAWS secret access key. Write-only: never stored in state. If\u003cspan pulumi-lang-nodejs=\" secretsWoVersion \" pulumi-lang-dotnet=\" SecretsWoVersion \" pulumi-lang-go=\" secretsWoVersion \" pulumi-lang-python=\" secrets_wo_version \" pulumi-lang-yaml=\" secretsWoVersion \" pulumi-lang-java=\" secretsWoVersion \" pulumi-lang-hcl=\" secrets_wo_version \"\u003e secretsWoVersion \u003c/span\u003eis not set, changes are automatically detected via a hash stored in private state.", "secret": true }, "awsSessionToken": { "type": "string", "description": "AWS session token." }, "azureAccountKey": { "type": "string", "description": "Azure account key. Required when\u003cspan pulumi-lang-nodejs=\" azureAuthMode \" pulumi-lang-dotnet=\" AzureAuthMode \" pulumi-lang-go=\" azureAuthMode \" pulumi-lang-python=\" azure_auth_mode \" pulumi-lang-yaml=\" azureAuthMode \" pulumi-lang-java=\" azureAuthMode \" pulumi-lang-hcl=\" azure_auth_mode \"\u003e azureAuthMode \u003c/span\u003eis 'shared'." }, "azureAccountName": { "type": "string", "description": "Azure account name." }, "azureAuthMode": { "type": "string", "description": "Azure authentication mode. Required for azure-blob storage. Possible values are 'shared', 'managed', or 'environment'. Requires Vault Enterprise 1.18.0+." }, "azureBlobEnvironment": { "type": "string", "description": "Azure blob environment." }, "azureClientId": { "type": "string", "description": "Azure client ID for authentication. Required when\u003cspan pulumi-lang-nodejs=\" azureAuthMode \" pulumi-lang-dotnet=\" AzureAuthMode \" pulumi-lang-go=\" azureAuthMode \" pulumi-lang-python=\" azure_auth_mode \" pulumi-lang-yaml=\" azureAuthMode \" pulumi-lang-java=\" azureAuthMode \" pulumi-lang-hcl=\" azure_auth_mode \"\u003e azureAuthMode \u003c/span\u003eis 'managed'. Requires Vault Enterprise 1.18.0+." }, "azureContainerName": { "type": "string", "description": "Azure container name to write snapshots to." }, "azureEndpoint": { "type": "string", "description": "Azure blob storage endpoint. This is typically only set when using a non-Azure implementation like Azurite." }, "filePrefix": { "type": "string", "description": "Within the directory or bucket\nprefix given by \u003cspan pulumi-lang-nodejs=\"`pathPrefix`\" pulumi-lang-dotnet=\"`PathPrefix`\" pulumi-lang-go=\"`pathPrefix`\" pulumi-lang-python=\"`path_prefix`\" pulumi-lang-yaml=\"`pathPrefix`\" pulumi-lang-java=\"`pathPrefix`\" pulumi-lang-hcl=\"`path_prefix`\"\u003e`pathPrefix`\u003c/span\u003e, the file or object name of snapshot files\nwill start with this string.\n" }, "googleDisableTls": { "type": "boolean", "description": "Disable TLS for the GCS endpoint." }, "googleEndpoint": { "type": "string", "description": "GCS endpoint. This is typically only set when using a non-Google GCS implementation like fake-gcs-server." }, "googleGcsBucket": { "type": "string", "description": "GCS bucket to write snapshots to." }, "googleServiceAccountKey": { "type": "string", "description": "Google service account key in JSON format." }, "intervalSeconds": { "type": "integer", "description": "`\u003crequired\u003e` - Time (in seconds) between snapshots.\n" }, "localMaxSpace": { "type": "integer", "description": "The maximum space, in bytes, to use for snapshots." }, "name": { "type": "string", "description": "`\u003crequired\u003e` – Name of the configuration to modify.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "pathPrefix": { "type": "string", "description": "`\u003crequired\u003e` - For \u003cspan pulumi-lang-nodejs=\"`storageType \" pulumi-lang-dotnet=\"`StorageType \" pulumi-lang-go=\"`storageType \" pulumi-lang-python=\"`storage_type \" pulumi-lang-yaml=\"`storageType \" pulumi-lang-java=\"`storageType \" pulumi-lang-hcl=\"`storage_type \"\u003e`storageType \u003c/span\u003e= \"local\"`, the directory to\nwrite the snapshots in. For cloud storage types, the bucket prefix to use.\nTypes `azure-blob` and `google-gcs` require a trailing `/` (slash).\nTypes \u003cspan pulumi-lang-nodejs=\"`local`\" pulumi-lang-dotnet=\"`Local`\" pulumi-lang-go=\"`local`\" pulumi-lang-python=\"`local`\" pulumi-lang-yaml=\"`local`\" pulumi-lang-java=\"`local`\" pulumi-lang-hcl=\"`local`\"\u003e`local`\u003c/span\u003e and `aws-s3` the trailing `/` is optional.\n" }, "retain": { "type": "integer", "description": "How many snapshots are to be kept; when writing a\nsnapshot, if there are more snapshots already stored than this number, the\noldest ones will be deleted.\n" }, "secretsWoVersion": { "type": "integer", "description": "Version number for write-only secret updates. If not set, the provider automatically detects changes to write-only secrets using a SHA-256 hash stored in private state. If set manually, you control when the secret is updated by incrementing this value." }, "storageType": { "type": "string", "description": "`\u003crequired\u003e` - One of \"local\", \"azure-blob\", \"aws-s3\",\nor \"google-gcs\". The remaining parameters described below are all specific to\nthe selected \u003cspan pulumi-lang-nodejs=\"`storageType`\" pulumi-lang-dotnet=\"`StorageType`\" pulumi-lang-go=\"`storageType`\" pulumi-lang-python=\"`storage_type`\" pulumi-lang-yaml=\"`storageType`\" pulumi-lang-java=\"`storageType`\" pulumi-lang-hcl=\"`storage_type`\"\u003e`storageType`\u003c/span\u003e and prefixed accordingly.\n" } }, "required": [ "filePrefix", "intervalSeconds", "name", "pathPrefix", "retain", "secretsWoVersion", "storageType" ], "inputProperties": { "autoloadEnabled": { "type": "boolean", "description": "Have Vault automatically load the latest snapshot after it is written. This will replace the previously loaded snapshot. Note that this does not mean the snapshot is automatically applied to the cluster, it is just loaded and available for recovery operations.\n**Note:** Not supported with \u003cspan pulumi-lang-nodejs=\"`storageType \" pulumi-lang-dotnet=\"`StorageType \" pulumi-lang-go=\"`storageType \" pulumi-lang-python=\"`storage_type \" pulumi-lang-yaml=\"`storageType \" pulumi-lang-java=\"`storageType \" pulumi-lang-hcl=\"`storage_type \"\u003e`storageType \u003c/span\u003e= \"local\"`.\n\n*Requires Vault Enterprise 1.21.0+*.\n" }, "awsAccessKeyId": { "type": "string", "description": "AWS access key ID." }, "awsS3Bucket": { "type": "string", "description": "S3 bucket to write snapshots to." }, "awsS3DisableTls": { "type": "boolean", "description": "Disable TLS for the S3 endpoint. This should only be used for testing purposes." }, "awsS3EnableKms": { "type": "boolean", "description": "Use KMS to encrypt bucket contents." }, "awsS3Endpoint": { "type": "string", "description": "AWS endpoint. This is typically only set when using a non-AWS S3 implementation like Minio." }, "awsS3ForcePathStyle": { "type": "boolean", "description": "Use the endpoint/bucket URL style instead of bucket.endpoint." }, "awsS3KmsKey": { "type": "string", "description": "Use named KMS key, when aws_s3_enable_kms=true" }, "awsS3Region": { "type": "string", "description": "AWS region bucket is in." }, "awsS3ServerSideEncryption": { "type": "boolean", "description": "Use AES256 to encrypt bucket contents." }, "awsSecretAccessKey": { "type": "string", "description": "AWS secret access key.", "deprecationMessage": "Use\u003cspan pulumi-lang-nodejs=\" awsSecretAccessKeyWo \" pulumi-lang-dotnet=\" AwsSecretAccessKeyWo \" pulumi-lang-go=\" awsSecretAccessKeyWo \" pulumi-lang-python=\" aws_secret_access_key_wo \" pulumi-lang-yaml=\" awsSecretAccessKeyWo \" pulumi-lang-java=\" awsSecretAccessKeyWo \" pulumi-lang-hcl=\" aws_secret_access_key_wo \"\u003e awsSecretAccessKeyWo \u003c/span\u003einstead, which is a write-only attribute that is never stored in state.", "secret": true }, "awsSecretAccessKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nAWS secret access key. Write-only: never stored in state. If\u003cspan pulumi-lang-nodejs=\" secretsWoVersion \" pulumi-lang-dotnet=\" SecretsWoVersion \" pulumi-lang-go=\" secretsWoVersion \" pulumi-lang-python=\" secrets_wo_version \" pulumi-lang-yaml=\" secretsWoVersion \" pulumi-lang-java=\" secretsWoVersion \" pulumi-lang-hcl=\" secrets_wo_version \"\u003e secretsWoVersion \u003c/span\u003eis not set, changes are automatically detected via a hash stored in private state.", "secret": true }, "awsSessionToken": { "type": "string", "description": "AWS session token." }, "azureAccountKey": { "type": "string", "description": "Azure account key. Required when\u003cspan pulumi-lang-nodejs=\" azureAuthMode \" pulumi-lang-dotnet=\" AzureAuthMode \" pulumi-lang-go=\" azureAuthMode \" pulumi-lang-python=\" azure_auth_mode \" pulumi-lang-yaml=\" azureAuthMode \" pulumi-lang-java=\" azureAuthMode \" pulumi-lang-hcl=\" azure_auth_mode \"\u003e azureAuthMode \u003c/span\u003eis 'shared'." }, "azureAccountName": { "type": "string", "description": "Azure account name." }, "azureAuthMode": { "type": "string", "description": "Azure authentication mode. Required for azure-blob storage. Possible values are 'shared', 'managed', or 'environment'. Requires Vault Enterprise 1.18.0+." }, "azureBlobEnvironment": { "type": "string", "description": "Azure blob environment." }, "azureClientId": { "type": "string", "description": "Azure client ID for authentication. Required when\u003cspan pulumi-lang-nodejs=\" azureAuthMode \" pulumi-lang-dotnet=\" AzureAuthMode \" pulumi-lang-go=\" azureAuthMode \" pulumi-lang-python=\" azure_auth_mode \" pulumi-lang-yaml=\" azureAuthMode \" pulumi-lang-java=\" azureAuthMode \" pulumi-lang-hcl=\" azure_auth_mode \"\u003e azureAuthMode \u003c/span\u003eis 'managed'. Requires Vault Enterprise 1.18.0+." }, "azureContainerName": { "type": "string", "description": "Azure container name to write snapshots to." }, "azureEndpoint": { "type": "string", "description": "Azure blob storage endpoint. This is typically only set when using a non-Azure implementation like Azurite." }, "filePrefix": { "type": "string", "description": "Within the directory or bucket\nprefix given by \u003cspan pulumi-lang-nodejs=\"`pathPrefix`\" pulumi-lang-dotnet=\"`PathPrefix`\" pulumi-lang-go=\"`pathPrefix`\" pulumi-lang-python=\"`path_prefix`\" pulumi-lang-yaml=\"`pathPrefix`\" pulumi-lang-java=\"`pathPrefix`\" pulumi-lang-hcl=\"`path_prefix`\"\u003e`pathPrefix`\u003c/span\u003e, the file or object name of snapshot files\nwill start with this string.\n" }, "googleDisableTls": { "type": "boolean", "description": "Disable TLS for the GCS endpoint." }, "googleEndpoint": { "type": "string", "description": "GCS endpoint. This is typically only set when using a non-Google GCS implementation like fake-gcs-server." }, "googleGcsBucket": { "type": "string", "description": "GCS bucket to write snapshots to." }, "googleServiceAccountKey": { "type": "string", "description": "Google service account key in JSON format." }, "intervalSeconds": { "type": "integer", "description": "`\u003crequired\u003e` - Time (in seconds) between snapshots.\n" }, "localMaxSpace": { "type": "integer", "description": "The maximum space, in bytes, to use for snapshots." }, "name": { "type": "string", "description": "`\u003crequired\u003e` – Name of the configuration to modify.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "pathPrefix": { "type": "string", "description": "`\u003crequired\u003e` - For \u003cspan pulumi-lang-nodejs=\"`storageType \" pulumi-lang-dotnet=\"`StorageType \" pulumi-lang-go=\"`storageType \" pulumi-lang-python=\"`storage_type \" pulumi-lang-yaml=\"`storageType \" pulumi-lang-java=\"`storageType \" pulumi-lang-hcl=\"`storage_type \"\u003e`storageType \u003c/span\u003e= \"local\"`, the directory to\nwrite the snapshots in. For cloud storage types, the bucket prefix to use.\nTypes `azure-blob` and `google-gcs` require a trailing `/` (slash).\nTypes \u003cspan pulumi-lang-nodejs=\"`local`\" pulumi-lang-dotnet=\"`Local`\" pulumi-lang-go=\"`local`\" pulumi-lang-python=\"`local`\" pulumi-lang-yaml=\"`local`\" pulumi-lang-java=\"`local`\" pulumi-lang-hcl=\"`local`\"\u003e`local`\u003c/span\u003e and `aws-s3` the trailing `/` is optional.\n" }, "retain": { "type": "integer", "description": "How many snapshots are to be kept; when writing a\nsnapshot, if there are more snapshots already stored than this number, the\noldest ones will be deleted.\n" }, "secretsWoVersion": { "type": "integer", "description": "Version number for write-only secret updates. If not set, the provider automatically detects changes to write-only secrets using a SHA-256 hash stored in private state. If set manually, you control when the secret is updated by incrementing this value." }, "storageType": { "type": "string", "description": "`\u003crequired\u003e` - One of \"local\", \"azure-blob\", \"aws-s3\",\nor \"google-gcs\". The remaining parameters described below are all specific to\nthe selected \u003cspan pulumi-lang-nodejs=\"`storageType`\" pulumi-lang-dotnet=\"`StorageType`\" pulumi-lang-go=\"`storageType`\" pulumi-lang-python=\"`storage_type`\" pulumi-lang-yaml=\"`storageType`\" pulumi-lang-java=\"`storageType`\" pulumi-lang-hcl=\"`storage_type`\"\u003e`storageType`\u003c/span\u003e and prefixed accordingly.\n" } }, "requiredInputs": [ "intervalSeconds", "pathPrefix", "storageType" ], "stateInputs": { "description": "Input properties used for looking up and filtering RaftSnapshotAgentConfig resources.\n", "properties": { "autoloadEnabled": { "type": "boolean", "description": "Have Vault automatically load the latest snapshot after it is written. This will replace the previously loaded snapshot. Note that this does not mean the snapshot is automatically applied to the cluster, it is just loaded and available for recovery operations.\n**Note:** Not supported with \u003cspan pulumi-lang-nodejs=\"`storageType \" pulumi-lang-dotnet=\"`StorageType \" pulumi-lang-go=\"`storageType \" pulumi-lang-python=\"`storage_type \" pulumi-lang-yaml=\"`storageType \" pulumi-lang-java=\"`storageType \" pulumi-lang-hcl=\"`storage_type \"\u003e`storageType \u003c/span\u003e= \"local\"`.\n\n*Requires Vault Enterprise 1.21.0+*.\n" }, "awsAccessKeyId": { "type": "string", "description": "AWS access key ID." }, "awsS3Bucket": { "type": "string", "description": "S3 bucket to write snapshots to." }, "awsS3DisableTls": { "type": "boolean", "description": "Disable TLS for the S3 endpoint. This should only be used for testing purposes." }, "awsS3EnableKms": { "type": "boolean", "description": "Use KMS to encrypt bucket contents." }, "awsS3Endpoint": { "type": "string", "description": "AWS endpoint. This is typically only set when using a non-AWS S3 implementation like Minio." }, "awsS3ForcePathStyle": { "type": "boolean", "description": "Use the endpoint/bucket URL style instead of bucket.endpoint." }, "awsS3KmsKey": { "type": "string", "description": "Use named KMS key, when aws_s3_enable_kms=true" }, "awsS3Region": { "type": "string", "description": "AWS region bucket is in." }, "awsS3ServerSideEncryption": { "type": "boolean", "description": "Use AES256 to encrypt bucket contents." }, "awsSecretAccessKey": { "type": "string", "description": "AWS secret access key.", "deprecationMessage": "Use\u003cspan pulumi-lang-nodejs=\" awsSecretAccessKeyWo \" pulumi-lang-dotnet=\" AwsSecretAccessKeyWo \" pulumi-lang-go=\" awsSecretAccessKeyWo \" pulumi-lang-python=\" aws_secret_access_key_wo \" pulumi-lang-yaml=\" awsSecretAccessKeyWo \" pulumi-lang-java=\" awsSecretAccessKeyWo \" pulumi-lang-hcl=\" aws_secret_access_key_wo \"\u003e awsSecretAccessKeyWo \u003c/span\u003einstead, which is a write-only attribute that is never stored in state.", "secret": true }, "awsSecretAccessKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nAWS secret access key. Write-only: never stored in state. If\u003cspan pulumi-lang-nodejs=\" secretsWoVersion \" pulumi-lang-dotnet=\" SecretsWoVersion \" pulumi-lang-go=\" secretsWoVersion \" pulumi-lang-python=\" secrets_wo_version \" pulumi-lang-yaml=\" secretsWoVersion \" pulumi-lang-java=\" secretsWoVersion \" pulumi-lang-hcl=\" secrets_wo_version \"\u003e secretsWoVersion \u003c/span\u003eis not set, changes are automatically detected via a hash stored in private state.", "secret": true }, "awsSessionToken": { "type": "string", "description": "AWS session token." }, "azureAccountKey": { "type": "string", "description": "Azure account key. Required when\u003cspan pulumi-lang-nodejs=\" azureAuthMode \" pulumi-lang-dotnet=\" AzureAuthMode \" pulumi-lang-go=\" azureAuthMode \" pulumi-lang-python=\" azure_auth_mode \" pulumi-lang-yaml=\" azureAuthMode \" pulumi-lang-java=\" azureAuthMode \" pulumi-lang-hcl=\" azure_auth_mode \"\u003e azureAuthMode \u003c/span\u003eis 'shared'." }, "azureAccountName": { "type": "string", "description": "Azure account name." }, "azureAuthMode": { "type": "string", "description": "Azure authentication mode. Required for azure-blob storage. Possible values are 'shared', 'managed', or 'environment'. Requires Vault Enterprise 1.18.0+." }, "azureBlobEnvironment": { "type": "string", "description": "Azure blob environment." }, "azureClientId": { "type": "string", "description": "Azure client ID for authentication. Required when\u003cspan pulumi-lang-nodejs=\" azureAuthMode \" pulumi-lang-dotnet=\" AzureAuthMode \" pulumi-lang-go=\" azureAuthMode \" pulumi-lang-python=\" azure_auth_mode \" pulumi-lang-yaml=\" azureAuthMode \" pulumi-lang-java=\" azureAuthMode \" pulumi-lang-hcl=\" azure_auth_mode \"\u003e azureAuthMode \u003c/span\u003eis 'managed'. Requires Vault Enterprise 1.18.0+." }, "azureContainerName": { "type": "string", "description": "Azure container name to write snapshots to." }, "azureEndpoint": { "type": "string", "description": "Azure blob storage endpoint. This is typically only set when using a non-Azure implementation like Azurite." }, "filePrefix": { "type": "string", "description": "Within the directory or bucket\nprefix given by \u003cspan pulumi-lang-nodejs=\"`pathPrefix`\" pulumi-lang-dotnet=\"`PathPrefix`\" pulumi-lang-go=\"`pathPrefix`\" pulumi-lang-python=\"`path_prefix`\" pulumi-lang-yaml=\"`pathPrefix`\" pulumi-lang-java=\"`pathPrefix`\" pulumi-lang-hcl=\"`path_prefix`\"\u003e`pathPrefix`\u003c/span\u003e, the file or object name of snapshot files\nwill start with this string.\n" }, "googleDisableTls": { "type": "boolean", "description": "Disable TLS for the GCS endpoint." }, "googleEndpoint": { "type": "string", "description": "GCS endpoint. This is typically only set when using a non-Google GCS implementation like fake-gcs-server." }, "googleGcsBucket": { "type": "string", "description": "GCS bucket to write snapshots to." }, "googleServiceAccountKey": { "type": "string", "description": "Google service account key in JSON format." }, "intervalSeconds": { "type": "integer", "description": "`\u003crequired\u003e` - Time (in seconds) between snapshots.\n" }, "localMaxSpace": { "type": "integer", "description": "The maximum space, in bytes, to use for snapshots." }, "name": { "type": "string", "description": "`\u003crequired\u003e` – Name of the configuration to modify.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "pathPrefix": { "type": "string", "description": "`\u003crequired\u003e` - For \u003cspan pulumi-lang-nodejs=\"`storageType \" pulumi-lang-dotnet=\"`StorageType \" pulumi-lang-go=\"`storageType \" pulumi-lang-python=\"`storage_type \" pulumi-lang-yaml=\"`storageType \" pulumi-lang-java=\"`storageType \" pulumi-lang-hcl=\"`storage_type \"\u003e`storageType \u003c/span\u003e= \"local\"`, the directory to\nwrite the snapshots in. For cloud storage types, the bucket prefix to use.\nTypes `azure-blob` and `google-gcs` require a trailing `/` (slash).\nTypes \u003cspan pulumi-lang-nodejs=\"`local`\" pulumi-lang-dotnet=\"`Local`\" pulumi-lang-go=\"`local`\" pulumi-lang-python=\"`local`\" pulumi-lang-yaml=\"`local`\" pulumi-lang-java=\"`local`\" pulumi-lang-hcl=\"`local`\"\u003e`local`\u003c/span\u003e and `aws-s3` the trailing `/` is optional.\n" }, "retain": { "type": "integer", "description": "How many snapshots are to be kept; when writing a\nsnapshot, if there are more snapshots already stored than this number, the\noldest ones will be deleted.\n" }, "secretsWoVersion": { "type": "integer", "description": "Version number for write-only secret updates. If not set, the provider automatically detects changes to write-only secrets using a SHA-256 hash stored in private state. If set manually, you control when the secret is updated by incrementing this value." }, "storageType": { "type": "string", "description": "`\u003crequired\u003e` - One of \"local\", \"azure-blob\", \"aws-s3\",\nor \"google-gcs\". The remaining parameters described below are all specific to\nthe selected \u003cspan pulumi-lang-nodejs=\"`storageType`\" pulumi-lang-dotnet=\"`StorageType`\" pulumi-lang-go=\"`storageType`\" pulumi-lang-python=\"`storage_type`\" pulumi-lang-yaml=\"`storageType`\" pulumi-lang-java=\"`storageType`\" pulumi-lang-hcl=\"`storage_type`\"\u003e`storageType`\u003c/span\u003e and prefixed accordingly.\n" } }, "type": "object" } }, "vault:index/rgpPolicy:RgpPolicy": { "description": "Provides a resource to manage Role Governing Policy (RGP) via [Sentinel](https://www.vaultproject.io/docs/enterprise/sentinel/index.html).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst allow_all = new vault.RgpPolicy(\"allow-all\", {\n name: \"allow-all\",\n enforcementLevel: \"soft-mandatory\",\n policy: `main = rule {\n true\n}\n`,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nallow_all = vault.RgpPolicy(\"allow-all\",\n name=\"allow-all\",\n enforcement_level=\"soft-mandatory\",\n policy=\"\"\"main = rule {\n true\n}\n\"\"\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var allow_all = new Vault.RgpPolicy(\"allow-all\", new()\n {\n Name = \"allow-all\",\n EnforcementLevel = \"soft-mandatory\",\n Policy = @\"main = rule {\n true\n}\n\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewRgpPolicy(ctx, \"allow-all\", \u0026vault.RgpPolicyArgs{\n\t\t\tName: pulumi.String(\"allow-all\"),\n\t\t\tEnforcementLevel: pulumi.String(\"soft-mandatory\"),\n\t\t\tPolicy: pulumi.String(\"main = rule {\\n true\\n}\\n\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_rgppolicy\" \"allow-all\" {\n name = \"allow-all\"\n enforcement_level = \"soft-mandatory\"\n policy = \"main = rule {\\n true\\n}\\n\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.RgpPolicy;\nimport com.pulumi.vault.RgpPolicyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var allow_all = new RgpPolicy(\"allow-all\", RgpPolicyArgs.builder()\n .name(\"allow-all\")\n .enforcementLevel(\"soft-mandatory\")\n .policy(\"\"\"\nmain = rule {\n true\n}\n \"\"\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n allow-all:\n type: vault:RgpPolicy\n properties:\n name: allow-all\n enforcementLevel: soft-mandatory\n policy: |\n main = rule {\n true\n }\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "enforcementLevel": { "type": "string", "description": "Enforcement level of Sentinel policy. Can be either \u003cspan pulumi-lang-nodejs=\"`advisory`\" pulumi-lang-dotnet=\"`Advisory`\" pulumi-lang-go=\"`advisory`\" pulumi-lang-python=\"`advisory`\" pulumi-lang-yaml=\"`advisory`\" pulumi-lang-java=\"`advisory`\" pulumi-lang-hcl=\"`advisory`\"\u003e`advisory`\u003c/span\u003e or `soft-mandatory` or `hard-mandatory`\n" }, "name": { "type": "string", "description": "The name of the policy\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policy": { "type": "string", "description": "String containing a Sentinel policy\n" } }, "required": [ "enforcementLevel", "name", "policy" ], "inputProperties": { "enforcementLevel": { "type": "string", "description": "Enforcement level of Sentinel policy. Can be either \u003cspan pulumi-lang-nodejs=\"`advisory`\" pulumi-lang-dotnet=\"`Advisory`\" pulumi-lang-go=\"`advisory`\" pulumi-lang-python=\"`advisory`\" pulumi-lang-yaml=\"`advisory`\" pulumi-lang-java=\"`advisory`\" pulumi-lang-hcl=\"`advisory`\"\u003e`advisory`\u003c/span\u003e or `soft-mandatory` or `hard-mandatory`\n" }, "name": { "type": "string", "description": "The name of the policy\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policy": { "type": "string", "description": "String containing a Sentinel policy\n" } }, "requiredInputs": [ "enforcementLevel", "policy" ], "stateInputs": { "description": "Input properties used for looking up and filtering RgpPolicy resources.\n", "properties": { "enforcementLevel": { "type": "string", "description": "Enforcement level of Sentinel policy. Can be either \u003cspan pulumi-lang-nodejs=\"`advisory`\" pulumi-lang-dotnet=\"`Advisory`\" pulumi-lang-go=\"`advisory`\" pulumi-lang-python=\"`advisory`\" pulumi-lang-yaml=\"`advisory`\" pulumi-lang-java=\"`advisory`\" pulumi-lang-hcl=\"`advisory`\"\u003e`advisory`\u003c/span\u003e or `soft-mandatory` or `hard-mandatory`\n" }, "name": { "type": "string", "description": "The name of the policy\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policy": { "type": "string", "description": "String containing a Sentinel policy\n" } }, "type": "object" } }, "vault:index/rotationPolicy:RotationPolicy": { "description": "Provides a resource to manage Rotation Policies.\n\n**Note** this feature is available only in Vault Enterprise 2.0+.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.RotationPolicy(\"example\", {\n name: \"database-admin-retry-policy\",\n maxRetriesPerCycle: 6,\n maxRetryCycles: 3,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.RotationPolicy(\"example\",\n name=\"database-admin-retry-policy\",\n max_retries_per_cycle=6,\n max_retry_cycles=3)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.RotationPolicy(\"example\", new()\n {\n Name = \"database-admin-retry-policy\",\n MaxRetriesPerCycle = 6,\n MaxRetryCycles = 3,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewRotationPolicy(ctx, \"example\", \u0026vault.RotationPolicyArgs{\n\t\t\tName: pulumi.String(\"database-admin-retry-policy\"),\n\t\t\tMaxRetriesPerCycle: pulumi.Int(6),\n\t\t\tMaxRetryCycles: pulumi.Int(3),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_rotationpolicy\" \"example\" {\n name = \"database-admin-retry-policy\"\n max_retries_per_cycle = 6\n max_retry_cycles = 3\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.RotationPolicy;\nimport com.pulumi.vault.RotationPolicyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new RotationPolicy(\"example\", RotationPolicyArgs.builder()\n .name(\"database-admin-retry-policy\")\n .maxRetriesPerCycle(6)\n .maxRetryCycles(3)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:RotationPolicy\n properties:\n name: database-admin-retry-policy\n maxRetriesPerCycle: 6\n maxRetryCycles: 3\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nRotation policies can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:index/rotationPolicy:RotationPolicy example database-admin-retry-policy\n```\n\n", "properties": { "maxRetriesPerCycle": { "type": "integer", "description": "Maximum retries per cycle for this rotation policy.\n" }, "maxRetryCycles": { "type": "integer", "description": "Maximum retry cycles for this rotation policy.\n" }, "name": { "type": "string", "description": "The name of the rotation policy.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "maxRetriesPerCycle", "maxRetryCycles", "name" ], "inputProperties": { "maxRetriesPerCycle": { "type": "integer", "description": "Maximum retries per cycle for this rotation policy.\n" }, "maxRetryCycles": { "type": "integer", "description": "Maximum retry cycles for this rotation policy.\n" }, "name": { "type": "string", "description": "The name of the rotation policy.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "maxRetriesPerCycle", "maxRetryCycles" ], "stateInputs": { "description": "Input properties used for looking up and filtering RotationPolicy resources.\n", "properties": { "maxRetriesPerCycle": { "type": "integer", "description": "Maximum retries per cycle for this rotation policy.\n" }, "maxRetryCycles": { "type": "integer", "description": "Maximum retry cycles for this rotation policy.\n" }, "name": { "type": "string", "description": "The name of the rotation policy.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:index/scepAuthBackendRole:ScepAuthBackendRole": { "description": "Provides a resource to create a role in an [SCEP auth backend within Vault](https://developer.hashicorp.com/vault/docs/auth/scep).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst scep = new vault.AuthBackend(\"scep\", {\n path: \"scep\",\n type: \"scep\",\n});\nconst scepScepAuthBackendRole = new vault.ScepAuthBackendRole(\"scep\", {\n backend: scep.path,\n name: \"scep_challenge\",\n authType: \"static-challenge\",\n challenge: \"well known secret\",\n tokenType: \"batch\",\n tokenTtl: 300,\n tokenMaxTtl: 600,\n tokenPolicies: [\"scep-clients\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nscep = vault.AuthBackend(\"scep\",\n path=\"scep\",\n type=\"scep\")\nscep_scep_auth_backend_role = vault.ScepAuthBackendRole(\"scep\",\n backend=scep.path,\n name=\"scep_challenge\",\n auth_type=\"static-challenge\",\n challenge=\"well known secret\",\n token_type=\"batch\",\n token_ttl=300,\n token_max_ttl=600,\n token_policies=[\"scep-clients\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var scep = new Vault.AuthBackend(\"scep\", new()\n {\n Path = \"scep\",\n Type = \"scep\",\n });\n\n var scepScepAuthBackendRole = new Vault.ScepAuthBackendRole(\"scep\", new()\n {\n Backend = scep.Path,\n Name = \"scep_challenge\",\n AuthType = \"static-challenge\",\n Challenge = \"well known secret\",\n TokenType = \"batch\",\n TokenTtl = 300,\n TokenMaxTtl = 600,\n TokenPolicies = new[]\n {\n \"scep-clients\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tscep, err := vault.NewAuthBackend(ctx, \"scep\", \u0026vault.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"scep\"),\n\t\t\tType: pulumi.String(\"scep\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewScepAuthBackendRole(ctx, \"scep\", \u0026vault.ScepAuthBackendRoleArgs{\n\t\t\tBackend: scep.Path,\n\t\t\tName: pulumi.String(\"scep_challenge\"),\n\t\t\tAuthType: pulumi.String(\"static-challenge\"),\n\t\t\tChallenge: pulumi.String(\"well known secret\"),\n\t\t\tTokenType: pulumi.String(\"batch\"),\n\t\t\tTokenTtl: pulumi.Int(300),\n\t\t\tTokenMaxTtl: pulumi.Int(600),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"scep-clients\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"scep\" {\n path = \"scep\"\n type = \"scep\"\n}\nresource \"vault_scepauthbackendrole\" \"scep\" {\n backend = vault_authbackend.scep.path\n name = \"scep_challenge\"\n auth_type = \"static-challenge\"\n challenge = \"well known secret\"\n token_type = \"batch\"\n token_ttl = 300\n token_max_ttl = 600\n token_policies = [\"scep-clients\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.ScepAuthBackendRole;\nimport com.pulumi.vault.ScepAuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var scep = new AuthBackend(\"scep\", AuthBackendArgs.builder()\n .path(\"scep\")\n .type(\"scep\")\n .build());\n\n var scepScepAuthBackendRole = new ScepAuthBackendRole(\"scepScepAuthBackendRole\", ScepAuthBackendRoleArgs.builder()\n .backend(scep.path())\n .name(\"scep_challenge\")\n .authType(\"static-challenge\")\n .challenge(\"well known secret\")\n .tokenType(\"batch\")\n .tokenTtl(300)\n .tokenMaxTtl(600)\n .tokenPolicies(\"scep-clients\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n scep:\n type: vault:AuthBackend\n properties:\n path: scep\n type: scep\n scepScepAuthBackendRole:\n type: vault:ScepAuthBackendRole\n name: scep\n properties:\n backend: ${scep.path}\n name: scep_challenge\n authType: static-challenge\n challenge: well known secret\n tokenType: batch\n tokenTtl: 300\n tokenMaxTtl: 600\n tokenPolicies:\n - scep-clients\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "authType": { "type": "string", "description": "The authentication type to use. This can be either \"static-challenge\" or \"intune\".\n" }, "backend": { "type": "string", "description": "Path to the mounted SCEP auth backend.\n" }, "challenge": { "type": "string", "description": "The static challenge to use if\u003cspan pulumi-lang-nodejs=\" authType \" pulumi-lang-dotnet=\" AuthType \" pulumi-lang-go=\" authType \" pulumi-lang-python=\" auth_type \" pulumi-lang-yaml=\" authType \" pulumi-lang-java=\" authType \" pulumi-lang-hcl=\" auth_type \"\u003e authType \u003c/span\u003eis \"static-challenge\", not used for other auth types.\n" }, "displayName": { "type": "string" }, "name": { "type": "string", "description": "Name of the role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "authType", "displayName", "name" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "authType": { "type": "string", "description": "The authentication type to use. This can be either \"static-challenge\" or \"intune\".\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "Path to the mounted SCEP auth backend.\n", "willReplaceOnChanges": true }, "challenge": { "type": "string", "description": "The static challenge to use if\u003cspan pulumi-lang-nodejs=\" authType \" pulumi-lang-dotnet=\" AuthType \" pulumi-lang-go=\" authType \" pulumi-lang-python=\" auth_type \" pulumi-lang-yaml=\" authType \" pulumi-lang-java=\" authType \" pulumi-lang-hcl=\" auth_type \"\u003e authType \u003c/span\u003eis \"static-challenge\", not used for other auth types.\n" }, "displayName": { "type": "string" }, "name": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "requiredInputs": [ "authType" ], "stateInputs": { "description": "Input properties used for looking up and filtering ScepAuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "authType": { "type": "string", "description": "The authentication type to use. This can be either \"static-challenge\" or \"intune\".\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "Path to the mounted SCEP auth backend.\n", "willReplaceOnChanges": true }, "challenge": { "type": "string", "description": "The static challenge to use if\u003cspan pulumi-lang-nodejs=\" authType \" pulumi-lang-dotnet=\" AuthType \" pulumi-lang-go=\" authType \" pulumi-lang-python=\" auth_type \" pulumi-lang-yaml=\" authType \" pulumi-lang-java=\" authType \" pulumi-lang-hcl=\" auth_type \"\u003e authType \u003c/span\u003eis \"static-challenge\", not used for other auth types.\n" }, "displayName": { "type": "string" }, "name": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:index/sysConfigCors:SysConfigCors": { "description": "Manages the CORS (Cross-Origin Resource Sharing) configuration for Vault, controlling which origins can make cross-origin requests and which headers are allowed.\n\n\u003e **Important** This resource requires \u003cspan pulumi-lang-nodejs=\"`sudo`\" pulumi-lang-dotnet=\"`Sudo`\" pulumi-lang-go=\"`sudo`\" pulumi-lang-python=\"`sudo`\" pulumi-lang-yaml=\"`sudo`\" pulumi-lang-java=\"`sudo`\" pulumi-lang-hcl=\"`sudo`\"\u003e`sudo`\u003c/span\u003e capability and must be called from the root namespace. CORS configuration does not replicate across Performance Replication clusters in Vault Enterprise.\n\n**Note** This feature is available in Vault 1.14+\n\n## Example Usage\n\n### Enable CORS for specific origins\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.SysConfigCors(\"example\", {\n allowedOrigins: [\n \"http://www.example.com\",\n \"https://app.example.com\",\n ],\n allowedHeaders: [\n \"X-Custom-Header\",\n \"X-Application-ID\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.SysConfigCors(\"example\",\n allowed_origins=[\n \"http://www.example.com\",\n \"https://app.example.com\",\n ],\n allowed_headers=[\n \"X-Custom-Header\",\n \"X-Application-ID\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.SysConfigCors(\"example\", new()\n {\n AllowedOrigins = new[]\n {\n \"http://www.example.com\",\n \"https://app.example.com\",\n },\n AllowedHeaders = new[]\n {\n \"X-Custom-Header\",\n \"X-Application-ID\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewSysConfigCors(ctx, \"example\", \u0026vault.SysConfigCorsArgs{\n\t\t\tAllowedOrigins: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"http://www.example.com\"),\n\t\t\t\tpulumi.String(\"https://app.example.com\"),\n\t\t\t},\n\t\t\tAllowedHeaders: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"X-Custom-Header\"),\n\t\t\t\tpulumi.String(\"X-Application-ID\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_sysconfigcors\" \"example\" {\n allowed_origins = [\"http://www.example.com\", \"https://app.example.com\"]\n allowed_headers = [\"X-Custom-Header\", \"X-Application-ID\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.SysConfigCors;\nimport com.pulumi.vault.SysConfigCorsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new SysConfigCors(\"example\", SysConfigCorsArgs.builder()\n .allowedOrigins( \n \"http://www.example.com\",\n \"https://app.example.com\")\n .allowedHeaders( \n \"X-Custom-Header\",\n \"X-Application-ID\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:SysConfigCors\n properties:\n allowedOrigins:\n - http://www.example.com\n - https://app.example.com\n allowedHeaders:\n - X-Custom-Header\n - X-Application-ID\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Allow all origins (wildcard)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst wildcard = new vault.SysConfigCors(\"wildcard\", {allowedOrigins: [\"*\"]});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nwildcard = vault.SysConfigCors(\"wildcard\", allowed_origins=[\"*\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var wildcard = new Vault.SysConfigCors(\"wildcard\", new()\n {\n AllowedOrigins = new[]\n {\n \"*\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewSysConfigCors(ctx, \"wildcard\", \u0026vault.SysConfigCorsArgs{\n\t\t\tAllowedOrigins: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_sysconfigcors\" \"wildcard\" {\n allowed_origins = [\"*\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.SysConfigCors;\nimport com.pulumi.vault.SysConfigCorsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var wildcard = new SysConfigCors(\"wildcard\", SysConfigCorsArgs.builder()\n .allowedOrigins(\"*\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n wildcard:\n type: vault:SysConfigCors\n properties:\n allowedOrigins:\n - '*'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Production environment configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst production = new vault.SysConfigCors(\"production\", {\n allowedOrigins: [\n \"https://app.example.com\",\n \"https://admin.example.com\",\n \"https://api.example.com\",\n ],\n allowedHeaders: [\n \"X-Custom-Header\",\n \"X-Request-ID\",\n \"X-Application-Version\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nproduction = vault.SysConfigCors(\"production\",\n allowed_origins=[\n \"https://app.example.com\",\n \"https://admin.example.com\",\n \"https://api.example.com\",\n ],\n allowed_headers=[\n \"X-Custom-Header\",\n \"X-Request-ID\",\n \"X-Application-Version\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var production = new Vault.SysConfigCors(\"production\", new()\n {\n AllowedOrigins = new[]\n {\n \"https://app.example.com\",\n \"https://admin.example.com\",\n \"https://api.example.com\",\n },\n AllowedHeaders = new[]\n {\n \"X-Custom-Header\",\n \"X-Request-ID\",\n \"X-Application-Version\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewSysConfigCors(ctx, \"production\", \u0026vault.SysConfigCorsArgs{\n\t\t\tAllowedOrigins: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://app.example.com\"),\n\t\t\t\tpulumi.String(\"https://admin.example.com\"),\n\t\t\t\tpulumi.String(\"https://api.example.com\"),\n\t\t\t},\n\t\t\tAllowedHeaders: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"X-Custom-Header\"),\n\t\t\t\tpulumi.String(\"X-Request-ID\"),\n\t\t\t\tpulumi.String(\"X-Application-Version\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_sysconfigcors\" \"production\" {\n allowed_origins = [\"https://app.example.com\", \"https://admin.example.com\", \"https://api.example.com\"]\n allowed_headers = [\"X-Custom-Header\", \"X-Request-ID\", \"X-Application-Version\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.SysConfigCors;\nimport com.pulumi.vault.SysConfigCorsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var production = new SysConfigCors(\"production\", SysConfigCorsArgs.builder()\n .allowedOrigins( \n \"https://app.example.com\",\n \"https://admin.example.com\",\n \"https://api.example.com\")\n .allowedHeaders( \n \"X-Custom-Header\",\n \"X-Request-ID\",\n \"X-Application-Version\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n production:\n type: vault:SysConfigCors\n properties:\n allowedOrigins:\n - https://app.example.com\n - https://admin.example.com\n - https://api.example.com\n allowedHeaders:\n - X-Custom-Header\n - X-Request-ID\n - X-Application-Version\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Security Considerations\n\n* The wildcard `\"*\"` origin should be used cautiously and typically only in development environments\n* Allowing all origins in production can expose Vault to cross-site request forgery attacks\n* Custom headers should be carefully reviewed to ensure they don't expose sensitive information\n* CORS settings must be configured from the root namespace\n* In Vault Enterprise with Performance Replication, CORS configuration does not replicate across clusters - each secondary cluster must have its CORS configuration set independently\n* To disable CORS, delete the resource using `terraform destroy` or remove it from your configuration. There is no `enabled = false` option\n\n## API Documentation\n\nFor more information on the Vault CORS configuration API, see the [Vault API documentation](https://developer.hashicorp.com/vault/api-docs/system/config-cors).\n\n## Import\n\nCORS configuration can be imported using the fixed ID `sys/config/cors`:\n\n```sh\n$ pulumi import vault:index/sysConfigCors:SysConfigCors example sys/config/cors\n```\n\n", "properties": { "allowedHeaders": { "type": "array", "items": { "type": "string" }, "description": "Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:\n- `Content-Type`\n- `X-Requested-With`\n- `X-Vault-AWS-IAM-Server-ID`\n- `X-Vault-MFA`\n- `X-Vault-No-Request-Forwarding`\n- `X-Vault-Wrap-Format`\n- `X-Vault-Wrap-TTL`\n- `X-Vault-Policy-Override`\n- `Authorization`\n- `X-Vault-Token`\n" }, "allowedOrigins": { "type": "array", "items": { "type": "string" }, "description": "Set of origins permitted to make cross-origin requests. Use `\"*\"` as the only value to allow all origins. Must contain at least one origin.\n" }, "enabled": { "type": "boolean", "description": "(Computed) Whether CORS is currently enabled. Vault automatically sets this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e when \u003cspan pulumi-lang-nodejs=\"`allowedOrigins`\" pulumi-lang-dotnet=\"`AllowedOrigins`\" pulumi-lang-go=\"`allowedOrigins`\" pulumi-lang-python=\"`allowed_origins`\" pulumi-lang-yaml=\"`allowedOrigins`\" pulumi-lang-java=\"`allowedOrigins`\" pulumi-lang-hcl=\"`allowed_origins`\"\u003e`allowedOrigins`\u003c/span\u003e is configured, and \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e when CORS is deleted.\n" } }, "required": [ "allowedOrigins", "enabled" ], "inputProperties": { "allowedHeaders": { "type": "array", "items": { "type": "string" }, "description": "Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:\n- `Content-Type`\n- `X-Requested-With`\n- `X-Vault-AWS-IAM-Server-ID`\n- `X-Vault-MFA`\n- `X-Vault-No-Request-Forwarding`\n- `X-Vault-Wrap-Format`\n- `X-Vault-Wrap-TTL`\n- `X-Vault-Policy-Override`\n- `Authorization`\n- `X-Vault-Token`\n" }, "allowedOrigins": { "type": "array", "items": { "type": "string" }, "description": "Set of origins permitted to make cross-origin requests. Use `\"*\"` as the only value to allow all origins. Must contain at least one origin.\n" } }, "requiredInputs": [ "allowedOrigins" ], "stateInputs": { "description": "Input properties used for looking up and filtering SysConfigCors resources.\n", "properties": { "allowedHeaders": { "type": "array", "items": { "type": "string" }, "description": "Set of additional custom headers allowed on cross-origin requests. Vault automatically includes standard headers, so only specify custom headers here. The standard headers that are always included are:\n- `Content-Type`\n- `X-Requested-With`\n- `X-Vault-AWS-IAM-Server-ID`\n- `X-Vault-MFA`\n- `X-Vault-No-Request-Forwarding`\n- `X-Vault-Wrap-Format`\n- `X-Vault-Wrap-TTL`\n- `X-Vault-Policy-Override`\n- `Authorization`\n- `X-Vault-Token`\n" }, "allowedOrigins": { "type": "array", "items": { "type": "string" }, "description": "Set of origins permitted to make cross-origin requests. Use `\"*\"` as the only value to allow all origins. Must contain at least one origin.\n" }, "enabled": { "type": "boolean", "description": "(Computed) Whether CORS is currently enabled. Vault automatically sets this to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e when \u003cspan pulumi-lang-nodejs=\"`allowedOrigins`\" pulumi-lang-dotnet=\"`AllowedOrigins`\" pulumi-lang-go=\"`allowedOrigins`\" pulumi-lang-python=\"`allowed_origins`\" pulumi-lang-yaml=\"`allowedOrigins`\" pulumi-lang-java=\"`allowedOrigins`\" pulumi-lang-hcl=\"`allowed_origins`\"\u003e`allowedOrigins`\u003c/span\u003e is configured, and \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e when CORS is deleted.\n" } }, "type": "object" } }, "vault:index/token:Token": { "description": "Provides a resource to generate a vault token with its options. The token renewing is supported through optional\narguments.\n\nThe token used by Terraform will require update access to the `auth/token/lookup-accessor`\npath to create tokens and the `auth/token/revoke-accessor` path in Vault to\ndestroy a token.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.Token(\"example\", {\n roleName: \"app\",\n policies: [\n \"policy1\",\n \"policy2\",\n ],\n renewable: true,\n ttl: \"24h\",\n renewMinLease: 43200,\n renewIncrement: 86400,\n metadata: {\n purpose: \"service-account\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.Token(\"example\",\n role_name=\"app\",\n policies=[\n \"policy1\",\n \"policy2\",\n ],\n renewable=True,\n ttl=\"24h\",\n renew_min_lease=43200,\n renew_increment=86400,\n metadata={\n \"purpose\": \"service-account\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Token(\"example\", new()\n {\n RoleName = \"app\",\n Policies = new[]\n {\n \"policy1\",\n \"policy2\",\n },\n Renewable = true,\n Ttl = \"24h\",\n RenewMinLease = 43200,\n RenewIncrement = 86400,\n Metadata = \n {\n { \"purpose\", \"service-account\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewToken(ctx, \"example\", \u0026vault.TokenArgs{\n\t\t\tRoleName: pulumi.String(\"app\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"policy1\"),\n\t\t\t\tpulumi.String(\"policy2\"),\n\t\t\t},\n\t\t\tRenewable: pulumi.Bool(true),\n\t\t\tTtl: pulumi.String(\"24h\"),\n\t\t\tRenewMinLease: pulumi.Int(43200),\n\t\t\tRenewIncrement: pulumi.Int(86400),\n\t\t\tMetadata: pulumi.StringMap{\n\t\t\t\t\"purpose\": pulumi.String(\"service-account\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_token\" \"example\" {\n role_name = \"app\"\n policies = [\"policy1\", \"policy2\"]\n renewable = true\n ttl = \"24h\"\n renew_min_lease = 43200\n renew_increment = 86400\n metadata = {\n \"purpose\" = \"service-account\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Token;\nimport com.pulumi.vault.TokenArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new Token(\"example\", TokenArgs.builder()\n .roleName(\"app\")\n .policies( \n \"policy1\",\n \"policy2\")\n .renewable(true)\n .ttl(\"24h\")\n .renewMinLease(43200)\n .renewIncrement(86400)\n .metadata(Map.of(\"purpose\", \"service-account\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:Token\n properties:\n roleName: app\n policies:\n - policy1\n - policy2\n renewable: true\n ttl: 24h\n renewMinLease: 43200\n renewIncrement: 86400\n metadata:\n purpose: service-account\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nTokens can be imported using its \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e as accessor id, e.g.\n\n```sh\n$ pulumi import vault:index/token:Token example \u003caccessor_id\u003e\n```\n\n", "properties": { "clientToken": { "type": "string", "description": "String containing the client token if stored in present file\n", "secret": true }, "displayName": { "type": "string", "description": "String containing the token display name\n" }, "explicitMaxTtl": { "type": "string", "description": "The explicit max TTL of this token. This is specified as a numeric string with suffix like \"30s\" ro \"5m\"\n" }, "leaseDuration": { "type": "integer", "description": "String containing the token lease duration if present in state file\n" }, "leaseStarted": { "type": "string", "description": "String containing the token lease started time if present in state file\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Metadata to be set on this token\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "noDefaultPolicy": { "type": "boolean", "description": "Flag to not attach the default policy to this token\n" }, "noParent": { "type": "boolean", "description": "Flag to create a token without parent\n" }, "numUses": { "type": "integer", "description": "The number of allowed uses of this token\n" }, "period": { "type": "string", "description": "The period of this token. This is specified as a numeric string with suffix like \"30s\" ro \"5m\"\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies to attach to this token\n" }, "renewIncrement": { "type": "integer", "description": "The renew increment. This is specified in seconds\n" }, "renewMinLease": { "type": "integer", "description": "The minimal lease to renew this token\n" }, "renewable": { "type": "boolean", "description": "Flag to allow to renew this token\n" }, "roleName": { "type": "string", "description": "The token role name\n" }, "ttl": { "type": "string", "description": "The TTL period of this token. This is specified as a numeric string with suffix like \"30s\" ro \"5m\"\n" }, "wrappedToken": { "type": "string", "description": "The client wrapped token.", "secret": true }, "wrappingAccessor": { "type": "string", "description": "The client wrapping accessor.", "secret": true }, "wrappingTtl": { "type": "string", "description": "The TTL period of the wrapped token." } }, "required": [ "clientToken", "leaseDuration", "leaseStarted", "noParent", "numUses", "renewable", "wrappedToken", "wrappingAccessor" ], "inputProperties": { "displayName": { "type": "string", "description": "String containing the token display name\n", "willReplaceOnChanges": true }, "explicitMaxTtl": { "type": "string", "description": "The explicit max TTL of this token. This is specified as a numeric string with suffix like \"30s\" ro \"5m\"\n", "willReplaceOnChanges": true }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Metadata to be set on this token\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "noDefaultPolicy": { "type": "boolean", "description": "Flag to not attach the default policy to this token\n", "willReplaceOnChanges": true }, "noParent": { "type": "boolean", "description": "Flag to create a token without parent\n", "willReplaceOnChanges": true }, "numUses": { "type": "integer", "description": "The number of allowed uses of this token\n", "willReplaceOnChanges": true }, "period": { "type": "string", "description": "The period of this token. This is specified as a numeric string with suffix like \"30s\" ro \"5m\"\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies to attach to this token\n", "willReplaceOnChanges": true }, "renewIncrement": { "type": "integer", "description": "The renew increment. This is specified in seconds\n" }, "renewMinLease": { "type": "integer", "description": "The minimal lease to renew this token\n" }, "renewable": { "type": "boolean", "description": "Flag to allow to renew this token\n", "willReplaceOnChanges": true }, "roleName": { "type": "string", "description": "The token role name\n", "willReplaceOnChanges": true }, "ttl": { "type": "string", "description": "The TTL period of this token. This is specified as a numeric string with suffix like \"30s\" ro \"5m\"\n", "willReplaceOnChanges": true }, "wrappingTtl": { "type": "string", "description": "The TTL period of the wrapped token." } }, "stateInputs": { "description": "Input properties used for looking up and filtering Token resources.\n", "properties": { "clientToken": { "type": "string", "description": "String containing the client token if stored in present file\n", "secret": true }, "displayName": { "type": "string", "description": "String containing the token display name\n", "willReplaceOnChanges": true }, "explicitMaxTtl": { "type": "string", "description": "The explicit max TTL of this token. This is specified as a numeric string with suffix like \"30s\" ro \"5m\"\n", "willReplaceOnChanges": true }, "leaseDuration": { "type": "integer", "description": "String containing the token lease duration if present in state file\n" }, "leaseStarted": { "type": "string", "description": "String containing the token lease started time if present in state file\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Metadata to be set on this token\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "noDefaultPolicy": { "type": "boolean", "description": "Flag to not attach the default policy to this token\n", "willReplaceOnChanges": true }, "noParent": { "type": "boolean", "description": "Flag to create a token without parent\n", "willReplaceOnChanges": true }, "numUses": { "type": "integer", "description": "The number of allowed uses of this token\n", "willReplaceOnChanges": true }, "period": { "type": "string", "description": "The period of this token. This is specified as a numeric string with suffix like \"30s\" ro \"5m\"\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of policies to attach to this token\n", "willReplaceOnChanges": true }, "renewIncrement": { "type": "integer", "description": "The renew increment. This is specified in seconds\n" }, "renewMinLease": { "type": "integer", "description": "The minimal lease to renew this token\n" }, "renewable": { "type": "boolean", "description": "Flag to allow to renew this token\n", "willReplaceOnChanges": true }, "roleName": { "type": "string", "description": "The token role name\n", "willReplaceOnChanges": true }, "ttl": { "type": "string", "description": "The TTL period of this token. This is specified as a numeric string with suffix like \"30s\" ro \"5m\"\n", "willReplaceOnChanges": true }, "wrappedToken": { "type": "string", "description": "The client wrapped token.", "secret": true }, "wrappingAccessor": { "type": "string", "description": "The client wrapping accessor.", "secret": true }, "wrappingTtl": { "type": "string", "description": "The TTL period of the wrapped token." } }, "type": "object" } }, "vault:index/userpassAuthBackendUser:UserpassAuthBackendUser": { "description": "Manages a user for the [Userpass auth method](https://developer.hashicorp.com/vault/docs/auth/userpass) in Vault.\n\n## API Behavior\n\nThis resource manages Userpass users via the [`POST /auth/\u003cmount\u003e/users/\u003cusername\u003e`](https://developer.hashicorp.com/vault/api-docs/auth/userpass#create-update-user) endpoint for all create and update operations, including changes to passwords and token-related settings.\n\n## Example Usage\n\n### Password-Based User With Token Settings\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst userpass = new vault.AuthBackend(\"userpass\", {\n type: \"userpass\",\n path: \"userpass\",\n});\nconst user = new vault.UserpassAuthBackendUser(\"user\", {\n mount: userpass.path,\n username: \"example-user\",\n passwordWo: \"initial-password\",\n passwordWoVersion: 1,\n tokenPolicies: [\n \"default\",\n \"dev\",\n ],\n tokenTtl: 3600,\n tokenMaxTtl: 7200,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nuserpass = vault.AuthBackend(\"userpass\",\n type=\"userpass\",\n path=\"userpass\")\nuser = vault.UserpassAuthBackendUser(\"user\",\n mount=userpass.path,\n username=\"example-user\",\n password_wo=\"initial-password\",\n password_wo_version=1,\n token_policies=[\n \"default\",\n \"dev\",\n ],\n token_ttl=3600,\n token_max_ttl=7200)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var userpass = new Vault.AuthBackend(\"userpass\", new()\n {\n Type = \"userpass\",\n Path = \"userpass\",\n });\n\n var user = new Vault.UserpassAuthBackendUser(\"user\", new()\n {\n Mount = userpass.Path,\n Username = \"example-user\",\n PasswordWo = \"initial-password\",\n PasswordWoVersion = 1,\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n },\n TokenTtl = 3600,\n TokenMaxTtl = 7200,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tuserpass, err := vault.NewAuthBackend(ctx, \"userpass\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"userpass\"),\n\t\t\tPath: pulumi.String(\"userpass\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewUserpassAuthBackendUser(ctx, \"user\", \u0026vault.UserpassAuthBackendUserArgs{\n\t\t\tMount: userpass.Path,\n\t\t\tUsername: pulumi.String(\"example-user\"),\n\t\t\tPasswordWo: pulumi.String(\"initial-password\"),\n\t\t\tPasswordWoVersion: pulumi.Int(1),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t},\n\t\t\tTokenTtl: pulumi.Int(3600),\n\t\t\tTokenMaxTtl: pulumi.Int(7200),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"userpass\" {\n type = \"userpass\"\n path = \"userpass\"\n}\nresource \"vault_userpassauthbackenduser\" \"user\" {\n mount = vault_authbackend.userpass.path\n username = \"example-user\"\n password_wo = \"initial-password\"\n password_wo_version = 1\n token_policies = [\"default\", \"dev\"]\n token_ttl = 3600\n token_max_ttl = 7200\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.UserpassAuthBackendUser;\nimport com.pulumi.vault.UserpassAuthBackendUserArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var userpass = new AuthBackend(\"userpass\", AuthBackendArgs.builder()\n .type(\"userpass\")\n .path(\"userpass\")\n .build());\n\n var user = new UserpassAuthBackendUser(\"user\", UserpassAuthBackendUserArgs.builder()\n .mount(userpass.path())\n .username(\"example-user\")\n .passwordWo(\"initial-password\")\n .passwordWoVersion(1)\n .tokenPolicies( \n \"default\",\n \"dev\")\n .tokenTtl(3600)\n .tokenMaxTtl(7200)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n userpass:\n type: vault:AuthBackend\n properties:\n type: userpass\n path: userpass\n user:\n type: vault:UserpassAuthBackendUser\n properties:\n mount: ${userpass.path}\n username: example-user\n passwordWo: initial-password\n passwordWoVersion: 1\n tokenPolicies:\n - default\n - dev\n tokenTtl: 3600\n tokenMaxTtl: 7200\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Bcrypt Password Hash User\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst userWithHash = new vault.UserpassAuthBackendUser(\"user_with_hash\", {\n mount: userpass.path,\n username: \"example-user-hash\",\n passwordHashWo: \"$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW\",\n passwordHashWoVersion: 1,\n tokenPolicies: [\n \"default\",\n \"dev\",\n ],\n tokenTtl: 3600,\n tokenMaxTtl: 7200,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nuser_with_hash = vault.UserpassAuthBackendUser(\"user_with_hash\",\n mount=userpass[\"path\"],\n username=\"example-user-hash\",\n password_hash_wo=\"$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW\",\n password_hash_wo_version=1,\n token_policies=[\n \"default\",\n \"dev\",\n ],\n token_ttl=3600,\n token_max_ttl=7200)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var userWithHash = new Vault.UserpassAuthBackendUser(\"user_with_hash\", new()\n {\n Mount = userpass.Path,\n Username = \"example-user-hash\",\n PasswordHashWo = \"$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW\",\n PasswordHashWoVersion = 1,\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n },\n TokenTtl = 3600,\n TokenMaxTtl = 7200,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := vault.NewUserpassAuthBackendUser(ctx, \"user_with_hash\", \u0026vault.UserpassAuthBackendUserArgs{\n\t\t\tMount: pulumi.Any(userpass.Path),\n\t\t\tUsername: pulumi.String(\"example-user-hash\"),\n\t\t\tPasswordHashWo: pulumi.String(\"$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW\"),\n\t\t\tPasswordHashWoVersion: pulumi.Int(1),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t},\n\t\t\tTokenTtl: pulumi.Int(3600),\n\t\t\tTokenMaxTtl: pulumi.Int(7200),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_userpassauthbackenduser\" \"user_with_hash\" {\n mount = userpass.path\n username = \"example-user-hash\"\n password_hash_wo = \"$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW\"\n password_hash_wo_version = 1\n token_policies = [\"default\", \"dev\"]\n token_ttl = 3600\n token_max_ttl = 7200\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.UserpassAuthBackendUser;\nimport com.pulumi.vault.UserpassAuthBackendUserArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var userWithHash = new UserpassAuthBackendUser(\"userWithHash\", UserpassAuthBackendUserArgs.builder()\n .mount(userpass.path())\n .username(\"example-user-hash\")\n .passwordHashWo(\"$2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW\")\n .passwordHashWoVersion(1)\n .tokenPolicies( \n \"default\",\n \"dev\")\n .tokenTtl(3600)\n .tokenMaxTtl(7200)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n userWithHash:\n type: vault:UserpassAuthBackendUser\n name: user_with_hash\n properties:\n mount: ${userpass.path}\n username: example-user-hash\n passwordHashWo: $2a$10$V1HAj0oLIhJtqkj3w0zGx.fjMxmVnY2m0sI4GTiD6W69eCi7epTzW\n passwordHashWoVersion: 1\n tokenPolicies:\n - default\n - dev\n tokenTtl: 3600\n tokenMaxTtl: 7200\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Namespaced User (Vault Enterprise)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.Namespace(\"test\", {path: \"ns-team-a\"});\nconst userpassNs = new vault.AuthBackend(\"userpass_ns\", {\n type: \"userpass\",\n path: \"userpass-ns\",\n namespace: test.path,\n});\nconst userNamespaced = new vault.UserpassAuthBackendUser(\"user_namespaced\", {\n namespace: test.path,\n mount: userpassNs.path,\n username: \"example-user-ns\",\n passwordWo: \"initial-password\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.Namespace(\"test\", path=\"ns-team-a\")\nuserpass_ns = vault.AuthBackend(\"userpass_ns\",\n type=\"userpass\",\n path=\"userpass-ns\",\n namespace=test.path)\nuser_namespaced = vault.UserpassAuthBackendUser(\"user_namespaced\",\n namespace=test.path,\n mount=userpass_ns.path,\n username=\"example-user-ns\",\n password_wo=\"initial-password\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Namespace(\"test\", new()\n {\n Path = \"ns-team-a\",\n });\n\n var userpassNs = new Vault.AuthBackend(\"userpass_ns\", new()\n {\n Type = \"userpass\",\n Path = \"userpass-ns\",\n Namespace = test.Path,\n });\n\n var userNamespaced = new Vault.UserpassAuthBackendUser(\"user_namespaced\", new()\n {\n Namespace = test.Path,\n Mount = userpassNs.Path,\n Username = \"example-user-ns\",\n PasswordWo = \"initial-password\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttest, err := vault.NewNamespace(ctx, \"test\", \u0026vault.NamespaceArgs{\n\t\t\tPath: pulumi.String(\"ns-team-a\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tuserpassNs, err := vault.NewAuthBackend(ctx, \"userpass_ns\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"userpass\"),\n\t\t\tPath: pulumi.String(\"userpass-ns\"),\n\t\t\tNamespace: test.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewUserpassAuthBackendUser(ctx, \"user_namespaced\", \u0026vault.UserpassAuthBackendUserArgs{\n\t\t\tNamespace: test.Path,\n\t\t\tMount: userpassNs.Path,\n\t\t\tUsername: pulumi.String(\"example-user-ns\"),\n\t\t\tPasswordWo: pulumi.String(\"initial-password\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_namespace\" \"test\" {\n path = \"ns-team-a\"\n}\nresource \"vault_authbackend\" \"userpass_ns\" {\n type = \"userpass\"\n path = \"userpass-ns\"\n namespace = vault_namespace.test.path\n}\nresource \"vault_userpassauthbackenduser\" \"user_namespaced\" {\n namespace = vault_namespace.test.path\n mount = vault_authbackend.userpass_ns.path\n username = \"example-user-ns\"\n password_wo = \"initial-password\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Namespace;\nimport com.pulumi.vault.NamespaceArgs;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.UserpassAuthBackendUser;\nimport com.pulumi.vault.UserpassAuthBackendUserArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new Namespace(\"test\", NamespaceArgs.builder()\n .path(\"ns-team-a\")\n .build());\n\n var userpassNs = new AuthBackend(\"userpassNs\", AuthBackendArgs.builder()\n .type(\"userpass\")\n .path(\"userpass-ns\")\n .namespace(test.path())\n .build());\n\n var userNamespaced = new UserpassAuthBackendUser(\"userNamespaced\", UserpassAuthBackendUserArgs.builder()\n .namespace(test.path())\n .mount(userpassNs.path())\n .username(\"example-user-ns\")\n .passwordWo(\"initial-password\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:Namespace\n properties:\n path: ns-team-a\n userpassNs:\n type: vault:AuthBackend\n name: userpass_ns\n properties:\n type: userpass\n path: userpass-ns\n namespace: ${test.path}\n userNamespaced:\n type: vault:UserpassAuthBackendUser\n name: user_namespaced\n properties:\n namespace: ${test.path}\n mount: ${userpassNs.path}\n username: example-user-ns\n passwordWo: initial-password\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Invalid Configuration Examples (Do Not Apply)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\n```\n```python\nimport pulumi\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n }\n}\n```\n```yaml\n{}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nUserpass auth backend users can be imported using the path, e.g.\n\n```sh\n$ pulumi import vault:index/userpassAuthBackendUser:UserpassAuthBackendUser user auth/userpass/users/example-user\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "mount": { "type": "string", "description": "Mount path for the Userpass auth engine in Vault.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordHashWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nPre-hashed password for this user in bcrypt format.Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e. Available in Vault 1.17 and later.\n", "secret": true }, "passwordHashWoVersion": { "type": "integer", "description": "Version counter for the \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e field.\nSince write-only values are not stored in state, Terraform cannot detect when the password hash changes. Increment this value whenever you update \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e to ensure the new password hash is sent to Vault.Must be used with \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e.\n\nExactly one of \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e must be specified.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nPassword for this user.\nThis value is never read back from Vault or stored in Terraform state.\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field.\nSince write-only values are not stored in state, Terraform cannot detect when the password changes.\nIncrement this value whenever you update \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e to ensure the new password is sent to Vault.\nMust be used with \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "username": { "type": "string", "description": "Username for this Userpass user.\n" } }, "required": [ "mount", "tokenType", "username" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "mount": { "type": "string", "description": "Mount path for the Userpass auth engine in Vault.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordHashWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nPre-hashed password for this user in bcrypt format.Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e. Available in Vault 1.17 and later.\n", "secret": true }, "passwordHashWoVersion": { "type": "integer", "description": "Version counter for the \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e field.\nSince write-only values are not stored in state, Terraform cannot detect when the password hash changes. Increment this value whenever you update \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e to ensure the new password hash is sent to Vault.Must be used with \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e.\n\nExactly one of \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e must be specified.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nPassword for this user.\nThis value is never read back from Vault or stored in Terraform state.\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field.\nSince write-only values are not stored in state, Terraform cannot detect when the password changes.\nIncrement this value whenever you update \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e to ensure the new password is sent to Vault.\nMust be used with \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "username": { "type": "string", "description": "Username for this Userpass user.\n" } }, "requiredInputs": [ "mount", "username" ], "stateInputs": { "description": "Input properties used for looking up and filtering UserpassAuthBackendUser resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "mount": { "type": "string", "description": "Mount path for the Userpass auth engine in Vault.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordHashWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nPre-hashed password for this user in bcrypt format.Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e. Available in Vault 1.17 and later.\n", "secret": true }, "passwordHashWoVersion": { "type": "integer", "description": "Version counter for the \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e field.\nSince write-only values are not stored in state, Terraform cannot detect when the password hash changes. Increment this value whenever you update \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e to ensure the new password hash is sent to Vault.Must be used with \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e.\n\nExactly one of \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`passwordHashWo`\" pulumi-lang-dotnet=\"`PasswordHashWo`\" pulumi-lang-go=\"`passwordHashWo`\" pulumi-lang-python=\"`password_hash_wo`\" pulumi-lang-yaml=\"`passwordHashWo`\" pulumi-lang-java=\"`passwordHashWo`\" pulumi-lang-hcl=\"`password_hash_wo`\"\u003e`passwordHashWo`\u003c/span\u003e must be specified.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nPassword for this user.\nThis value is never read back from Vault or stored in Terraform state.\n", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "Version counter for the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field.\nSince write-only values are not stored in state, Terraform cannot detect when the password changes.\nIncrement this value whenever you update \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e to ensure the new password is sent to Vault.\nMust be used with \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "username": { "type": "string", "description": "Username for this Userpass user.\n" } }, "type": "object" } }, "vault:jwt/authBackend:AuthBackend": { "description": "Provides a resource for managing an\n[JWT auth backend within Vault](https://www.vaultproject.io/docs/auth/jwt.html).\n\n## Example Usage\n\nManage JWT auth backend:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.jwt.AuthBackend(\"example\", {\n description: \"Demonstration of the Terraform JWT auth backend\",\n path: \"jwt\",\n oidcDiscoveryUrl: \"https://myco.auth0.com/\",\n boundIssuer: \"https://myco.auth0.com/\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.jwt.AuthBackend(\"example\",\n description=\"Demonstration of the Terraform JWT auth backend\",\n path=\"jwt\",\n oidc_discovery_url=\"https://myco.auth0.com/\",\n bound_issuer=\"https://myco.auth0.com/\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Jwt.AuthBackend(\"example\", new()\n {\n Description = \"Demonstration of the Terraform JWT auth backend\",\n Path = \"jwt\",\n OidcDiscoveryUrl = \"https://myco.auth0.com/\",\n BoundIssuer = \"https://myco.auth0.com/\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/jwt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := jwt.NewAuthBackend(ctx, \"example\", \u0026jwt.AuthBackendArgs{\n\t\t\tDescription: pulumi.String(\"Demonstration of the Terraform JWT auth backend\"),\n\t\t\tPath: pulumi.String(\"jwt\"),\n\t\t\tOidcDiscoveryUrl: pulumi.String(\"https://myco.auth0.com/\"),\n\t\t\tBoundIssuer: pulumi.String(\"https://myco.auth0.com/\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_jwt_authbackend\" \"example\" {\n description = \"Demonstration of the Terraform JWT auth backend\"\n path = \"jwt\"\n oidc_discovery_url = \"https://myco.auth0.com/\"\n bound_issuer = \"https://myco.auth0.com/\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.jwt.AuthBackend;\nimport com.pulumi.vault.jwt.AuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .description(\"Demonstration of the Terraform JWT auth backend\")\n .path(\"jwt\")\n .oidcDiscoveryUrl(\"https://myco.auth0.com/\")\n .boundIssuer(\"https://myco.auth0.com/\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:jwt:AuthBackend\n properties:\n description: Demonstration of the Terraform JWT auth backend\n path: jwt\n oidcDiscoveryUrl: https://myco.auth0.com/\n boundIssuer: https://myco.auth0.com/\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nManage OIDC auth backend:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.jwt.AuthBackend(\"example\", {\n description: \"Demonstration of the Terraform JWT auth backend\",\n path: \"oidc\",\n type: \"oidc\",\n oidcDiscoveryUrl: \"https://myco.auth0.com/\",\n oidcClientId: \"1234567890\",\n oidcClientSecret: \"secret123456\",\n boundIssuer: \"https://myco.auth0.com/\",\n tune: {\n listingVisibility: \"unauth\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.jwt.AuthBackend(\"example\",\n description=\"Demonstration of the Terraform JWT auth backend\",\n path=\"oidc\",\n type=\"oidc\",\n oidc_discovery_url=\"https://myco.auth0.com/\",\n oidc_client_id=\"1234567890\",\n oidc_client_secret=\"secret123456\",\n bound_issuer=\"https://myco.auth0.com/\",\n tune={\n \"listing_visibility\": \"unauth\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Jwt.AuthBackend(\"example\", new()\n {\n Description = \"Demonstration of the Terraform JWT auth backend\",\n Path = \"oidc\",\n Type = \"oidc\",\n OidcDiscoveryUrl = \"https://myco.auth0.com/\",\n OidcClientId = \"1234567890\",\n OidcClientSecret = \"secret123456\",\n BoundIssuer = \"https://myco.auth0.com/\",\n Tune = new Vault.Jwt.Inputs.AuthBackendTuneArgs\n {\n ListingVisibility = \"unauth\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/jwt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := jwt.NewAuthBackend(ctx, \"example\", \u0026jwt.AuthBackendArgs{\n\t\t\tDescription: pulumi.String(\"Demonstration of the Terraform JWT auth backend\"),\n\t\t\tPath: pulumi.String(\"oidc\"),\n\t\t\tType: pulumi.String(\"oidc\"),\n\t\t\tOidcDiscoveryUrl: pulumi.String(\"https://myco.auth0.com/\"),\n\t\t\tOidcClientId: pulumi.String(\"1234567890\"),\n\t\t\tOidcClientSecret: pulumi.String(\"secret123456\"),\n\t\t\tBoundIssuer: pulumi.String(\"https://myco.auth0.com/\"),\n\t\t\tTune: \u0026jwt.AuthBackendTuneArgs{\n\t\t\t\tListingVisibility: pulumi.String(\"unauth\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_jwt_authbackend\" \"example\" {\n description = \"Demonstration of the Terraform JWT auth backend\"\n path = \"oidc\"\n type = \"oidc\"\n oidc_discovery_url = \"https://myco.auth0.com/\"\n oidc_client_id = \"1234567890\"\n oidc_client_secret = \"secret123456\"\n bound_issuer = \"https://myco.auth0.com/\"\n tune = {\n listing_visibility = \"unauth\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.jwt.AuthBackend;\nimport com.pulumi.vault.jwt.AuthBackendArgs;\nimport com.pulumi.vault.jwt.inputs.AuthBackendTuneArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .description(\"Demonstration of the Terraform JWT auth backend\")\n .path(\"oidc\")\n .type(\"oidc\")\n .oidcDiscoveryUrl(\"https://myco.auth0.com/\")\n .oidcClientId(\"1234567890\")\n .oidcClientSecret(\"secret123456\")\n .boundIssuer(\"https://myco.auth0.com/\")\n .tune(AuthBackendTuneArgs.builder()\n .listingVisibility(\"unauth\")\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:jwt:AuthBackend\n properties:\n description: Demonstration of the Terraform JWT auth backend\n path: oidc\n type: oidc\n oidcDiscoveryUrl: https://myco.auth0.com/\n oidcClientId: '1234567890'\n oidcClientSecret: secret123456\n boundIssuer: https://myco.auth0.com/\n tune:\n listingVisibility: unauth\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nManage OIDC auth backend with write-only secret (recommended):\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.jwt.AuthBackend(\"example\", {\n description: \"Demonstration of the Terraform JWT auth backend\",\n path: \"oidc\",\n type: \"oidc\",\n oidcDiscoveryUrl: \"https://myco.auth0.com/\",\n oidcClientId: \"1234567890\",\n oidcClientSecretWo: \"secret123456\",\n oidcClientSecretWoVersion: 1,\n boundIssuer: \"https://myco.auth0.com/\",\n tune: {\n listingVisibility: \"unauth\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.jwt.AuthBackend(\"example\",\n description=\"Demonstration of the Terraform JWT auth backend\",\n path=\"oidc\",\n type=\"oidc\",\n oidc_discovery_url=\"https://myco.auth0.com/\",\n oidc_client_id=\"1234567890\",\n oidc_client_secret_wo=\"secret123456\",\n oidc_client_secret_wo_version=1,\n bound_issuer=\"https://myco.auth0.com/\",\n tune={\n \"listing_visibility\": \"unauth\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Jwt.AuthBackend(\"example\", new()\n {\n Description = \"Demonstration of the Terraform JWT auth backend\",\n Path = \"oidc\",\n Type = \"oidc\",\n OidcDiscoveryUrl = \"https://myco.auth0.com/\",\n OidcClientId = \"1234567890\",\n OidcClientSecretWo = \"secret123456\",\n OidcClientSecretWoVersion = 1,\n BoundIssuer = \"https://myco.auth0.com/\",\n Tune = new Vault.Jwt.Inputs.AuthBackendTuneArgs\n {\n ListingVisibility = \"unauth\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/jwt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := jwt.NewAuthBackend(ctx, \"example\", \u0026jwt.AuthBackendArgs{\n\t\t\tDescription: pulumi.String(\"Demonstration of the Terraform JWT auth backend\"),\n\t\t\tPath: pulumi.String(\"oidc\"),\n\t\t\tType: pulumi.String(\"oidc\"),\n\t\t\tOidcDiscoveryUrl: pulumi.String(\"https://myco.auth0.com/\"),\n\t\t\tOidcClientId: pulumi.String(\"1234567890\"),\n\t\t\tOidcClientSecretWo: pulumi.String(\"secret123456\"),\n\t\t\tOidcClientSecretWoVersion: pulumi.Int(1),\n\t\t\tBoundIssuer: pulumi.String(\"https://myco.auth0.com/\"),\n\t\t\tTune: \u0026jwt.AuthBackendTuneArgs{\n\t\t\t\tListingVisibility: pulumi.String(\"unauth\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_jwt_authbackend\" \"example\" {\n description = \"Demonstration of the Terraform JWT auth backend\"\n path = \"oidc\"\n type = \"oidc\"\n oidc_discovery_url = \"https://myco.auth0.com/\"\n oidc_client_id = \"1234567890\"\n oidc_client_secret_wo = \"secret123456\"\n oidc_client_secret_wo_version = 1 # Increment to update the secret\n bound_issuer = \"https://myco.auth0.com/\"\n tune = {\n listing_visibility = \"unauth\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.jwt.AuthBackend;\nimport com.pulumi.vault.jwt.AuthBackendArgs;\nimport com.pulumi.vault.jwt.inputs.AuthBackendTuneArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .description(\"Demonstration of the Terraform JWT auth backend\")\n .path(\"oidc\")\n .type(\"oidc\")\n .oidcDiscoveryUrl(\"https://myco.auth0.com/\")\n .oidcClientId(\"1234567890\")\n .oidcClientSecretWo(\"secret123456\")\n .oidcClientSecretWoVersion(1)\n .boundIssuer(\"https://myco.auth0.com/\")\n .tune(AuthBackendTuneArgs.builder()\n .listingVisibility(\"unauth\")\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:jwt:AuthBackend\n properties:\n description: Demonstration of the Terraform JWT auth backend\n path: oidc\n type: oidc\n oidcDiscoveryUrl: https://myco.auth0.com/\n oidcClientId: '1234567890'\n oidcClientSecretWo: secret123456\n oidcClientSecretWoVersion: 1 # Increment to update the secret\n boundIssuer: https://myco.auth0.com/\n tune:\n listingVisibility: unauth\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nConfiguring the auth backend with a `provider_config:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gsuite = new vault.jwt.AuthBackend(\"gsuite\", {\n description: \"OIDC backend\",\n oidcDiscoveryUrl: \"https://accounts.google.com\",\n path: \"oidc\",\n type: \"oidc\",\n providerConfig: {\n provider: \"gsuite\",\n fetch_groups: \"true\",\n fetch_user_info: \"true\",\n groups_recurse_max_depth: \"1\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ngsuite = vault.jwt.AuthBackend(\"gsuite\",\n description=\"OIDC backend\",\n oidc_discovery_url=\"https://accounts.google.com\",\n path=\"oidc\",\n type=\"oidc\",\n provider_config={\n \"provider\": \"gsuite\",\n \"fetch_groups\": \"true\",\n \"fetch_user_info\": \"true\",\n \"groups_recurse_max_depth\": \"1\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gsuite = new Vault.Jwt.AuthBackend(\"gsuite\", new()\n {\n Description = \"OIDC backend\",\n OidcDiscoveryUrl = \"https://accounts.google.com\",\n Path = \"oidc\",\n Type = \"oidc\",\n ProviderConfig = \n {\n { \"provider\", \"gsuite\" },\n { \"fetch_groups\", \"true\" },\n { \"fetch_user_info\", \"true\" },\n { \"groups_recurse_max_depth\", \"1\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/jwt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := jwt.NewAuthBackend(ctx, \"gsuite\", \u0026jwt.AuthBackendArgs{\n\t\t\tDescription: pulumi.String(\"OIDC backend\"),\n\t\t\tOidcDiscoveryUrl: pulumi.String(\"https://accounts.google.com\"),\n\t\t\tPath: pulumi.String(\"oidc\"),\n\t\t\tType: pulumi.String(\"oidc\"),\n\t\t\tProviderConfig: pulumi.StringMap{\n\t\t\t\t\"provider\": pulumi.String(\"gsuite\"),\n\t\t\t\t\"fetch_groups\": pulumi.String(\"true\"),\n\t\t\t\t\"fetch_user_info\": pulumi.String(\"true\"),\n\t\t\t\t\"groups_recurse_max_depth\": pulumi.String(\"1\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_jwt_authbackend\" \"gsuite\" {\n description = \"OIDC backend\"\n oidc_discovery_url = \"https://accounts.google.com\"\n path = \"oidc\"\n type = \"oidc\"\n provider_config = {\n \"provider\" = \"gsuite\"\n \"fetch_groups\" = true\n \"fetch_user_info\" = true\n \"groups_recurse_max_depth\" = 1\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.jwt.AuthBackend;\nimport com.pulumi.vault.jwt.AuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gsuite = new AuthBackend(\"gsuite\", AuthBackendArgs.builder()\n .description(\"OIDC backend\")\n .oidcDiscoveryUrl(\"https://accounts.google.com\")\n .path(\"oidc\")\n .type(\"oidc\")\n .providerConfig(Map.ofEntries(\n Map.entry(\"provider\", \"gsuite\"),\n Map.entry(\"fetch_groups\", \"true\"),\n Map.entry(\"fetch_user_info\", \"true\"),\n Map.entry(\"groups_recurse_max_depth\", \"1\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gsuite:\n type: vault:jwt:AuthBackend\n properties:\n description: OIDC backend\n oidcDiscoveryUrl: https://accounts.google.com\n path: oidc\n type: oidc\n providerConfig:\n provider: gsuite\n fetch_groups: true\n fetch_user_info: true\n groups_recurse_max_depth: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nConfiguring the auth backend with Okta provider(requires Vault 2.2.0+):\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst okta = new vault.jwt.AuthBackend(\"okta\", {\n description: \"OIDC backend\",\n oidcDiscoveryUrl: \"https://mycompany.okta.com/oauth2/default\",\n path: \"oidc\",\n type: \"oidc\",\n providerConfig: {\n provider: \"okta\",\n fetch_groups: \"true\",\n org_url: \"https://mycompany.okta.com\",\n api_token: \"12345\",\n groups_cap: \"200\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nokta = vault.jwt.AuthBackend(\"okta\",\n description=\"OIDC backend\",\n oidc_discovery_url=\"https://mycompany.okta.com/oauth2/default\",\n path=\"oidc\",\n type=\"oidc\",\n provider_config={\n \"provider\": \"okta\",\n \"fetch_groups\": \"true\",\n \"org_url\": \"https://mycompany.okta.com\",\n \"api_token\": \"12345\",\n \"groups_cap\": \"200\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var okta = new Vault.Jwt.AuthBackend(\"okta\", new()\n {\n Description = \"OIDC backend\",\n OidcDiscoveryUrl = \"https://mycompany.okta.com/oauth2/default\",\n Path = \"oidc\",\n Type = \"oidc\",\n ProviderConfig = \n {\n { \"provider\", \"okta\" },\n { \"fetch_groups\", \"true\" },\n { \"org_url\", \"https://mycompany.okta.com\" },\n { \"api_token\", \"12345\" },\n { \"groups_cap\", \"200\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/jwt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := jwt.NewAuthBackend(ctx, \"okta\", \u0026jwt.AuthBackendArgs{\n\t\t\tDescription: pulumi.String(\"OIDC backend\"),\n\t\t\tOidcDiscoveryUrl: pulumi.String(\"https://mycompany.okta.com/oauth2/default\"),\n\t\t\tPath: pulumi.String(\"oidc\"),\n\t\t\tType: pulumi.String(\"oidc\"),\n\t\t\tProviderConfig: pulumi.StringMap{\n\t\t\t\t\"provider\": pulumi.String(\"okta\"),\n\t\t\t\t\"fetch_groups\": pulumi.String(\"true\"),\n\t\t\t\t\"org_url\": pulumi.String(\"https://mycompany.okta.com\"),\n\t\t\t\t\"api_token\": pulumi.String(\"12345\"),\n\t\t\t\t\"groups_cap\": pulumi.String(\"200\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_jwt_authbackend\" \"okta\" {\n description = \"OIDC backend\"\n oidc_discovery_url = \"https://mycompany.okta.com/oauth2/default\"\n path = \"oidc\"\n type = \"oidc\"\n provider_config = {\n \"provider\" = \"okta\"\n \"fetch_groups\" = true\n \"org_url\" = \"https://mycompany.okta.com\"\n \"api_token\" = \"12345\"\n \"groups_cap\" = 200\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.jwt.AuthBackend;\nimport com.pulumi.vault.jwt.AuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var okta = new AuthBackend(\"okta\", AuthBackendArgs.builder()\n .description(\"OIDC backend\")\n .oidcDiscoveryUrl(\"https://mycompany.okta.com/oauth2/default\")\n .path(\"oidc\")\n .type(\"oidc\")\n .providerConfig(Map.ofEntries(\n Map.entry(\"provider\", \"okta\"),\n Map.entry(\"fetch_groups\", \"true\"),\n Map.entry(\"org_url\", \"https://mycompany.okta.com\"),\n Map.entry(\"api_token\", \"12345\"),\n Map.entry(\"groups_cap\", \"200\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n okta:\n type: vault:jwt:AuthBackend\n properties:\n description: OIDC backend\n oidcDiscoveryUrl: https://mycompany.okta.com/oauth2/default\n path: oidc\n type: oidc\n providerConfig:\n provider: okta\n fetch_groups: true\n org_url: https://mycompany.okta.com\n api_token: '12345'\n groups_cap: 200\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e - (Optional) Write-only Client Secret used for OIDC backends. This value will **never** be stored in Terraform state. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`oidcClientSecret`\" pulumi-lang-dotnet=\"`OidcClientSecret`\" pulumi-lang-go=\"`oidcClientSecret`\" pulumi-lang-python=\"`oidc_client_secret`\" pulumi-lang-yaml=\"`oidcClientSecret`\" pulumi-lang-java=\"`oidcClientSecret`\" pulumi-lang-hcl=\"`oidc_client_secret`\"\u003e`oidcClientSecret`\u003c/span\u003e. Must be used with \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWoVersion`\" pulumi-lang-dotnet=\"`OidcClientSecretWoVersion`\" pulumi-lang-go=\"`oidcClientSecretWoVersion`\" pulumi-lang-python=\"`oidc_client_secret_wo_version`\" pulumi-lang-yaml=\"`oidcClientSecretWoVersion`\" pulumi-lang-java=\"`oidcClientSecretWoVersion`\" pulumi-lang-hcl=\"`oidc_client_secret_wo_version`\"\u003e`oidcClientSecretWoVersion`\u003c/span\u003e. To rotate the secret, update the value and increment \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWoVersion`\" pulumi-lang-dotnet=\"`OidcClientSecretWoVersion`\" pulumi-lang-go=\"`oidcClientSecretWoVersion`\" pulumi-lang-python=\"`oidc_client_secret_wo_version`\" pulumi-lang-yaml=\"`oidcClientSecretWoVersion`\" pulumi-lang-java=\"`oidcClientSecretWoVersion`\" pulumi-lang-hcl=\"`oidc_client_secret_wo_version`\"\u003e`oidcClientSecretWoVersion`\u003c/span\u003e.\n\n## Import\n\nJWT auth backend can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:jwt/authBackend:AuthBackend oidc oidc\n```\n\nor\n\n```sh\n$ pulumi import vault:jwt/authBackend:AuthBackend jwt jwt\n```\n\n", "properties": { "accessor": { "type": "string", "description": "The accessor for this auth method\n" }, "boundIssuer": { "type": "string", "description": "The value against which to match the iss claim in a JWT\n" }, "defaultRole": { "type": "string", "description": "The default role to use if none is provided during login\n" }, "description": { "type": "string", "description": "The description of the auth backend\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "jwksCaPem": { "type": "string", "description": "The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.\n" }, "jwksPairs": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "string" } }, "description": "List of JWKS URL and optional CA certificate pairs. Cannot be used with \u003cspan pulumi-lang-nodejs=\"`jwksUrl`\" pulumi-lang-dotnet=\"`JwksUrl`\" pulumi-lang-go=\"`jwksUrl`\" pulumi-lang-python=\"`jwks_url`\" pulumi-lang-yaml=\"`jwksUrl`\" pulumi-lang-java=\"`jwksUrl`\" pulumi-lang-hcl=\"`jwks_url`\"\u003e`jwksUrl`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`jwksCaPem`\" pulumi-lang-dotnet=\"`JwksCaPem`\" pulumi-lang-go=\"`jwksCaPem`\" pulumi-lang-python=\"`jwks_ca_pem`\" pulumi-lang-yaml=\"`jwksCaPem`\" pulumi-lang-java=\"`jwksCaPem`\" pulumi-lang-hcl=\"`jwks_ca_pem`\"\u003e`jwksCaPem`\u003c/span\u003e. Requires Vault 1.16+.\n" }, "jwksUrl": { "type": "string", "description": "JWKS URL to use to authenticate signatures. Cannot be used with \u003cspan pulumi-lang-nodejs=\"\"oidcDiscoveryUrl\"\" pulumi-lang-dotnet=\"\"OidcDiscoveryUrl\"\" pulumi-lang-go=\"\"oidcDiscoveryUrl\"\" pulumi-lang-python=\"\"oidc_discovery_url\"\" pulumi-lang-yaml=\"\"oidcDiscoveryUrl\"\" pulumi-lang-java=\"\"oidcDiscoveryUrl\"\" pulumi-lang-hcl=\"\"oidc_discovery_url\"\"\u003e\"oidcDiscoveryUrl\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jwtValidationPubkeys\"\" pulumi-lang-dotnet=\"\"JwtValidationPubkeys\"\" pulumi-lang-go=\"\"jwtValidationPubkeys\"\" pulumi-lang-python=\"\"jwt_validation_pubkeys\"\" pulumi-lang-yaml=\"\"jwtValidationPubkeys\"\" pulumi-lang-java=\"\"jwtValidationPubkeys\"\" pulumi-lang-hcl=\"\"jwt_validation_pubkeys\"\"\u003e\"jwtValidationPubkeys\"\u003c/span\u003e.\n" }, "jwtSupportedAlgs": { "type": "array", "items": { "type": "string" }, "description": "A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ\n" }, "jwtValidationPubkeys": { "type": "array", "items": { "type": "string" }, "description": "A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with \u003cspan pulumi-lang-nodejs=\"`oidcDiscoveryUrl`\" pulumi-lang-dotnet=\"`OidcDiscoveryUrl`\" pulumi-lang-go=\"`oidcDiscoveryUrl`\" pulumi-lang-python=\"`oidc_discovery_url`\" pulumi-lang-yaml=\"`oidcDiscoveryUrl`\" pulumi-lang-java=\"`oidcDiscoveryUrl`\" pulumi-lang-hcl=\"`oidc_discovery_url`\"\u003e`oidcDiscoveryUrl`\u003c/span\u003e\n" }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "namespaceInState": { "type": "boolean", "description": "Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs\n\n* tune - (Optional) Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "oidcClientId": { "type": "string", "description": "Client ID used for OIDC backends\n" }, "oidcClientSecret": { "type": "string", "description": "Client Secret used for OIDC backends. **Note:** This field is stored in state. For enhanced security, use \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e instead.\n", "secret": true }, "oidcClientSecretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only Client Secret used for OIDC. This field is recommended over\u003cspan pulumi-lang-nodejs=\" oidcClientSecret \" pulumi-lang-dotnet=\" OidcClientSecret \" pulumi-lang-go=\" oidcClientSecret \" pulumi-lang-python=\" oidc_client_secret \" pulumi-lang-yaml=\" oidcClientSecret \" pulumi-lang-java=\" oidcClientSecret \" pulumi-lang-hcl=\" oidc_client_secret \"\u003e oidcClientSecret \u003c/span\u003efor enhanced security.", "secret": true }, "oidcClientSecretWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e field. Increment this value to trigger an update of the client secret in Vault. Required when using \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e.\n" }, "oidcDiscoveryCaPem": { "type": "string", "description": "The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used\n" }, "oidcDiscoveryUrl": { "type": "string", "description": "The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with \u003cspan pulumi-lang-nodejs=\"`jwtValidationPubkeys`\" pulumi-lang-dotnet=\"`JwtValidationPubkeys`\" pulumi-lang-go=\"`jwtValidationPubkeys`\" pulumi-lang-python=\"`jwt_validation_pubkeys`\" pulumi-lang-yaml=\"`jwtValidationPubkeys`\" pulumi-lang-java=\"`jwtValidationPubkeys`\" pulumi-lang-hcl=\"`jwt_validation_pubkeys`\"\u003e`jwtValidationPubkeys`\u003c/span\u003e\n" }, "oidcResponseMode": { "type": "string", "description": "The response mode to be used in the OAuth2 request. Allowed values are \u003cspan pulumi-lang-nodejs=\"`query`\" pulumi-lang-dotnet=\"`Query`\" pulumi-lang-go=\"`query`\" pulumi-lang-python=\"`query`\" pulumi-lang-yaml=\"`query`\" pulumi-lang-java=\"`query`\" pulumi-lang-hcl=\"`query`\"\u003e`query`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`formPost`\" pulumi-lang-dotnet=\"`FormPost`\" pulumi-lang-go=\"`formPost`\" pulumi-lang-python=\"`form_post`\" pulumi-lang-yaml=\"`formPost`\" pulumi-lang-java=\"`formPost`\" pulumi-lang-hcl=\"`form_post`\"\u003e`formPost`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`query`\" pulumi-lang-dotnet=\"`Query`\" pulumi-lang-go=\"`query`\" pulumi-lang-python=\"`query`\" pulumi-lang-yaml=\"`query`\" pulumi-lang-java=\"`query`\" pulumi-lang-hcl=\"`query`\"\u003e`query`\u003c/span\u003e. If using Vault namespaces, and \u003cspan pulumi-lang-nodejs=\"`oidcResponseMode`\" pulumi-lang-dotnet=\"`OidcResponseMode`\" pulumi-lang-go=\"`oidcResponseMode`\" pulumi-lang-python=\"`oidc_response_mode`\" pulumi-lang-yaml=\"`oidcResponseMode`\" pulumi-lang-java=\"`oidcResponseMode`\" pulumi-lang-hcl=\"`oidc_response_mode`\"\u003e`oidcResponseMode`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`formPost`\" pulumi-lang-dotnet=\"`FormPost`\" pulumi-lang-go=\"`formPost`\" pulumi-lang-python=\"`form_post`\" pulumi-lang-yaml=\"`formPost`\" pulumi-lang-java=\"`formPost`\" pulumi-lang-hcl=\"`form_post`\"\u003e`formPost`\u003c/span\u003e, then \u003cspan pulumi-lang-nodejs=\"`namespaceInState`\" pulumi-lang-dotnet=\"`NamespaceInState`\" pulumi-lang-go=\"`namespaceInState`\" pulumi-lang-python=\"`namespace_in_state`\" pulumi-lang-yaml=\"`namespaceInState`\" pulumi-lang-java=\"`namespaceInState`\" pulumi-lang-hcl=\"`namespace_in_state`\"\u003e`namespaceInState`\u003c/span\u003e should be set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "oidcResponseTypes": { "type": "array", "items": { "type": "string" }, "description": "List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `[\"code\"]`. Note: \u003cspan pulumi-lang-nodejs=\"`idToken`\" pulumi-lang-dotnet=\"`IdToken`\" pulumi-lang-go=\"`idToken`\" pulumi-lang-python=\"`id_token`\" pulumi-lang-yaml=\"`idToken`\" pulumi-lang-java=\"`idToken`\" pulumi-lang-hcl=\"`id_token`\"\u003e`idToken`\u003c/span\u003e may only be used if \u003cspan pulumi-lang-nodejs=\"`oidcResponseMode`\" pulumi-lang-dotnet=\"`OidcResponseMode`\" pulumi-lang-go=\"`oidcResponseMode`\" pulumi-lang-python=\"`oidc_response_mode`\" pulumi-lang-yaml=\"`oidcResponseMode`\" pulumi-lang-java=\"`oidcResponseMode`\" pulumi-lang-hcl=\"`oidc_response_mode`\"\u003e`oidcResponseMode`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`formPost`\" pulumi-lang-dotnet=\"`FormPost`\" pulumi-lang-go=\"`formPost`\" pulumi-lang-python=\"`form_post`\" pulumi-lang-yaml=\"`formPost`\" pulumi-lang-java=\"`formPost`\" pulumi-lang-hcl=\"`form_post`\"\u003e`formPost`\u003c/span\u003e.\n" }, "path": { "type": "string", "description": "Path to mount the JWT/OIDC auth backend\n" }, "providerConfig": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.\n" }, "tune": { "$ref": "#/types/vault:jwt/AuthBackendTune:AuthBackendTune" }, "type": { "type": "string", "description": "Type of auth backend. Should be one of \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e. Default - \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e\n" } }, "required": [ "accessor", "tune" ], "inputProperties": { "boundIssuer": { "type": "string", "description": "The value against which to match the iss claim in a JWT\n" }, "defaultRole": { "type": "string", "description": "The default role to use if none is provided during login\n" }, "description": { "type": "string", "description": "The description of the auth backend\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "jwksCaPem": { "type": "string", "description": "The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.\n" }, "jwksPairs": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "string" } }, "description": "List of JWKS URL and optional CA certificate pairs. Cannot be used with \u003cspan pulumi-lang-nodejs=\"`jwksUrl`\" pulumi-lang-dotnet=\"`JwksUrl`\" pulumi-lang-go=\"`jwksUrl`\" pulumi-lang-python=\"`jwks_url`\" pulumi-lang-yaml=\"`jwksUrl`\" pulumi-lang-java=\"`jwksUrl`\" pulumi-lang-hcl=\"`jwks_url`\"\u003e`jwksUrl`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`jwksCaPem`\" pulumi-lang-dotnet=\"`JwksCaPem`\" pulumi-lang-go=\"`jwksCaPem`\" pulumi-lang-python=\"`jwks_ca_pem`\" pulumi-lang-yaml=\"`jwksCaPem`\" pulumi-lang-java=\"`jwksCaPem`\" pulumi-lang-hcl=\"`jwks_ca_pem`\"\u003e`jwksCaPem`\u003c/span\u003e. Requires Vault 1.16+.\n" }, "jwksUrl": { "type": "string", "description": "JWKS URL to use to authenticate signatures. Cannot be used with \u003cspan pulumi-lang-nodejs=\"\"oidcDiscoveryUrl\"\" pulumi-lang-dotnet=\"\"OidcDiscoveryUrl\"\" pulumi-lang-go=\"\"oidcDiscoveryUrl\"\" pulumi-lang-python=\"\"oidc_discovery_url\"\" pulumi-lang-yaml=\"\"oidcDiscoveryUrl\"\" pulumi-lang-java=\"\"oidcDiscoveryUrl\"\" pulumi-lang-hcl=\"\"oidc_discovery_url\"\"\u003e\"oidcDiscoveryUrl\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jwtValidationPubkeys\"\" pulumi-lang-dotnet=\"\"JwtValidationPubkeys\"\" pulumi-lang-go=\"\"jwtValidationPubkeys\"\" pulumi-lang-python=\"\"jwt_validation_pubkeys\"\" pulumi-lang-yaml=\"\"jwtValidationPubkeys\"\" pulumi-lang-java=\"\"jwtValidationPubkeys\"\" pulumi-lang-hcl=\"\"jwt_validation_pubkeys\"\"\u003e\"jwtValidationPubkeys\"\u003c/span\u003e.\n" }, "jwtSupportedAlgs": { "type": "array", "items": { "type": "string" }, "description": "A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ\n" }, "jwtValidationPubkeys": { "type": "array", "items": { "type": "string" }, "description": "A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with \u003cspan pulumi-lang-nodejs=\"`oidcDiscoveryUrl`\" pulumi-lang-dotnet=\"`OidcDiscoveryUrl`\" pulumi-lang-go=\"`oidcDiscoveryUrl`\" pulumi-lang-python=\"`oidc_discovery_url`\" pulumi-lang-yaml=\"`oidcDiscoveryUrl`\" pulumi-lang-java=\"`oidcDiscoveryUrl`\" pulumi-lang-hcl=\"`oidc_discovery_url`\"\u003e`oidcDiscoveryUrl`\u003c/span\u003e\n" }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "namespaceInState": { "type": "boolean", "description": "Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs\n\n* tune - (Optional) Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "oidcClientId": { "type": "string", "description": "Client ID used for OIDC backends\n" }, "oidcClientSecret": { "type": "string", "description": "Client Secret used for OIDC backends. **Note:** This field is stored in state. For enhanced security, use \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e instead.\n", "secret": true }, "oidcClientSecretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only Client Secret used for OIDC. This field is recommended over\u003cspan pulumi-lang-nodejs=\" oidcClientSecret \" pulumi-lang-dotnet=\" OidcClientSecret \" pulumi-lang-go=\" oidcClientSecret \" pulumi-lang-python=\" oidc_client_secret \" pulumi-lang-yaml=\" oidcClientSecret \" pulumi-lang-java=\" oidcClientSecret \" pulumi-lang-hcl=\" oidc_client_secret \"\u003e oidcClientSecret \u003c/span\u003efor enhanced security.", "secret": true }, "oidcClientSecretWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e field. Increment this value to trigger an update of the client secret in Vault. Required when using \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e.\n" }, "oidcDiscoveryCaPem": { "type": "string", "description": "The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used\n" }, "oidcDiscoveryUrl": { "type": "string", "description": "The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with \u003cspan pulumi-lang-nodejs=\"`jwtValidationPubkeys`\" pulumi-lang-dotnet=\"`JwtValidationPubkeys`\" pulumi-lang-go=\"`jwtValidationPubkeys`\" pulumi-lang-python=\"`jwt_validation_pubkeys`\" pulumi-lang-yaml=\"`jwtValidationPubkeys`\" pulumi-lang-java=\"`jwtValidationPubkeys`\" pulumi-lang-hcl=\"`jwt_validation_pubkeys`\"\u003e`jwtValidationPubkeys`\u003c/span\u003e\n" }, "oidcResponseMode": { "type": "string", "description": "The response mode to be used in the OAuth2 request. Allowed values are \u003cspan pulumi-lang-nodejs=\"`query`\" pulumi-lang-dotnet=\"`Query`\" pulumi-lang-go=\"`query`\" pulumi-lang-python=\"`query`\" pulumi-lang-yaml=\"`query`\" pulumi-lang-java=\"`query`\" pulumi-lang-hcl=\"`query`\"\u003e`query`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`formPost`\" pulumi-lang-dotnet=\"`FormPost`\" pulumi-lang-go=\"`formPost`\" pulumi-lang-python=\"`form_post`\" pulumi-lang-yaml=\"`formPost`\" pulumi-lang-java=\"`formPost`\" pulumi-lang-hcl=\"`form_post`\"\u003e`formPost`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`query`\" pulumi-lang-dotnet=\"`Query`\" pulumi-lang-go=\"`query`\" pulumi-lang-python=\"`query`\" pulumi-lang-yaml=\"`query`\" pulumi-lang-java=\"`query`\" pulumi-lang-hcl=\"`query`\"\u003e`query`\u003c/span\u003e. If using Vault namespaces, and \u003cspan pulumi-lang-nodejs=\"`oidcResponseMode`\" pulumi-lang-dotnet=\"`OidcResponseMode`\" pulumi-lang-go=\"`oidcResponseMode`\" pulumi-lang-python=\"`oidc_response_mode`\" pulumi-lang-yaml=\"`oidcResponseMode`\" pulumi-lang-java=\"`oidcResponseMode`\" pulumi-lang-hcl=\"`oidc_response_mode`\"\u003e`oidcResponseMode`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`formPost`\" pulumi-lang-dotnet=\"`FormPost`\" pulumi-lang-go=\"`formPost`\" pulumi-lang-python=\"`form_post`\" pulumi-lang-yaml=\"`formPost`\" pulumi-lang-java=\"`formPost`\" pulumi-lang-hcl=\"`form_post`\"\u003e`formPost`\u003c/span\u003e, then \u003cspan pulumi-lang-nodejs=\"`namespaceInState`\" pulumi-lang-dotnet=\"`NamespaceInState`\" pulumi-lang-go=\"`namespaceInState`\" pulumi-lang-python=\"`namespace_in_state`\" pulumi-lang-yaml=\"`namespaceInState`\" pulumi-lang-java=\"`namespaceInState`\" pulumi-lang-hcl=\"`namespace_in_state`\"\u003e`namespaceInState`\u003c/span\u003e should be set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "oidcResponseTypes": { "type": "array", "items": { "type": "string" }, "description": "List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `[\"code\"]`. Note: \u003cspan pulumi-lang-nodejs=\"`idToken`\" pulumi-lang-dotnet=\"`IdToken`\" pulumi-lang-go=\"`idToken`\" pulumi-lang-python=\"`id_token`\" pulumi-lang-yaml=\"`idToken`\" pulumi-lang-java=\"`idToken`\" pulumi-lang-hcl=\"`id_token`\"\u003e`idToken`\u003c/span\u003e may only be used if \u003cspan pulumi-lang-nodejs=\"`oidcResponseMode`\" pulumi-lang-dotnet=\"`OidcResponseMode`\" pulumi-lang-go=\"`oidcResponseMode`\" pulumi-lang-python=\"`oidc_response_mode`\" pulumi-lang-yaml=\"`oidcResponseMode`\" pulumi-lang-java=\"`oidcResponseMode`\" pulumi-lang-hcl=\"`oidc_response_mode`\"\u003e`oidcResponseMode`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`formPost`\" pulumi-lang-dotnet=\"`FormPost`\" pulumi-lang-go=\"`formPost`\" pulumi-lang-python=\"`form_post`\" pulumi-lang-yaml=\"`formPost`\" pulumi-lang-java=\"`formPost`\" pulumi-lang-hcl=\"`form_post`\"\u003e`formPost`\u003c/span\u003e.\n" }, "path": { "type": "string", "description": "Path to mount the JWT/OIDC auth backend\n" }, "providerConfig": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.\n" }, "tune": { "$ref": "#/types/vault:jwt/AuthBackendTune:AuthBackendTune" }, "type": { "type": "string", "description": "Type of auth backend. Should be one of \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e. Default - \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e\n", "willReplaceOnChanges": true } }, "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "The accessor for this auth method\n" }, "boundIssuer": { "type": "string", "description": "The value against which to match the iss claim in a JWT\n" }, "defaultRole": { "type": "string", "description": "The default role to use if none is provided during login\n" }, "description": { "type": "string", "description": "The description of the auth backend\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "jwksCaPem": { "type": "string", "description": "The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.\n" }, "jwksPairs": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "string" } }, "description": "List of JWKS URL and optional CA certificate pairs. Cannot be used with \u003cspan pulumi-lang-nodejs=\"`jwksUrl`\" pulumi-lang-dotnet=\"`JwksUrl`\" pulumi-lang-go=\"`jwksUrl`\" pulumi-lang-python=\"`jwks_url`\" pulumi-lang-yaml=\"`jwksUrl`\" pulumi-lang-java=\"`jwksUrl`\" pulumi-lang-hcl=\"`jwks_url`\"\u003e`jwksUrl`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`jwksCaPem`\" pulumi-lang-dotnet=\"`JwksCaPem`\" pulumi-lang-go=\"`jwksCaPem`\" pulumi-lang-python=\"`jwks_ca_pem`\" pulumi-lang-yaml=\"`jwksCaPem`\" pulumi-lang-java=\"`jwksCaPem`\" pulumi-lang-hcl=\"`jwks_ca_pem`\"\u003e`jwksCaPem`\u003c/span\u003e. Requires Vault 1.16+.\n" }, "jwksUrl": { "type": "string", "description": "JWKS URL to use to authenticate signatures. Cannot be used with \u003cspan pulumi-lang-nodejs=\"\"oidcDiscoveryUrl\"\" pulumi-lang-dotnet=\"\"OidcDiscoveryUrl\"\" pulumi-lang-go=\"\"oidcDiscoveryUrl\"\" pulumi-lang-python=\"\"oidc_discovery_url\"\" pulumi-lang-yaml=\"\"oidcDiscoveryUrl\"\" pulumi-lang-java=\"\"oidcDiscoveryUrl\"\" pulumi-lang-hcl=\"\"oidc_discovery_url\"\"\u003e\"oidcDiscoveryUrl\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jwtValidationPubkeys\"\" pulumi-lang-dotnet=\"\"JwtValidationPubkeys\"\" pulumi-lang-go=\"\"jwtValidationPubkeys\"\" pulumi-lang-python=\"\"jwt_validation_pubkeys\"\" pulumi-lang-yaml=\"\"jwtValidationPubkeys\"\" pulumi-lang-java=\"\"jwtValidationPubkeys\"\" pulumi-lang-hcl=\"\"jwt_validation_pubkeys\"\"\u003e\"jwtValidationPubkeys\"\u003c/span\u003e.\n" }, "jwtSupportedAlgs": { "type": "array", "items": { "type": "string" }, "description": "A list of supported signing algorithms. Vault 1.1.0 defaults to [RS256] but future or past versions of Vault may differ\n" }, "jwtValidationPubkeys": { "type": "array", "items": { "type": "string" }, "description": "A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used in combination with \u003cspan pulumi-lang-nodejs=\"`oidcDiscoveryUrl`\" pulumi-lang-dotnet=\"`OidcDiscoveryUrl`\" pulumi-lang-go=\"`oidcDiscoveryUrl`\" pulumi-lang-python=\"`oidc_discovery_url`\" pulumi-lang-yaml=\"`oidcDiscoveryUrl`\" pulumi-lang-java=\"`oidcDiscoveryUrl`\" pulumi-lang-hcl=\"`oidc_discovery_url`\"\u003e`oidcDiscoveryUrl`\u003c/span\u003e\n" }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "namespaceInState": { "type": "boolean", "description": "Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the OIDC provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs\n\n* tune - (Optional) Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "oidcClientId": { "type": "string", "description": "Client ID used for OIDC backends\n" }, "oidcClientSecret": { "type": "string", "description": "Client Secret used for OIDC backends. **Note:** This field is stored in state. For enhanced security, use \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e instead.\n", "secret": true }, "oidcClientSecretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only Client Secret used for OIDC. This field is recommended over\u003cspan pulumi-lang-nodejs=\" oidcClientSecret \" pulumi-lang-dotnet=\" OidcClientSecret \" pulumi-lang-go=\" oidcClientSecret \" pulumi-lang-python=\" oidc_client_secret \" pulumi-lang-yaml=\" oidcClientSecret \" pulumi-lang-java=\" oidcClientSecret \" pulumi-lang-hcl=\" oidc_client_secret \"\u003e oidcClientSecret \u003c/span\u003efor enhanced security.", "secret": true }, "oidcClientSecretWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e field. Increment this value to trigger an update of the client secret in Vault. Required when using \u003cspan pulumi-lang-nodejs=\"`oidcClientSecretWo`\" pulumi-lang-dotnet=\"`OidcClientSecretWo`\" pulumi-lang-go=\"`oidcClientSecretWo`\" pulumi-lang-python=\"`oidc_client_secret_wo`\" pulumi-lang-yaml=\"`oidcClientSecretWo`\" pulumi-lang-java=\"`oidcClientSecretWo`\" pulumi-lang-hcl=\"`oidc_client_secret_wo`\"\u003e`oidcClientSecretWo`\u003c/span\u003e.\n" }, "oidcDiscoveryCaPem": { "type": "string", "description": "The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used\n" }, "oidcDiscoveryUrl": { "type": "string", "description": "The OIDC Discovery URL, without any .well-known component (base path). Cannot be used in combination with \u003cspan pulumi-lang-nodejs=\"`jwtValidationPubkeys`\" pulumi-lang-dotnet=\"`JwtValidationPubkeys`\" pulumi-lang-go=\"`jwtValidationPubkeys`\" pulumi-lang-python=\"`jwt_validation_pubkeys`\" pulumi-lang-yaml=\"`jwtValidationPubkeys`\" pulumi-lang-java=\"`jwtValidationPubkeys`\" pulumi-lang-hcl=\"`jwt_validation_pubkeys`\"\u003e`jwtValidationPubkeys`\u003c/span\u003e\n" }, "oidcResponseMode": { "type": "string", "description": "The response mode to be used in the OAuth2 request. Allowed values are \u003cspan pulumi-lang-nodejs=\"`query`\" pulumi-lang-dotnet=\"`Query`\" pulumi-lang-go=\"`query`\" pulumi-lang-python=\"`query`\" pulumi-lang-yaml=\"`query`\" pulumi-lang-java=\"`query`\" pulumi-lang-hcl=\"`query`\"\u003e`query`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`formPost`\" pulumi-lang-dotnet=\"`FormPost`\" pulumi-lang-go=\"`formPost`\" pulumi-lang-python=\"`form_post`\" pulumi-lang-yaml=\"`formPost`\" pulumi-lang-java=\"`formPost`\" pulumi-lang-hcl=\"`form_post`\"\u003e`formPost`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`query`\" pulumi-lang-dotnet=\"`Query`\" pulumi-lang-go=\"`query`\" pulumi-lang-python=\"`query`\" pulumi-lang-yaml=\"`query`\" pulumi-lang-java=\"`query`\" pulumi-lang-hcl=\"`query`\"\u003e`query`\u003c/span\u003e. If using Vault namespaces, and \u003cspan pulumi-lang-nodejs=\"`oidcResponseMode`\" pulumi-lang-dotnet=\"`OidcResponseMode`\" pulumi-lang-go=\"`oidcResponseMode`\" pulumi-lang-python=\"`oidc_response_mode`\" pulumi-lang-yaml=\"`oidcResponseMode`\" pulumi-lang-java=\"`oidcResponseMode`\" pulumi-lang-hcl=\"`oidc_response_mode`\"\u003e`oidcResponseMode`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`formPost`\" pulumi-lang-dotnet=\"`FormPost`\" pulumi-lang-go=\"`formPost`\" pulumi-lang-python=\"`form_post`\" pulumi-lang-yaml=\"`formPost`\" pulumi-lang-java=\"`formPost`\" pulumi-lang-hcl=\"`form_post`\"\u003e`formPost`\u003c/span\u003e, then \u003cspan pulumi-lang-nodejs=\"`namespaceInState`\" pulumi-lang-dotnet=\"`NamespaceInState`\" pulumi-lang-go=\"`namespaceInState`\" pulumi-lang-python=\"`namespace_in_state`\" pulumi-lang-yaml=\"`namespaceInState`\" pulumi-lang-java=\"`namespaceInState`\" pulumi-lang-hcl=\"`namespace_in_state`\"\u003e`namespaceInState`\u003c/span\u003e should be set to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "oidcResponseTypes": { "type": "array", "items": { "type": "string" }, "description": "List of response types to request. Allowed values are 'code' and 'id_token'. Defaults to `[\"code\"]`. Note: \u003cspan pulumi-lang-nodejs=\"`idToken`\" pulumi-lang-dotnet=\"`IdToken`\" pulumi-lang-go=\"`idToken`\" pulumi-lang-python=\"`id_token`\" pulumi-lang-yaml=\"`idToken`\" pulumi-lang-java=\"`idToken`\" pulumi-lang-hcl=\"`id_token`\"\u003e`idToken`\u003c/span\u003e may only be used if \u003cspan pulumi-lang-nodejs=\"`oidcResponseMode`\" pulumi-lang-dotnet=\"`OidcResponseMode`\" pulumi-lang-go=\"`oidcResponseMode`\" pulumi-lang-python=\"`oidc_response_mode`\" pulumi-lang-yaml=\"`oidcResponseMode`\" pulumi-lang-java=\"`oidcResponseMode`\" pulumi-lang-hcl=\"`oidc_response_mode`\"\u003e`oidcResponseMode`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`formPost`\" pulumi-lang-dotnet=\"`FormPost`\" pulumi-lang-go=\"`formPost`\" pulumi-lang-python=\"`form_post`\" pulumi-lang-yaml=\"`formPost`\" pulumi-lang-java=\"`formPost`\" pulumi-lang-hcl=\"`form_post`\"\u003e`formPost`\u003c/span\u003e.\n" }, "path": { "type": "string", "description": "Path to mount the JWT/OIDC auth backend\n" }, "providerConfig": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Provider specific handling configuration. All values may be strings, and the provider will convert to the appropriate type when configuring Vault.\n" }, "tune": { "$ref": "#/types/vault:jwt/AuthBackendTune:AuthBackendTune" }, "type": { "type": "string", "description": "Type of auth backend. Should be one of \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e. Default - \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:jwt/authBackendRole:AuthBackendRole": { "description": "Manages an JWT/OIDC auth backend role in a Vault server. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/jwt.html) for more\ninformation.\n\n## Example Usage\n\nRole for JWT backend:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst jwt = new vault.jwt.AuthBackend(\"jwt\", {path: \"jwt\"});\nconst example = new vault.jwt.AuthBackendRole(\"example\", {\n backend: jwt.path,\n roleName: \"test-role\",\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n boundAudiences: [\"https://myco.test\"],\n boundClaims: {\n color: \"red,green,blue\",\n },\n userClaim: \"https://vault/user\",\n roleType: \"jwt\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\njwt = vault.jwt.AuthBackend(\"jwt\", path=\"jwt\")\nexample = vault.jwt.AuthBackendRole(\"example\",\n backend=jwt.path,\n role_name=\"test-role\",\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ],\n bound_audiences=[\"https://myco.test\"],\n bound_claims={\n \"color\": \"red,green,blue\",\n },\n user_claim=\"https://vault/user\",\n role_type=\"jwt\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var jwt = new Vault.Jwt.AuthBackend(\"jwt\", new()\n {\n Path = \"jwt\",\n });\n\n var example = new Vault.Jwt.AuthBackendRole(\"example\", new()\n {\n Backend = jwt.Path,\n RoleName = \"test-role\",\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n BoundAudiences = new[]\n {\n \"https://myco.test\",\n },\n BoundClaims = \n {\n { \"color\", \"red,green,blue\" },\n },\n UserClaim = \"https://vault/user\",\n RoleType = \"jwt\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/jwt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tjwt2, err := jwt.NewAuthBackend(ctx, \"jwt\", \u0026jwt.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"jwt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = jwt.NewAuthBackendRole(ctx, \"example\", \u0026jwt.AuthBackendRoleArgs{\n\t\t\tBackend: jwt2.Path,\n\t\t\tRoleName: pulumi.String(\"test-role\"),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t\tBoundAudiences: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://myco.test\"),\n\t\t\t},\n\t\t\tBoundClaims: pulumi.StringMap{\n\t\t\t\t\"color\": pulumi.String(\"red,green,blue\"),\n\t\t\t},\n\t\t\tUserClaim: pulumi.String(\"https://vault/user\"),\n\t\t\tRoleType: pulumi.String(\"jwt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_jwt_authbackend\" \"jwt\" {\n path = \"jwt\"\n}\nresource \"vault_jwt_authbackendrole\" \"example\" {\n backend = vault_jwt_authbackend.jwt.path\n role_name = \"test-role\"\n token_policies = [\"default\", \"dev\", \"prod\"]\n bound_audiences = [\"https://myco.test\"]\n bound_claims = {\n \"color\" = \"red,green,blue\"\n }\n user_claim = \"https://vault/user\"\n role_type = \"jwt\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.jwt.AuthBackend;\nimport com.pulumi.vault.jwt.AuthBackendArgs;\nimport com.pulumi.vault.jwt.AuthBackendRole;\nimport com.pulumi.vault.jwt.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var jwt = new AuthBackend(\"jwt\", AuthBackendArgs.builder()\n .path(\"jwt\")\n .build());\n\n var example = new AuthBackendRole(\"example\", AuthBackendRoleArgs.builder()\n .backend(jwt.path())\n .roleName(\"test-role\")\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .boundAudiences(\"https://myco.test\")\n .boundClaims(Map.of(\"color\", \"red,green,blue\"))\n .userClaim(\"https://vault/user\")\n .roleType(\"jwt\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n jwt:\n type: vault:jwt:AuthBackend\n properties:\n path: jwt\n example:\n type: vault:jwt:AuthBackendRole\n properties:\n backend: ${jwt.path}\n roleName: test-role\n tokenPolicies:\n - default\n - dev\n - prod\n boundAudiences:\n - https://myco.test\n boundClaims:\n color: red,green,blue\n userClaim: https://vault/user\n roleType: jwt\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nRole for OIDC backend:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst oidc = new vault.jwt.AuthBackend(\"oidc\", {\n path: \"oidc\",\n defaultRole: \"test-role\",\n});\nconst example = new vault.jwt.AuthBackendRole(\"example\", {\n backend: oidc.path,\n roleName: \"test-role\",\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n userClaim: \"https://vault/user\",\n roleType: \"oidc\",\n allowedRedirectUris: [\"http://localhost:8200/ui/vault/auth/oidc/oidc/callback\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\noidc = vault.jwt.AuthBackend(\"oidc\",\n path=\"oidc\",\n default_role=\"test-role\")\nexample = vault.jwt.AuthBackendRole(\"example\",\n backend=oidc.path,\n role_name=\"test-role\",\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ],\n user_claim=\"https://vault/user\",\n role_type=\"oidc\",\n allowed_redirect_uris=[\"http://localhost:8200/ui/vault/auth/oidc/oidc/callback\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var oidc = new Vault.Jwt.AuthBackend(\"oidc\", new()\n {\n Path = \"oidc\",\n DefaultRole = \"test-role\",\n });\n\n var example = new Vault.Jwt.AuthBackendRole(\"example\", new()\n {\n Backend = oidc.Path,\n RoleName = \"test-role\",\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n UserClaim = \"https://vault/user\",\n RoleType = \"oidc\",\n AllowedRedirectUris = new[]\n {\n \"http://localhost:8200/ui/vault/auth/oidc/oidc/callback\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/jwt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\toidc, err := jwt.NewAuthBackend(ctx, \"oidc\", \u0026jwt.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"oidc\"),\n\t\t\tDefaultRole: pulumi.String(\"test-role\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = jwt.NewAuthBackendRole(ctx, \"example\", \u0026jwt.AuthBackendRoleArgs{\n\t\t\tBackend: oidc.Path,\n\t\t\tRoleName: pulumi.String(\"test-role\"),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t\tUserClaim: pulumi.String(\"https://vault/user\"),\n\t\t\tRoleType: pulumi.String(\"oidc\"),\n\t\t\tAllowedRedirectUris: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"http://localhost:8200/ui/vault/auth/oidc/oidc/callback\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_jwt_authbackend\" \"oidc\" {\n path = \"oidc\"\n default_role = \"test-role\"\n}\nresource \"vault_jwt_authbackendrole\" \"example\" {\n backend = vault_jwt_authbackend.oidc.path\n role_name = \"test-role\"\n token_policies = [\"default\", \"dev\", \"prod\"]\n user_claim = \"https://vault/user\"\n role_type = \"oidc\"\n allowed_redirect_uris = [\"http://localhost:8200/ui/vault/auth/oidc/oidc/callback\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.jwt.AuthBackend;\nimport com.pulumi.vault.jwt.AuthBackendArgs;\nimport com.pulumi.vault.jwt.AuthBackendRole;\nimport com.pulumi.vault.jwt.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var oidc = new AuthBackend(\"oidc\", AuthBackendArgs.builder()\n .path(\"oidc\")\n .defaultRole(\"test-role\")\n .build());\n\n var example = new AuthBackendRole(\"example\", AuthBackendRoleArgs.builder()\n .backend(oidc.path())\n .roleName(\"test-role\")\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .userClaim(\"https://vault/user\")\n .roleType(\"oidc\")\n .allowedRedirectUris(\"http://localhost:8200/ui/vault/auth/oidc/oidc/callback\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n oidc:\n type: vault:jwt:AuthBackend\n properties:\n path: oidc\n defaultRole: test-role\n example:\n type: vault:jwt:AuthBackendRole\n properties:\n backend: ${oidc.path}\n roleName: test-role\n tokenPolicies:\n - default\n - dev\n - prod\n userClaim: https://vault/user\n roleType: oidc\n allowedRedirectUris:\n - http://localhost:8200/ui/vault/auth/oidc/oidc/callback\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nJWT authentication backend roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:jwt/authBackendRole:AuthBackendRole example auth/jwt/role/test-role\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowedRedirectUris": { "type": "array", "items": { "type": "string" }, "description": "The list of allowed values for\u003cspan pulumi-lang-nodejs=\" redirectUri \" pulumi-lang-dotnet=\" RedirectUri \" pulumi-lang-go=\" redirectUri \" pulumi-lang-python=\" redirect_uri \" pulumi-lang-yaml=\" redirectUri \" pulumi-lang-java=\" redirectUri \" pulumi-lang-hcl=\" redirect_uri \"\u003e redirectUri \u003c/span\u003eduring OIDC logins.\nRequired for OIDC roles\n" }, "backend": { "type": "string", "description": "The unique name of the auth backend to configure.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e.\n" }, "boundAudiences": { "type": "array", "items": { "type": "string" }, "description": "(Required for roles of type \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e, optional for roles of\ntype \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e) List of \u003cspan pulumi-lang-nodejs=\"`aud`\" pulumi-lang-dotnet=\"`Aud`\" pulumi-lang-go=\"`aud`\" pulumi-lang-python=\"`aud`\" pulumi-lang-yaml=\"`aud`\" pulumi-lang-java=\"`aud`\" pulumi-lang-hcl=\"`aud`\"\u003e`aud`\u003c/span\u003e claims to match against. Any match is sufficient.\n" }, "boundClaims": { "type": "object", "additionalProperties": { "type": "string" }, "description": "If set, a map of claims to values to match against.\nA claim's value must be a string, which may contain one value or multiple\ncomma-separated values, e.g. `\"red\"` or `\"red,green,blue\"`.\n" }, "boundClaimsType": { "type": "string", "description": "How to interpret values in the claims/values\nmap (\u003cspan pulumi-lang-nodejs=\"`boundClaims`\" pulumi-lang-dotnet=\"`BoundClaims`\" pulumi-lang-go=\"`boundClaims`\" pulumi-lang-python=\"`bound_claims`\" pulumi-lang-yaml=\"`boundClaims`\" pulumi-lang-java=\"`boundClaims`\" pulumi-lang-hcl=\"`bound_claims`\"\u003e`boundClaims`\u003c/span\u003e): can be either \u003cspan pulumi-lang-nodejs=\"`string`\" pulumi-lang-dotnet=\"`String`\" pulumi-lang-go=\"`string`\" pulumi-lang-python=\"`string`\" pulumi-lang-yaml=\"`string`\" pulumi-lang-java=\"`string`\" pulumi-lang-hcl=\"`string`\"\u003e`string`\u003c/span\u003e (exact match) or \u003cspan pulumi-lang-nodejs=\"`glob`\" pulumi-lang-dotnet=\"`Glob`\" pulumi-lang-go=\"`glob`\" pulumi-lang-python=\"`glob`\" pulumi-lang-yaml=\"`glob`\" pulumi-lang-java=\"`glob`\" pulumi-lang-hcl=\"`glob`\"\u003e`glob`\u003c/span\u003e (wildcard\nmatch). Requires Vault 1.4.0 or above.\n" }, "boundSubject": { "type": "string", "description": "If set, requires that the \u003cspan pulumi-lang-nodejs=\"`sub`\" pulumi-lang-dotnet=\"`Sub`\" pulumi-lang-go=\"`sub`\" pulumi-lang-python=\"`sub`\" pulumi-lang-yaml=\"`sub`\" pulumi-lang-java=\"`sub`\" pulumi-lang-hcl=\"`sub`\"\u003e`sub`\u003c/span\u003e claim matches\nthis value.\n" }, "claimMappings": { "type": "object", "additionalProperties": { "type": "string" }, "description": "If set, a map of claims (keys) to be copied\nto specified metadata fields (values).\n" }, "clockSkewLeeway": { "type": "integer", "description": "The amount of leeway to add to all claims to account for clock skew, in\nseconds. Defaults to \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e seconds if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e and can be disabled if set to `-1`.\nOnly applicable with \"jwt\" roles.\n" }, "disableBoundClaimsParsing": { "type": "boolean", "description": "Disable bound claim value parsing. Useful when values contain commas." }, "expirationLeeway": { "type": "integer", "description": "The amount of leeway to add to expiration (\u003cspan pulumi-lang-nodejs=\"`exp`\" pulumi-lang-dotnet=\"`Exp`\" pulumi-lang-go=\"`exp`\" pulumi-lang-python=\"`exp`\" pulumi-lang-yaml=\"`exp`\" pulumi-lang-java=\"`exp`\" pulumi-lang-hcl=\"`exp`\"\u003e`exp`\u003c/span\u003e) claims to account for\nclock skew, in seconds. Defaults to \u003cspan pulumi-lang-nodejs=\"`150`\" pulumi-lang-dotnet=\"`150`\" pulumi-lang-go=\"`150`\" pulumi-lang-python=\"`150`\" pulumi-lang-yaml=\"`150`\" pulumi-lang-java=\"`150`\" pulumi-lang-hcl=\"`150`\"\u003e`150`\u003c/span\u003e seconds if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e and can be disabled if set to `-1`.\nOnly applicable with \"jwt\" roles.\n" }, "groupsClaim": { "type": "string", "description": "The claim to use to uniquely identify\nthe set of groups to which the user belongs; this will be used as the names\nfor the Identity group aliases created due to a successful login. The claim\nvalue must be a list of strings.\n" }, "maxAge": { "type": "integer", "description": "Specifies the allowable elapsed time in seconds since the last time \nthe user was actively authenticated with the OIDC provider.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "notBeforeLeeway": { "type": "integer", "description": "The amount of leeway to add to not before (\u003cspan pulumi-lang-nodejs=\"`nbf`\" pulumi-lang-dotnet=\"`Nbf`\" pulumi-lang-go=\"`nbf`\" pulumi-lang-python=\"`nbf`\" pulumi-lang-yaml=\"`nbf`\" pulumi-lang-java=\"`nbf`\" pulumi-lang-hcl=\"`nbf`\"\u003e`nbf`\u003c/span\u003e) claims to account for\nclock skew, in seconds. Defaults to \u003cspan pulumi-lang-nodejs=\"`150`\" pulumi-lang-dotnet=\"`150`\" pulumi-lang-go=\"`150`\" pulumi-lang-python=\"`150`\" pulumi-lang-yaml=\"`150`\" pulumi-lang-java=\"`150`\" pulumi-lang-hcl=\"`150`\"\u003e`150`\u003c/span\u003e seconds if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e and can be disabled if set to `-1`.\nOnly applicable with \"jwt\" roles.\n" }, "oidcScopes": { "type": "array", "items": { "type": "string" }, "description": "If set, a list of OIDC scopes to be used with an OIDC role.\nThe standard scope \"openid\" is automatically included and need not be specified.\n" }, "roleName": { "type": "string", "description": "The name of the role.\n" }, "roleType": { "type": "string", "description": "Type of role, either \"oidc\" (default) or \"jwt\".\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "userClaim": { "type": "string", "description": "The claim to use to uniquely identify\nthe user; this will be used as the name for the Identity entity alias created\ndue to a successful login.\n" }, "userClaimJsonPointer": { "type": "boolean", "description": "Specifies if the \u003cspan pulumi-lang-nodejs=\"`userClaim`\" pulumi-lang-dotnet=\"`UserClaim`\" pulumi-lang-go=\"`userClaim`\" pulumi-lang-python=\"`user_claim`\" pulumi-lang-yaml=\"`userClaim`\" pulumi-lang-java=\"`userClaim`\" pulumi-lang-hcl=\"`user_claim`\"\u003e`userClaim`\u003c/span\u003e value uses\n[JSON pointer](https://www.vaultproject.io/docs/auth/jwt#claim-specifications-and-json-pointer)\nsyntax for referencing claims. By default, the \u003cspan pulumi-lang-nodejs=\"`userClaim`\" pulumi-lang-dotnet=\"`UserClaim`\" pulumi-lang-go=\"`userClaim`\" pulumi-lang-python=\"`user_claim`\" pulumi-lang-yaml=\"`userClaim`\" pulumi-lang-java=\"`userClaim`\" pulumi-lang-hcl=\"`user_claim`\"\u003e`userClaim`\u003c/span\u003e value will not use JSON pointer.\nRequires Vault 1.11+.\n" }, "verboseOidcLogging": { "type": "boolean", "description": "Log received OIDC tokens and claims when debug-level\nlogging is active. Not recommended in production since sensitive information may be present\nin OIDC responses.\n" } }, "required": [ "boundClaimsType", "roleName", "roleType", "userClaim" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowedRedirectUris": { "type": "array", "items": { "type": "string" }, "description": "The list of allowed values for\u003cspan pulumi-lang-nodejs=\" redirectUri \" pulumi-lang-dotnet=\" RedirectUri \" pulumi-lang-go=\" redirectUri \" pulumi-lang-python=\" redirect_uri \" pulumi-lang-yaml=\" redirectUri \" pulumi-lang-java=\" redirectUri \" pulumi-lang-hcl=\" redirect_uri \"\u003e redirectUri \u003c/span\u003eduring OIDC logins.\nRequired for OIDC roles\n" }, "backend": { "type": "string", "description": "The unique name of the auth backend to configure.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "boundAudiences": { "type": "array", "items": { "type": "string" }, "description": "(Required for roles of type \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e, optional for roles of\ntype \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e) List of \u003cspan pulumi-lang-nodejs=\"`aud`\" pulumi-lang-dotnet=\"`Aud`\" pulumi-lang-go=\"`aud`\" pulumi-lang-python=\"`aud`\" pulumi-lang-yaml=\"`aud`\" pulumi-lang-java=\"`aud`\" pulumi-lang-hcl=\"`aud`\"\u003e`aud`\u003c/span\u003e claims to match against. Any match is sufficient.\n" }, "boundClaims": { "type": "object", "additionalProperties": { "type": "string" }, "description": "If set, a map of claims to values to match against.\nA claim's value must be a string, which may contain one value or multiple\ncomma-separated values, e.g. `\"red\"` or `\"red,green,blue\"`.\n" }, "boundClaimsType": { "type": "string", "description": "How to interpret values in the claims/values\nmap (\u003cspan pulumi-lang-nodejs=\"`boundClaims`\" pulumi-lang-dotnet=\"`BoundClaims`\" pulumi-lang-go=\"`boundClaims`\" pulumi-lang-python=\"`bound_claims`\" pulumi-lang-yaml=\"`boundClaims`\" pulumi-lang-java=\"`boundClaims`\" pulumi-lang-hcl=\"`bound_claims`\"\u003e`boundClaims`\u003c/span\u003e): can be either \u003cspan pulumi-lang-nodejs=\"`string`\" pulumi-lang-dotnet=\"`String`\" pulumi-lang-go=\"`string`\" pulumi-lang-python=\"`string`\" pulumi-lang-yaml=\"`string`\" pulumi-lang-java=\"`string`\" pulumi-lang-hcl=\"`string`\"\u003e`string`\u003c/span\u003e (exact match) or \u003cspan pulumi-lang-nodejs=\"`glob`\" pulumi-lang-dotnet=\"`Glob`\" pulumi-lang-go=\"`glob`\" pulumi-lang-python=\"`glob`\" pulumi-lang-yaml=\"`glob`\" pulumi-lang-java=\"`glob`\" pulumi-lang-hcl=\"`glob`\"\u003e`glob`\u003c/span\u003e (wildcard\nmatch). Requires Vault 1.4.0 or above.\n" }, "boundSubject": { "type": "string", "description": "If set, requires that the \u003cspan pulumi-lang-nodejs=\"`sub`\" pulumi-lang-dotnet=\"`Sub`\" pulumi-lang-go=\"`sub`\" pulumi-lang-python=\"`sub`\" pulumi-lang-yaml=\"`sub`\" pulumi-lang-java=\"`sub`\" pulumi-lang-hcl=\"`sub`\"\u003e`sub`\u003c/span\u003e claim matches\nthis value.\n" }, "claimMappings": { "type": "object", "additionalProperties": { "type": "string" }, "description": "If set, a map of claims (keys) to be copied\nto specified metadata fields (values).\n" }, "clockSkewLeeway": { "type": "integer", "description": "The amount of leeway to add to all claims to account for clock skew, in\nseconds. Defaults to \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e seconds if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e and can be disabled if set to `-1`.\nOnly applicable with \"jwt\" roles.\n" }, "disableBoundClaimsParsing": { "type": "boolean", "description": "Disable bound claim value parsing. Useful when values contain commas." }, "expirationLeeway": { "type": "integer", "description": "The amount of leeway to add to expiration (\u003cspan pulumi-lang-nodejs=\"`exp`\" pulumi-lang-dotnet=\"`Exp`\" pulumi-lang-go=\"`exp`\" pulumi-lang-python=\"`exp`\" pulumi-lang-yaml=\"`exp`\" pulumi-lang-java=\"`exp`\" pulumi-lang-hcl=\"`exp`\"\u003e`exp`\u003c/span\u003e) claims to account for\nclock skew, in seconds. Defaults to \u003cspan pulumi-lang-nodejs=\"`150`\" pulumi-lang-dotnet=\"`150`\" pulumi-lang-go=\"`150`\" pulumi-lang-python=\"`150`\" pulumi-lang-yaml=\"`150`\" pulumi-lang-java=\"`150`\" pulumi-lang-hcl=\"`150`\"\u003e`150`\u003c/span\u003e seconds if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e and can be disabled if set to `-1`.\nOnly applicable with \"jwt\" roles.\n" }, "groupsClaim": { "type": "string", "description": "The claim to use to uniquely identify\nthe set of groups to which the user belongs; this will be used as the names\nfor the Identity group aliases created due to a successful login. The claim\nvalue must be a list of strings.\n" }, "maxAge": { "type": "integer", "description": "Specifies the allowable elapsed time in seconds since the last time \nthe user was actively authenticated with the OIDC provider.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notBeforeLeeway": { "type": "integer", "description": "The amount of leeway to add to not before (\u003cspan pulumi-lang-nodejs=\"`nbf`\" pulumi-lang-dotnet=\"`Nbf`\" pulumi-lang-go=\"`nbf`\" pulumi-lang-python=\"`nbf`\" pulumi-lang-yaml=\"`nbf`\" pulumi-lang-java=\"`nbf`\" pulumi-lang-hcl=\"`nbf`\"\u003e`nbf`\u003c/span\u003e) claims to account for\nclock skew, in seconds. Defaults to \u003cspan pulumi-lang-nodejs=\"`150`\" pulumi-lang-dotnet=\"`150`\" pulumi-lang-go=\"`150`\" pulumi-lang-python=\"`150`\" pulumi-lang-yaml=\"`150`\" pulumi-lang-java=\"`150`\" pulumi-lang-hcl=\"`150`\"\u003e`150`\u003c/span\u003e seconds if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e and can be disabled if set to `-1`.\nOnly applicable with \"jwt\" roles.\n" }, "oidcScopes": { "type": "array", "items": { "type": "string" }, "description": "If set, a list of OIDC scopes to be used with an OIDC role.\nThe standard scope \"openid\" is automatically included and need not be specified.\n" }, "roleName": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "roleType": { "type": "string", "description": "Type of role, either \"oidc\" (default) or \"jwt\".\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "userClaim": { "type": "string", "description": "The claim to use to uniquely identify\nthe user; this will be used as the name for the Identity entity alias created\ndue to a successful login.\n" }, "userClaimJsonPointer": { "type": "boolean", "description": "Specifies if the \u003cspan pulumi-lang-nodejs=\"`userClaim`\" pulumi-lang-dotnet=\"`UserClaim`\" pulumi-lang-go=\"`userClaim`\" pulumi-lang-python=\"`user_claim`\" pulumi-lang-yaml=\"`userClaim`\" pulumi-lang-java=\"`userClaim`\" pulumi-lang-hcl=\"`user_claim`\"\u003e`userClaim`\u003c/span\u003e value uses\n[JSON pointer](https://www.vaultproject.io/docs/auth/jwt#claim-specifications-and-json-pointer)\nsyntax for referencing claims. By default, the \u003cspan pulumi-lang-nodejs=\"`userClaim`\" pulumi-lang-dotnet=\"`UserClaim`\" pulumi-lang-go=\"`userClaim`\" pulumi-lang-python=\"`user_claim`\" pulumi-lang-yaml=\"`userClaim`\" pulumi-lang-java=\"`userClaim`\" pulumi-lang-hcl=\"`user_claim`\"\u003e`userClaim`\u003c/span\u003e value will not use JSON pointer.\nRequires Vault 1.11+.\n" }, "verboseOidcLogging": { "type": "boolean", "description": "Log received OIDC tokens and claims when debug-level\nlogging is active. Not recommended in production since sensitive information may be present\nin OIDC responses.\n" } }, "requiredInputs": [ "roleName", "userClaim" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "allowedRedirectUris": { "type": "array", "items": { "type": "string" }, "description": "The list of allowed values for\u003cspan pulumi-lang-nodejs=\" redirectUri \" pulumi-lang-dotnet=\" RedirectUri \" pulumi-lang-go=\" redirectUri \" pulumi-lang-python=\" redirect_uri \" pulumi-lang-yaml=\" redirectUri \" pulumi-lang-java=\" redirectUri \" pulumi-lang-hcl=\" redirect_uri \"\u003e redirectUri \u003c/span\u003eduring OIDC logins.\nRequired for OIDC roles\n" }, "backend": { "type": "string", "description": "The unique name of the auth backend to configure.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "boundAudiences": { "type": "array", "items": { "type": "string" }, "description": "(Required for roles of type \u003cspan pulumi-lang-nodejs=\"`jwt`\" pulumi-lang-dotnet=\"`Jwt`\" pulumi-lang-go=\"`jwt`\" pulumi-lang-python=\"`jwt`\" pulumi-lang-yaml=\"`jwt`\" pulumi-lang-java=\"`jwt`\" pulumi-lang-hcl=\"`jwt`\"\u003e`jwt`\u003c/span\u003e, optional for roles of\ntype \u003cspan pulumi-lang-nodejs=\"`oidc`\" pulumi-lang-dotnet=\"`Oidc`\" pulumi-lang-go=\"`oidc`\" pulumi-lang-python=\"`oidc`\" pulumi-lang-yaml=\"`oidc`\" pulumi-lang-java=\"`oidc`\" pulumi-lang-hcl=\"`oidc`\"\u003e`oidc`\u003c/span\u003e) List of \u003cspan pulumi-lang-nodejs=\"`aud`\" pulumi-lang-dotnet=\"`Aud`\" pulumi-lang-go=\"`aud`\" pulumi-lang-python=\"`aud`\" pulumi-lang-yaml=\"`aud`\" pulumi-lang-java=\"`aud`\" pulumi-lang-hcl=\"`aud`\"\u003e`aud`\u003c/span\u003e claims to match against. Any match is sufficient.\n" }, "boundClaims": { "type": "object", "additionalProperties": { "type": "string" }, "description": "If set, a map of claims to values to match against.\nA claim's value must be a string, which may contain one value or multiple\ncomma-separated values, e.g. `\"red\"` or `\"red,green,blue\"`.\n" }, "boundClaimsType": { "type": "string", "description": "How to interpret values in the claims/values\nmap (\u003cspan pulumi-lang-nodejs=\"`boundClaims`\" pulumi-lang-dotnet=\"`BoundClaims`\" pulumi-lang-go=\"`boundClaims`\" pulumi-lang-python=\"`bound_claims`\" pulumi-lang-yaml=\"`boundClaims`\" pulumi-lang-java=\"`boundClaims`\" pulumi-lang-hcl=\"`bound_claims`\"\u003e`boundClaims`\u003c/span\u003e): can be either \u003cspan pulumi-lang-nodejs=\"`string`\" pulumi-lang-dotnet=\"`String`\" pulumi-lang-go=\"`string`\" pulumi-lang-python=\"`string`\" pulumi-lang-yaml=\"`string`\" pulumi-lang-java=\"`string`\" pulumi-lang-hcl=\"`string`\"\u003e`string`\u003c/span\u003e (exact match) or \u003cspan pulumi-lang-nodejs=\"`glob`\" pulumi-lang-dotnet=\"`Glob`\" pulumi-lang-go=\"`glob`\" pulumi-lang-python=\"`glob`\" pulumi-lang-yaml=\"`glob`\" pulumi-lang-java=\"`glob`\" pulumi-lang-hcl=\"`glob`\"\u003e`glob`\u003c/span\u003e (wildcard\nmatch). Requires Vault 1.4.0 or above.\n" }, "boundSubject": { "type": "string", "description": "If set, requires that the \u003cspan pulumi-lang-nodejs=\"`sub`\" pulumi-lang-dotnet=\"`Sub`\" pulumi-lang-go=\"`sub`\" pulumi-lang-python=\"`sub`\" pulumi-lang-yaml=\"`sub`\" pulumi-lang-java=\"`sub`\" pulumi-lang-hcl=\"`sub`\"\u003e`sub`\u003c/span\u003e claim matches\nthis value.\n" }, "claimMappings": { "type": "object", "additionalProperties": { "type": "string" }, "description": "If set, a map of claims (keys) to be copied\nto specified metadata fields (values).\n" }, "clockSkewLeeway": { "type": "integer", "description": "The amount of leeway to add to all claims to account for clock skew, in\nseconds. Defaults to \u003cspan pulumi-lang-nodejs=\"`60`\" pulumi-lang-dotnet=\"`60`\" pulumi-lang-go=\"`60`\" pulumi-lang-python=\"`60`\" pulumi-lang-yaml=\"`60`\" pulumi-lang-java=\"`60`\" pulumi-lang-hcl=\"`60`\"\u003e`60`\u003c/span\u003e seconds if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e and can be disabled if set to `-1`.\nOnly applicable with \"jwt\" roles.\n" }, "disableBoundClaimsParsing": { "type": "boolean", "description": "Disable bound claim value parsing. Useful when values contain commas." }, "expirationLeeway": { "type": "integer", "description": "The amount of leeway to add to expiration (\u003cspan pulumi-lang-nodejs=\"`exp`\" pulumi-lang-dotnet=\"`Exp`\" pulumi-lang-go=\"`exp`\" pulumi-lang-python=\"`exp`\" pulumi-lang-yaml=\"`exp`\" pulumi-lang-java=\"`exp`\" pulumi-lang-hcl=\"`exp`\"\u003e`exp`\u003c/span\u003e) claims to account for\nclock skew, in seconds. Defaults to \u003cspan pulumi-lang-nodejs=\"`150`\" pulumi-lang-dotnet=\"`150`\" pulumi-lang-go=\"`150`\" pulumi-lang-python=\"`150`\" pulumi-lang-yaml=\"`150`\" pulumi-lang-java=\"`150`\" pulumi-lang-hcl=\"`150`\"\u003e`150`\u003c/span\u003e seconds if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e and can be disabled if set to `-1`.\nOnly applicable with \"jwt\" roles.\n" }, "groupsClaim": { "type": "string", "description": "The claim to use to uniquely identify\nthe set of groups to which the user belongs; this will be used as the names\nfor the Identity group aliases created due to a successful login. The claim\nvalue must be a list of strings.\n" }, "maxAge": { "type": "integer", "description": "Specifies the allowable elapsed time in seconds since the last time \nthe user was actively authenticated with the OIDC provider.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notBeforeLeeway": { "type": "integer", "description": "The amount of leeway to add to not before (\u003cspan pulumi-lang-nodejs=\"`nbf`\" pulumi-lang-dotnet=\"`Nbf`\" pulumi-lang-go=\"`nbf`\" pulumi-lang-python=\"`nbf`\" pulumi-lang-yaml=\"`nbf`\" pulumi-lang-java=\"`nbf`\" pulumi-lang-hcl=\"`nbf`\"\u003e`nbf`\u003c/span\u003e) claims to account for\nclock skew, in seconds. Defaults to \u003cspan pulumi-lang-nodejs=\"`150`\" pulumi-lang-dotnet=\"`150`\" pulumi-lang-go=\"`150`\" pulumi-lang-python=\"`150`\" pulumi-lang-yaml=\"`150`\" pulumi-lang-java=\"`150`\" pulumi-lang-hcl=\"`150`\"\u003e`150`\u003c/span\u003e seconds if set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e and can be disabled if set to `-1`.\nOnly applicable with \"jwt\" roles.\n" }, "oidcScopes": { "type": "array", "items": { "type": "string" }, "description": "If set, a list of OIDC scopes to be used with an OIDC role.\nThe standard scope \"openid\" is automatically included and need not be specified.\n" }, "roleName": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "roleType": { "type": "string", "description": "Type of role, either \"oidc\" (default) or \"jwt\".\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "userClaim": { "type": "string", "description": "The claim to use to uniquely identify\nthe user; this will be used as the name for the Identity entity alias created\ndue to a successful login.\n" }, "userClaimJsonPointer": { "type": "boolean", "description": "Specifies if the \u003cspan pulumi-lang-nodejs=\"`userClaim`\" pulumi-lang-dotnet=\"`UserClaim`\" pulumi-lang-go=\"`userClaim`\" pulumi-lang-python=\"`user_claim`\" pulumi-lang-yaml=\"`userClaim`\" pulumi-lang-java=\"`userClaim`\" pulumi-lang-hcl=\"`user_claim`\"\u003e`userClaim`\u003c/span\u003e value uses\n[JSON pointer](https://www.vaultproject.io/docs/auth/jwt#claim-specifications-and-json-pointer)\nsyntax for referencing claims. By default, the \u003cspan pulumi-lang-nodejs=\"`userClaim`\" pulumi-lang-dotnet=\"`UserClaim`\" pulumi-lang-go=\"`userClaim`\" pulumi-lang-python=\"`user_claim`\" pulumi-lang-yaml=\"`userClaim`\" pulumi-lang-java=\"`userClaim`\" pulumi-lang-hcl=\"`user_claim`\"\u003e`userClaim`\u003c/span\u003e value will not use JSON pointer.\nRequires Vault 1.11+.\n" }, "verboseOidcLogging": { "type": "boolean", "description": "Log received OIDC tokens and claims when debug-level\nlogging is active. Not recommended in production since sensitive information may be present\nin OIDC responses.\n" } }, "type": "object" } }, "vault:keymgmt/awsKms:AwsKms": { "description": "Manages an AWS KMS provider in the Vault Key Management secrets engine. This resource configures Vault to integrate with AWS Key Management Service, allowing keys created in Vault to be distributed to AWS KMS for use in AWS services.\n\nOnce configured, keys can be distributed to AWS KMS using the \u003cspan pulumi-lang-nodejs=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-dotnet=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-go=\"`keymgmt.DistributeKey`\" pulumi-lang-python=\"`keymgmt.DistributeKey`\" pulumi-lang-yaml=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-java=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-hcl=\"`vault_keymgmt_distribute_key`\"\u003e`vault.keymgmt.DistributeKey`\u003c/span\u003e resource.\n\n\u003e **Important** This resource requires **Terraform 1.11+** for write-only attribute support.\nThe \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e field is write-only and will never be stored in Terraform state.\nSee the main provider documentation for more details.\n\nFor more information on managing AWS KMS with Vault, please refer to the Vault [documentation](https://developer.hashicorp.com/vault/docs/secrets/key-management).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n### Basic Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst keymgmt = new vault.Mount(\"keymgmt\", {\n path: \"keymgmt\",\n type: \"keymgmt\",\n});\nconst usWest = new vault.keymgmt.AwsKms(\"us_west\", {\n mount: keymgmt.path,\n name: \"aws-us-west-2\",\n keyCollection: \"us-west-2\",\n credentialsWo: {\n access_key: awsAccessKeyId,\n secret_key: awsSecretAccessKey,\n },\n credentialsWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkeymgmt = vault.Mount(\"keymgmt\",\n path=\"keymgmt\",\n type=\"keymgmt\")\nus_west = vault.keymgmt.AwsKms(\"us_west\",\n mount=keymgmt.path,\n name=\"aws-us-west-2\",\n key_collection=\"us-west-2\",\n credentials_wo={\n \"access_key\": aws_access_key_id,\n \"secret_key\": aws_secret_access_key,\n },\n credentials_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var keymgmt = new Vault.Mount(\"keymgmt\", new()\n {\n Path = \"keymgmt\",\n Type = \"keymgmt\",\n });\n\n var usWest = new Vault.KeyMgmt.AwsKms(\"us_west\", new()\n {\n Mount = keymgmt.Path,\n Name = \"aws-us-west-2\",\n KeyCollection = \"us-west-2\",\n CredentialsWo = \n {\n { \"access_key\", awsAccessKeyId },\n { \"secret_key\", awsSecretAccessKey },\n },\n CredentialsWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkeymgmt2, err := vault.NewMount(ctx, \"keymgmt\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"keymgmt\"),\n\t\t\tType: pulumi.String(\"keymgmt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewAwsKms(ctx, \"us_west\", \u0026keymgmt.AwsKmsArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"aws-us-west-2\"),\n\t\t\tKeyCollection: pulumi.String(\"us-west-2\"),\n\t\t\tCredentialsWo: pulumi.StringMap{\n\t\t\t\t\"access_key\": pulumi.Any(awsAccessKeyId),\n\t\t\t\t\"secret_key\": pulumi.Any(awsSecretAccessKey),\n\t\t\t},\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"keymgmt\" {\n path = \"keymgmt\"\n type = \"keymgmt\"\n}\nresource \"vault_keymgmt_awskms\" \"us_west\" {\n mount = vault_mount.keymgmt.path\n name = \"aws-us-west-2\"\n key_collection = \"us-west-2\"\n credentials_wo = {\n \"access_key\" = awsAccessKeyId\n \"secret_key\" = awsSecretAccessKey\n }\n credentials_wo_version = 1\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.keymgmt.AwsKms;\nimport com.pulumi.vault.keymgmt.AwsKmsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var keymgmt = new Mount(\"keymgmt\", MountArgs.builder()\n .path(\"keymgmt\")\n .type(\"keymgmt\")\n .build());\n\n var usWest = new AwsKms(\"usWest\", AwsKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"aws-us-west-2\")\n .keyCollection(\"us-west-2\")\n .credentialsWo(Map.ofEntries(\n Map.entry(\"access_key\", awsAccessKeyId),\n Map.entry(\"secret_key\", awsSecretAccessKey)\n ))\n .credentialsWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n keymgmt:\n type: vault:Mount\n properties:\n path: keymgmt\n type: keymgmt\n usWest:\n type: vault:keymgmt:AwsKms\n name: us_west\n properties:\n mount: ${keymgmt.path}\n name: aws-us-west-2\n keyCollection: us-west-2\n credentialsWo:\n access_key: ${awsAccessKeyId}\n secret_key: ${awsSecretAccessKey}\n credentialsWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using AWS Environment Variables or IAM Roles\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\n// When credentials are not provided, Vault will use AWS SDK's credential chain:\n// 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)\n// 2. Shared credentials file (~/.aws/credentials)\n// 3. IAM instance profile (when running on EC2)\n// 4. ECS task credentials (when running on ECS)\nconst production = new vault.keymgmt.AwsKms(\"production\", {\n mount: keymgmt.path,\n name: \"aws-production\",\n keyCollection: \"us-east-1\",\n});\n// Distribute a key to AWS KMS\nconst encryptionKey = new vault.keymgmt.Key(\"encryption_key\", {\n mount: keymgmt.path,\n name: \"aws-encryption-key\",\n type: \"aes256-gcm96\",\n});\nconst awsDist = new vault.keymgmt.DistributeKey(\"aws_dist\", {\n path: keymgmt.path,\n kmsName: production.name,\n keyName: encryptionKey.name,\n purposes: [\n \"encrypt\",\n \"decrypt\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\n# When credentials are not provided, Vault will use AWS SDK's credential chain:\n# 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)\n# 2. Shared credentials file (~/.aws/credentials)\n# 3. IAM instance profile (when running on EC2)\n# 4. ECS task credentials (when running on ECS)\nproduction = vault.keymgmt.AwsKms(\"production\",\n mount=keymgmt[\"path\"],\n name=\"aws-production\",\n key_collection=\"us-east-1\")\n# Distribute a key to AWS KMS\nencryption_key = vault.keymgmt.Key(\"encryption_key\",\n mount=keymgmt[\"path\"],\n name=\"aws-encryption-key\",\n type=\"aes256-gcm96\")\naws_dist = vault.keymgmt.DistributeKey(\"aws_dist\",\n path=keymgmt[\"path\"],\n kms_name=production.name,\n key_name=encryption_key.name,\n purposes=[\n \"encrypt\",\n \"decrypt\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n // When credentials are not provided, Vault will use AWS SDK's credential chain:\n // 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)\n // 2. Shared credentials file (~/.aws/credentials)\n // 3. IAM instance profile (when running on EC2)\n // 4. ECS task credentials (when running on ECS)\n var production = new Vault.KeyMgmt.AwsKms(\"production\", new()\n {\n Mount = keymgmt.Path,\n Name = \"aws-production\",\n KeyCollection = \"us-east-1\",\n });\n\n // Distribute a key to AWS KMS\n var encryptionKey = new Vault.KeyMgmt.Key(\"encryption_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"aws-encryption-key\",\n Type = \"aes256-gcm96\",\n });\n\n var awsDist = new Vault.KeyMgmt.DistributeKey(\"aws_dist\", new()\n {\n Path = keymgmt.Path,\n KmsName = production.Name,\n KeyName = encryptionKey.Name,\n Purposes = new[]\n {\n \"encrypt\",\n \"decrypt\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t// When credentials are not provided, Vault will use AWS SDK's credential chain:\n\t\t// 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)\n\t\t// 2. Shared credentials file (~/.aws/credentials)\n\t\t// 3. IAM instance profile (when running on EC2)\n\t\t// 4. ECS task credentials (when running on ECS)\n\t\tproduction, err := keymgmt.NewAwsKms(ctx, \"production\", \u0026keymgmt.AwsKmsArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"aws-production\"),\n\t\t\tKeyCollection: pulumi.String(\"us-east-1\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// Distribute a key to AWS KMS\n\t\tencryptionKey, err := keymgmt.NewKey(ctx, \"encryption_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"aws-encryption-key\"),\n\t\t\tType: pulumi.String(\"aes256-gcm96\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewDistributeKey(ctx, \"aws_dist\", \u0026keymgmt.DistributeKeyArgs{\n\t\t\tPath: keymgmt.Path,\n\t\t\tKmsName: production.Name,\n\t\t\tKeyName: encryptionKey.Name,\n\t\t\tPurposes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"encrypt\"),\n\t\t\t\tpulumi.String(\"decrypt\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\n# When credentials are not provided, Vault will use AWS SDK's credential chain:\n# 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)\n# 2. Shared credentials file (~/.aws/credentials)\n# 3. IAM instance profile (when running on EC2)\n# 4. ECS task credentials (when running on ECS)\nresource \"vault_keymgmt_awskms\" \"production\" {\n mount = keymgmt.path\n name = \"aws-production\"\n key_collection = \"us-east-1\"\n}\n# Distribute a key to AWS KMS\nresource \"vault_keymgmt_key\" \"encryption_key\" {\n mount = keymgmt.path\n name = \"aws-encryption-key\"\n type = \"aes256-gcm96\"\n}\nresource \"vault_keymgmt_distributekey\" \"aws_dist\" {\n path = keymgmt.path\n kms_name = vault_keymgmt_awskms.production.name\n key_name = vault_keymgmt_key.encryption_key.name\n purposes = [\"encrypt\", \"decrypt\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.keymgmt.AwsKms;\nimport com.pulumi.vault.keymgmt.AwsKmsArgs;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport com.pulumi.vault.keymgmt.DistributeKey;\nimport com.pulumi.vault.keymgmt.DistributeKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n // When credentials are not provided, Vault will use AWS SDK's credential chain:\n // 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)\n // 2. Shared credentials file (~/.aws/credentials)\n // 3. IAM instance profile (when running on EC2)\n // 4. ECS task credentials (when running on ECS)\n var production = new AwsKms(\"production\", AwsKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"aws-production\")\n .keyCollection(\"us-east-1\")\n .build());\n\n // Distribute a key to AWS KMS\n var encryptionKey = new Key(\"encryptionKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"aws-encryption-key\")\n .type(\"aes256-gcm96\")\n .build());\n\n var awsDist = new DistributeKey(\"awsDist\", DistributeKeyArgs.builder()\n .path(keymgmt.path())\n .kmsName(production.name())\n .keyName(encryptionKey.name())\n .purposes( \n \"encrypt\",\n \"decrypt\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n # When credentials are not provided, Vault will use AWS SDK's credential chain:\n # 1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)\n # 2. Shared credentials file (~/.aws/credentials)\n # 3. IAM instance profile (when running on EC2)\n # 4. ECS task credentials (when running on ECS)\n production:\n type: vault:keymgmt:AwsKms\n properties:\n mount: ${keymgmt.path}\n name: aws-production\n keyCollection: us-east-1\n # Distribute a key to AWS KMS\n encryptionKey:\n type: vault:keymgmt:Key\n name: encryption_key\n properties:\n mount: ${keymgmt.path}\n name: aws-encryption-key\n type: aes256-gcm96\n awsDist:\n type: vault:keymgmt:DistributeKey\n name: aws_dist\n properties:\n path: ${keymgmt.path}\n kmsName: ${production.name}\n keyName: ${encryptionKey.name}\n purposes:\n - encrypt\n - decrypt\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAWS KMS providers can be imported using the format `{path}/kms/{name}`, e.g.\n\n```sh\n$ pulumi import vault:keymgmt/awsKms:AwsKms us_west keymgmt/kms/aws-us-west-2\n```\n\n\u003e **Note:** Import sets the \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e attribute from the import ID. The \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`credentialsWoVersion`\" pulumi-lang-dotnet=\"`CredentialsWoVersion`\" pulumi-lang-go=\"`credentialsWoVersion`\" pulumi-lang-python=\"`credentials_wo_version`\" pulumi-lang-yaml=\"`credentialsWoVersion`\" pulumi-lang-java=\"`credentialsWoVersion`\" pulumi-lang-hcl=\"`credentials_wo_version`\"\u003e`credentialsWoVersion`\u003c/span\u003e fields will not be populated as they are not returned by the Vault API. You must supply these values in your configuration after import. The corresponding \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource must also be present in your configuration (or separately imported).\n\n", "properties": { "credentialsWo": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state.\nThe following values are supported:\n", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.\n" }, "keyCollection": { "type": "string", "description": "Refers to the name of an AWS region. Cannot be changed after creation.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the AWS KMS provider. Cannot be changed after creation.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "keyCollection", "mount", "name" ], "inputProperties": { "credentialsWo": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state.\nThe following values are supported:\n", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.\n" }, "keyCollection": { "type": "string", "description": "Refers to the name of an AWS region. Cannot be changed after creation.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the AWS KMS provider. Cannot be changed after creation.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "keyCollection", "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering AwsKms resources.\n", "properties": { "credentialsWo": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe credentials to use for authentication with AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Credentials provided to this parameter will take precedence over credentials provided via environment variables. This value is write-only and will not be stored in Terraform state.\nThe following values are supported:\n", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.\n" }, "keyCollection": { "type": "string", "description": "Refers to the name of an AWS region. Cannot be changed after creation.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the AWS KMS provider. Cannot be changed after creation.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:keymgmt/azureKms:AzureKms": { "description": "Manages an Azure Key Vault provider in the Vault Key Management secrets engine. This resource configures Vault to integrate with Azure Key Vault, allowing keys created in Vault to be distributed to Azure Key Vault for use in Azure services.\n\nOnce configured, keys can be distributed to Azure Key Vault using the \u003cspan pulumi-lang-nodejs=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-dotnet=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-go=\"`keymgmt.DistributeKey`\" pulumi-lang-python=\"`keymgmt.DistributeKey`\" pulumi-lang-yaml=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-java=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-hcl=\"`vault_keymgmt_distribute_key`\"\u003e`vault.keymgmt.DistributeKey`\u003c/span\u003e resource.\n\n\u003e **Important** This resource requires **Terraform 1.11+** for write-only attribute support.\nThe \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e field is write-only and will never be stored in Terraform state.\nSee the main provider documentation for more details.\n\nFor more information on managing Azure Key Vault with Vault, please refer to the Vault [documentation](https://developer.hashicorp.com/vault/docs/secrets/key-management).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n### Using Explicit Credentials\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst keymgmt = new vault.Mount(\"keymgmt\", {\n path: \"keymgmt\",\n type: \"keymgmt\",\n});\nconst production = new vault.keymgmt.AzureKms(\"production\", {\n mount: keymgmt.path,\n name: \"azure-production\",\n keyCollection: \"my-keyvault\",\n credentialsWo: {\n tenant_id: azureTenantId,\n client_id: azureClientId,\n client_secret: azureClientSecret,\n environment: \"AzurePublicCloud\",\n },\n credentialsWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkeymgmt = vault.Mount(\"keymgmt\",\n path=\"keymgmt\",\n type=\"keymgmt\")\nproduction = vault.keymgmt.AzureKms(\"production\",\n mount=keymgmt.path,\n name=\"azure-production\",\n key_collection=\"my-keyvault\",\n credentials_wo={\n \"tenant_id\": azure_tenant_id,\n \"client_id\": azure_client_id,\n \"client_secret\": azure_client_secret,\n \"environment\": \"AzurePublicCloud\",\n },\n credentials_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var keymgmt = new Vault.Mount(\"keymgmt\", new()\n {\n Path = \"keymgmt\",\n Type = \"keymgmt\",\n });\n\n var production = new Vault.KeyMgmt.AzureKms(\"production\", new()\n {\n Mount = keymgmt.Path,\n Name = \"azure-production\",\n KeyCollection = \"my-keyvault\",\n CredentialsWo = \n {\n { \"tenant_id\", azureTenantId },\n { \"client_id\", azureClientId },\n { \"client_secret\", azureClientSecret },\n { \"environment\", \"AzurePublicCloud\" },\n },\n CredentialsWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkeymgmt2, err := vault.NewMount(ctx, \"keymgmt\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"keymgmt\"),\n\t\t\tType: pulumi.String(\"keymgmt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewAzureKms(ctx, \"production\", \u0026keymgmt.AzureKmsArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"azure-production\"),\n\t\t\tKeyCollection: pulumi.String(\"my-keyvault\"),\n\t\t\tCredentialsWo: pulumi.StringMap{\n\t\t\t\t\"tenant_id\": pulumi.Any(azureTenantId),\n\t\t\t\t\"client_id\": pulumi.Any(azureClientId),\n\t\t\t\t\"client_secret\": pulumi.Any(azureClientSecret),\n\t\t\t\t\"environment\": pulumi.String(\"AzurePublicCloud\"),\n\t\t\t},\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"keymgmt\" {\n path = \"keymgmt\"\n type = \"keymgmt\"\n}\nresource \"vault_keymgmt_azurekms\" \"production\" {\n mount = vault_mount.keymgmt.path\n name = \"azure-production\"\n key_collection = \"my-keyvault\"\n credentials_wo = {\n \"tenant_id\" = azureTenantId\n \"client_id\" = azureClientId\n \"client_secret\" = azureClientSecret\n \"environment\" = \"AzurePublicCloud\"\n }\n credentials_wo_version = 1\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.keymgmt.AzureKms;\nimport com.pulumi.vault.keymgmt.AzureKmsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var keymgmt = new Mount(\"keymgmt\", MountArgs.builder()\n .path(\"keymgmt\")\n .type(\"keymgmt\")\n .build());\n\n var production = new AzureKms(\"production\", AzureKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"azure-production\")\n .keyCollection(\"my-keyvault\")\n .credentialsWo(Map.ofEntries(\n Map.entry(\"tenant_id\", azureTenantId),\n Map.entry(\"client_id\", azureClientId),\n Map.entry(\"client_secret\", azureClientSecret),\n Map.entry(\"environment\", \"AzurePublicCloud\")\n ))\n .credentialsWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n keymgmt:\n type: vault:Mount\n properties:\n path: keymgmt\n type: keymgmt\n production:\n type: vault:keymgmt:AzureKms\n properties:\n mount: ${keymgmt.path}\n name: azure-production\n keyCollection: my-keyvault\n credentialsWo:\n tenant_id: ${azureTenantId}\n client_id: ${azureClientId}\n client_secret: ${azureClientSecret}\n environment: AzurePublicCloud\n credentialsWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Azure Environment Variables or Managed Identity\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\n// When credentials_wo is not provided, Vault uses its own environment to\n// authenticate with Azure. Supported options include:\n// 1. Environment variables set on the Vault server:\n// AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET\n// 2. Azure Managed Identity (when Vault runs on an Azure VM or service\n// with an assigned identity)\nconst keymgmt = new vault.Mount(\"keymgmt\", {\n path: \"keymgmt\",\n type: \"keymgmt\",\n});\nconst production = new vault.keymgmt.AzureKms(\"production\", {\n mount: keymgmt.path,\n name: \"azure-production\",\n keyCollection: \"my-keyvault\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\n# When credentials_wo is not provided, Vault uses its own environment to\n# authenticate with Azure. Supported options include:\n# 1. Environment variables set on the Vault server:\n# AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET\n# 2. Azure Managed Identity (when Vault runs on an Azure VM or service\n# with an assigned identity)\nkeymgmt = vault.Mount(\"keymgmt\",\n path=\"keymgmt\",\n type=\"keymgmt\")\nproduction = vault.keymgmt.AzureKms(\"production\",\n mount=keymgmt.path,\n name=\"azure-production\",\n key_collection=\"my-keyvault\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n // When credentials_wo is not provided, Vault uses its own environment to\n // authenticate with Azure. Supported options include:\n // 1. Environment variables set on the Vault server:\n // AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET\n // 2. Azure Managed Identity (when Vault runs on an Azure VM or service\n // with an assigned identity)\n var keymgmt = new Vault.Mount(\"keymgmt\", new()\n {\n Path = \"keymgmt\",\n Type = \"keymgmt\",\n });\n\n var production = new Vault.KeyMgmt.AzureKms(\"production\", new()\n {\n Mount = keymgmt.Path,\n Name = \"azure-production\",\n KeyCollection = \"my-keyvault\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t// When credentials_wo is not provided, Vault uses its own environment to\n\t\t// authenticate with Azure. Supported options include:\n\t\t// 1. Environment variables set on the Vault server:\n\t\t// AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET\n\t\t// 2. Azure Managed Identity (when Vault runs on an Azure VM or service\n\t\t// with an assigned identity)\n\t\tkeymgmt2, err := vault.NewMount(ctx, \"keymgmt\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"keymgmt\"),\n\t\t\tType: pulumi.String(\"keymgmt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewAzureKms(ctx, \"production\", \u0026keymgmt.AzureKmsArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"azure-production\"),\n\t\t\tKeyCollection: pulumi.String(\"my-keyvault\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\n# When credentials_wo is not provided, Vault uses its own environment to\n# authenticate with Azure. Supported options include:\n# 1. Environment variables set on the Vault server:\n# AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET\n# 2. Azure Managed Identity (when Vault runs on an Azure VM or service\n# with an assigned identity)\nresource \"vault_mount\" \"keymgmt\" {\n path = \"keymgmt\"\n type = \"keymgmt\"\n}\nresource \"vault_keymgmt_azurekms\" \"production\" {\n mount = vault_mount.keymgmt.path\n name = \"azure-production\"\n key_collection = \"my-keyvault\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.keymgmt.AzureKms;\nimport com.pulumi.vault.keymgmt.AzureKmsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n // When credentials_wo is not provided, Vault uses its own environment to\n // authenticate with Azure. Supported options include:\n // 1. Environment variables set on the Vault server:\n // AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET\n // 2. Azure Managed Identity (when Vault runs on an Azure VM or service\n // with an assigned identity)\n var keymgmt = new Mount(\"keymgmt\", MountArgs.builder()\n .path(\"keymgmt\")\n .type(\"keymgmt\")\n .build());\n\n var production = new AzureKms(\"production\", AzureKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"azure-production\")\n .keyCollection(\"my-keyvault\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n # When credentials_wo is not provided, Vault uses its own environment to\n # authenticate with Azure. Supported options include:\n # 1. Environment variables set on the Vault server:\n # AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET\n # 2. Azure Managed Identity (when Vault runs on an Azure VM or service\n # with an assigned identity)\n keymgmt:\n type: vault:Mount\n properties:\n path: keymgmt\n type: keymgmt\n production:\n type: vault:keymgmt:AzureKms\n properties:\n mount: ${keymgmt.path}\n name: azure-production\n keyCollection: my-keyvault\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAzure Key Vault providers can be imported using the format `{path}/kms/{name}`, e.g.\n\n```sh\n$ pulumi import vault:keymgmt/azureKms:AzureKms production keymgmt/kms/azure-production\n```\n\n\u003e **Note:** Import sets the \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e attribute from the import ID. The \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`credentialsWoVersion`\" pulumi-lang-dotnet=\"`CredentialsWoVersion`\" pulumi-lang-go=\"`credentialsWoVersion`\" pulumi-lang-python=\"`credentials_wo_version`\" pulumi-lang-yaml=\"`credentialsWoVersion`\" pulumi-lang-java=\"`credentialsWoVersion`\" pulumi-lang-hcl=\"`credentials_wo_version`\"\u003e`credentialsWoVersion`\u003c/span\u003e fields will not be populated as they are not returned by the Vault API. You must supply these values in your configuration after import. The corresponding \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource must also be present in your configuration (or separately imported).\n\n", "properties": { "credentialsWo": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state.\nThe following values are supported:\n", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.\n" }, "keyCollection": { "type": "string", "description": "Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "keyCollection", "mount", "name" ], "inputProperties": { "credentialsWo": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state.\nThe following values are supported:\n", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.\n" }, "keyCollection": { "type": "string", "description": "Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "keyCollection", "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering AzureKms resources.\n", "properties": { "credentialsWo": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe credentials to use for authentication with Azure Key Vault. Supplying values for this parameter is optional, as credentials may also be specified as environment variables. Environment variables will take precedence over credentials provided via this parameter. This value is write-only and will not be stored in Terraform state.\nThe following values are supported:\n", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.\n" }, "keyCollection": { "type": "string", "description": "Refers to the name of an existing Azure Key Vault instance. Cannot be changed after creation.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the Azure Key Vault provider. Cannot be changed after creation.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:keymgmt/distributeKey:DistributeKey": { "description": "Distributes a key from Vault's Key Management secrets engine to an external Key Management Service provider (AWS KMS, Azure Key Vault, or GCP Cloud KMS). This resource manages the distribution of cryptographic keys to external KMS systems, allowing them to be used for encryption, decryption, signing, and verification operations in cloud environments.\n\n\u003e **Important**\nAll data provided in the resource configuration will be written in cleartext to\nstate and plan files generated by Terraform, and will appear in the console\noutput when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.\n\nFor more information on distributing keys with Vault, please refer to the Vault [documentation](https://developer.hashicorp.com/vault/docs/secrets/key-management).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n### Distribute to AWS KMS\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst keymgmt = new vault.Mount(\"keymgmt\", {\n path: \"keymgmt\",\n type: \"keymgmt\",\n});\nconst encryptionKey = new vault.keymgmt.Key(\"encryption_key\", {\n mount: keymgmt.path,\n name: \"aws-encryption-key\",\n type: \"aes256-gcm96\",\n});\nconst aws = new vault.keymgmt.AwsKms(\"aws\", {\n mount: keymgmt.path,\n name: \"aws-kms\",\n keyCollection: \"us-west-2\",\n credentialsWo: {\n access_key: awsAccessKeyId,\n secret_key: awsSecretAccessKey,\n },\n credentialsWoVersion: 1,\n});\nconst awsDist = new vault.keymgmt.DistributeKey(\"aws_dist\", {\n mount: keymgmt.path,\n kmsName: aws.name,\n keyName: encryptionKey.name,\n purposes: [\n \"encrypt\",\n \"decrypt\",\n ],\n protection: \"hsm\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkeymgmt = vault.Mount(\"keymgmt\",\n path=\"keymgmt\",\n type=\"keymgmt\")\nencryption_key = vault.keymgmt.Key(\"encryption_key\",\n mount=keymgmt.path,\n name=\"aws-encryption-key\",\n type=\"aes256-gcm96\")\naws = vault.keymgmt.AwsKms(\"aws\",\n mount=keymgmt.path,\n name=\"aws-kms\",\n key_collection=\"us-west-2\",\n credentials_wo={\n \"access_key\": aws_access_key_id,\n \"secret_key\": aws_secret_access_key,\n },\n credentials_wo_version=1)\naws_dist = vault.keymgmt.DistributeKey(\"aws_dist\",\n mount=keymgmt.path,\n kms_name=aws.name,\n key_name=encryption_key.name,\n purposes=[\n \"encrypt\",\n \"decrypt\",\n ],\n protection=\"hsm\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var keymgmt = new Vault.Mount(\"keymgmt\", new()\n {\n Path = \"keymgmt\",\n Type = \"keymgmt\",\n });\n\n var encryptionKey = new Vault.KeyMgmt.Key(\"encryption_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"aws-encryption-key\",\n Type = \"aes256-gcm96\",\n });\n\n var aws = new Vault.KeyMgmt.AwsKms(\"aws\", new()\n {\n Mount = keymgmt.Path,\n Name = \"aws-kms\",\n KeyCollection = \"us-west-2\",\n CredentialsWo = \n {\n { \"access_key\", awsAccessKeyId },\n { \"secret_key\", awsSecretAccessKey },\n },\n CredentialsWoVersion = 1,\n });\n\n var awsDist = new Vault.KeyMgmt.DistributeKey(\"aws_dist\", new()\n {\n Mount = keymgmt.Path,\n KmsName = aws.Name,\n KeyName = encryptionKey.Name,\n Purposes = new[]\n {\n \"encrypt\",\n \"decrypt\",\n },\n Protection = \"hsm\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkeymgmt2, err := vault.NewMount(ctx, \"keymgmt\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"keymgmt\"),\n\t\t\tType: pulumi.String(\"keymgmt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tencryptionKey, err := keymgmt.NewKey(ctx, \"encryption_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"aws-encryption-key\"),\n\t\t\tType: pulumi.String(\"aes256-gcm96\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\taws, err := keymgmt.NewAwsKms(ctx, \"aws\", \u0026keymgmt.AwsKmsArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"aws-kms\"),\n\t\t\tKeyCollection: pulumi.String(\"us-west-2\"),\n\t\t\tCredentialsWo: pulumi.StringMap{\n\t\t\t\t\"access_key\": pulumi.Any(awsAccessKeyId),\n\t\t\t\t\"secret_key\": pulumi.Any(awsSecretAccessKey),\n\t\t\t},\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewDistributeKey(ctx, \"aws_dist\", \u0026keymgmt.DistributeKeyArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tKmsName: aws.Name,\n\t\t\tKeyName: encryptionKey.Name,\n\t\t\tPurposes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"encrypt\"),\n\t\t\t\tpulumi.String(\"decrypt\"),\n\t\t\t},\n\t\t\tProtection: pulumi.String(\"hsm\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"keymgmt\" {\n path = \"keymgmt\"\n type = \"keymgmt\"\n}\nresource \"vault_keymgmt_key\" \"encryption_key\" {\n mount = vault_mount.keymgmt.path\n name = \"aws-encryption-key\"\n type = \"aes256-gcm96\"\n}\nresource \"vault_keymgmt_awskms\" \"aws\" {\n mount = vault_mount.keymgmt.path\n name = \"aws-kms\"\n key_collection = \"us-west-2\"\n credentials_wo = {\n \"access_key\" = awsAccessKeyId\n \"secret_key\" = awsSecretAccessKey\n }\n credentials_wo_version = 1\n}\nresource \"vault_keymgmt_distributekey\" \"aws_dist\" {\n mount = vault_mount.keymgmt.path\n kms_name = vault_keymgmt_awskms.aws.name\n key_name = vault_keymgmt_key.encryption_key.name\n purposes = [\"encrypt\", \"decrypt\"]\n protection = \"hsm\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport com.pulumi.vault.keymgmt.AwsKms;\nimport com.pulumi.vault.keymgmt.AwsKmsArgs;\nimport com.pulumi.vault.keymgmt.DistributeKey;\nimport com.pulumi.vault.keymgmt.DistributeKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var keymgmt = new Mount(\"keymgmt\", MountArgs.builder()\n .path(\"keymgmt\")\n .type(\"keymgmt\")\n .build());\n\n var encryptionKey = new Key(\"encryptionKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"aws-encryption-key\")\n .type(\"aes256-gcm96\")\n .build());\n\n var aws = new AwsKms(\"aws\", AwsKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"aws-kms\")\n .keyCollection(\"us-west-2\")\n .credentialsWo(Map.ofEntries(\n Map.entry(\"access_key\", awsAccessKeyId),\n Map.entry(\"secret_key\", awsSecretAccessKey)\n ))\n .credentialsWoVersion(1)\n .build());\n\n var awsDist = new DistributeKey(\"awsDist\", DistributeKeyArgs.builder()\n .mount(keymgmt.path())\n .kmsName(aws.name())\n .keyName(encryptionKey.name())\n .purposes( \n \"encrypt\",\n \"decrypt\")\n .protection(\"hsm\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n keymgmt:\n type: vault:Mount\n properties:\n path: keymgmt\n type: keymgmt\n encryptionKey:\n type: vault:keymgmt:Key\n name: encryption_key\n properties:\n mount: ${keymgmt.path}\n name: aws-encryption-key\n type: aes256-gcm96\n aws:\n type: vault:keymgmt:AwsKms\n properties:\n mount: ${keymgmt.path}\n name: aws-kms\n keyCollection: us-west-2\n credentialsWo:\n access_key: ${awsAccessKeyId}\n secret_key: ${awsSecretAccessKey}\n credentialsWoVersion: 1\n awsDist:\n type: vault:keymgmt:DistributeKey\n name: aws_dist\n properties:\n mount: ${keymgmt.path}\n kmsName: ${aws.name}\n keyName: ${encryptionKey.name}\n purposes:\n - encrypt\n - decrypt\n protection: hsm\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Distribute to AWS KMS (Using Environment Variables)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\n// When AWS credentials are configured via environment variables or IAM roles\n// on the Vault server, you can omit access_key and secret_key\nconst aws = new vault.keymgmt.AwsKms(\"aws\", {\n mount: keymgmt.path,\n name: \"aws-kms\",\n keyCollection: \"us-west-2\",\n});\nconst awsDist = new vault.keymgmt.DistributeKey(\"aws_dist\", {\n mount: keymgmt.path,\n kmsName: aws.name,\n keyName: encryptionKey.name,\n purposes: [\n \"encrypt\",\n \"decrypt\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\n# When AWS credentials are configured via environment variables or IAM roles\n# on the Vault server, you can omit access_key and secret_key\naws = vault.keymgmt.AwsKms(\"aws\",\n mount=keymgmt[\"path\"],\n name=\"aws-kms\",\n key_collection=\"us-west-2\")\naws_dist = vault.keymgmt.DistributeKey(\"aws_dist\",\n mount=keymgmt[\"path\"],\n kms_name=aws.name,\n key_name=encryption_key[\"name\"],\n purposes=[\n \"encrypt\",\n \"decrypt\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n // When AWS credentials are configured via environment variables or IAM roles\n // on the Vault server, you can omit access_key and secret_key\n var aws = new Vault.KeyMgmt.AwsKms(\"aws\", new()\n {\n Mount = keymgmt.Path,\n Name = \"aws-kms\",\n KeyCollection = \"us-west-2\",\n });\n\n var awsDist = new Vault.KeyMgmt.DistributeKey(\"aws_dist\", new()\n {\n Mount = keymgmt.Path,\n KmsName = aws.Name,\n KeyName = encryptionKey.Name,\n Purposes = new[]\n {\n \"encrypt\",\n \"decrypt\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t// When AWS credentials are configured via environment variables or IAM roles\n\t\t// on the Vault server, you can omit access_key and secret_key\n\t\taws, err := keymgmt.NewAwsKms(ctx, \"aws\", \u0026keymgmt.AwsKmsArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"aws-kms\"),\n\t\t\tKeyCollection: pulumi.String(\"us-west-2\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewDistributeKey(ctx, \"aws_dist\", \u0026keymgmt.DistributeKeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tKmsName: aws.Name,\n\t\t\tKeyName: pulumi.Any(encryptionKey.Name),\n\t\t\tPurposes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"encrypt\"),\n\t\t\t\tpulumi.String(\"decrypt\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\n# When AWS credentials are configured via environment variables or IAM roles\n# on the Vault server, you can omit access_key and secret_key\nresource \"vault_keymgmt_awskms\" \"aws\" {\n mount = keymgmt.path\n name = \"aws-kms\"\n key_collection = \"us-west-2\"\n}\nresource \"vault_keymgmt_distributekey\" \"aws_dist\" {\n mount = keymgmt.path\n kms_name = vault_keymgmt_awskms.aws.name\n key_name = encryptionKey.name\n purposes = [\"encrypt\", \"decrypt\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.keymgmt.AwsKms;\nimport com.pulumi.vault.keymgmt.AwsKmsArgs;\nimport com.pulumi.vault.keymgmt.DistributeKey;\nimport com.pulumi.vault.keymgmt.DistributeKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n // When AWS credentials are configured via environment variables or IAM roles\n // on the Vault server, you can omit access_key and secret_key\n var aws = new AwsKms(\"aws\", AwsKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"aws-kms\")\n .keyCollection(\"us-west-2\")\n .build());\n\n var awsDist = new DistributeKey(\"awsDist\", DistributeKeyArgs.builder()\n .mount(keymgmt.path())\n .kmsName(aws.name())\n .keyName(encryptionKey.name())\n .purposes( \n \"encrypt\",\n \"decrypt\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n # When AWS credentials are configured via environment variables or IAM roles\n # on the Vault server, you can omit access_key and secret_key\n aws:\n type: vault:keymgmt:AwsKms\n properties:\n mount: ${keymgmt.path}\n name: aws-kms\n keyCollection: us-west-2\n awsDist:\n type: vault:keymgmt:DistributeKey\n name: aws_dist\n properties:\n mount: ${keymgmt.path}\n kmsName: ${aws.name}\n keyName: ${encryptionKey.name}\n purposes:\n - encrypt\n - decrypt\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Distribute to Azure Key Vault\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst signingKey = new vault.keymgmt.Key(\"signing_key\", {\n mount: keymgmt.path,\n name: \"azure-signing-key\",\n type: \"rsa-2048\",\n});\nconst azure = new vault.keymgmt.AzureKms(\"azure\", {\n mount: keymgmt.path,\n name: \"azure-kv\",\n keyCollection: \"my-keyvault\",\n credentialsWo: {\n tenant_id: azureTenantId,\n client_id: azureClientId,\n client_secret: azureClientSecret,\n },\n credentialsWoVersion: 1,\n});\nconst azureDist = new vault.keymgmt.DistributeKey(\"azure_dist\", {\n mount: keymgmt.path,\n kmsName: azure.name,\n keyName: signingKey.name,\n purposes: [\n \"sign\",\n \"verify\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nsigning_key = vault.keymgmt.Key(\"signing_key\",\n mount=keymgmt[\"path\"],\n name=\"azure-signing-key\",\n type=\"rsa-2048\")\nazure = vault.keymgmt.AzureKms(\"azure\",\n mount=keymgmt[\"path\"],\n name=\"azure-kv\",\n key_collection=\"my-keyvault\",\n credentials_wo={\n \"tenant_id\": azure_tenant_id,\n \"client_id\": azure_client_id,\n \"client_secret\": azure_client_secret,\n },\n credentials_wo_version=1)\nazure_dist = vault.keymgmt.DistributeKey(\"azure_dist\",\n mount=keymgmt[\"path\"],\n kms_name=azure.name,\n key_name=signing_key.name,\n purposes=[\n \"sign\",\n \"verify\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var signingKey = new Vault.KeyMgmt.Key(\"signing_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"azure-signing-key\",\n Type = \"rsa-2048\",\n });\n\n var azure = new Vault.KeyMgmt.AzureKms(\"azure\", new()\n {\n Mount = keymgmt.Path,\n Name = \"azure-kv\",\n KeyCollection = \"my-keyvault\",\n CredentialsWo = \n {\n { \"tenant_id\", azureTenantId },\n { \"client_id\", azureClientId },\n { \"client_secret\", azureClientSecret },\n },\n CredentialsWoVersion = 1,\n });\n\n var azureDist = new Vault.KeyMgmt.DistributeKey(\"azure_dist\", new()\n {\n Mount = keymgmt.Path,\n KmsName = azure.Name,\n KeyName = signingKey.Name,\n Purposes = new[]\n {\n \"sign\",\n \"verify\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tsigningKey, err := keymgmt.NewKey(ctx, \"signing_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"azure-signing-key\"),\n\t\t\tType: pulumi.String(\"rsa-2048\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tazure, err := keymgmt.NewAzureKms(ctx, \"azure\", \u0026keymgmt.AzureKmsArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"azure-kv\"),\n\t\t\tKeyCollection: pulumi.String(\"my-keyvault\"),\n\t\t\tCredentialsWo: pulumi.StringMap{\n\t\t\t\t\"tenant_id\": pulumi.Any(azureTenantId),\n\t\t\t\t\"client_id\": pulumi.Any(azureClientId),\n\t\t\t\t\"client_secret\": pulumi.Any(azureClientSecret),\n\t\t\t},\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewDistributeKey(ctx, \"azure_dist\", \u0026keymgmt.DistributeKeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tKmsName: azure.Name,\n\t\t\tKeyName: signingKey.Name,\n\t\t\tPurposes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"sign\"),\n\t\t\t\tpulumi.String(\"verify\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_keymgmt_key\" \"signing_key\" {\n mount = keymgmt.path\n name = \"azure-signing-key\"\n type = \"rsa-2048\"\n}\nresource \"vault_keymgmt_azurekms\" \"azure\" {\n mount = keymgmt.path\n name = \"azure-kv\"\n key_collection = \"my-keyvault\"\n credentials_wo = {\n \"tenant_id\" = azureTenantId\n \"client_id\" = azureClientId\n \"client_secret\" = azureClientSecret\n }\n credentials_wo_version = 1\n}\nresource \"vault_keymgmt_distributekey\" \"azure_dist\" {\n mount = keymgmt.path\n kms_name = vault_keymgmt_azurekms.azure.name\n key_name = vault_keymgmt_key.signing_key.name\n purposes = [\"sign\", \"verify\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport com.pulumi.vault.keymgmt.AzureKms;\nimport com.pulumi.vault.keymgmt.AzureKmsArgs;\nimport com.pulumi.vault.keymgmt.DistributeKey;\nimport com.pulumi.vault.keymgmt.DistributeKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var signingKey = new Key(\"signingKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"azure-signing-key\")\n .type(\"rsa-2048\")\n .build());\n\n var azure = new AzureKms(\"azure\", AzureKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"azure-kv\")\n .keyCollection(\"my-keyvault\")\n .credentialsWo(Map.ofEntries(\n Map.entry(\"tenant_id\", azureTenantId),\n Map.entry(\"client_id\", azureClientId),\n Map.entry(\"client_secret\", azureClientSecret)\n ))\n .credentialsWoVersion(1)\n .build());\n\n var azureDist = new DistributeKey(\"azureDist\", DistributeKeyArgs.builder()\n .mount(keymgmt.path())\n .kmsName(azure.name())\n .keyName(signingKey.name())\n .purposes( \n \"sign\",\n \"verify\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n signingKey:\n type: vault:keymgmt:Key\n name: signing_key\n properties:\n mount: ${keymgmt.path}\n name: azure-signing-key\n type: rsa-2048\n azure:\n type: vault:keymgmt:AzureKms\n properties:\n mount: ${keymgmt.path}\n name: azure-kv\n keyCollection: my-keyvault\n credentialsWo:\n tenant_id: ${azureTenantId}\n client_id: ${azureClientId}\n client_secret: ${azureClientSecret}\n credentialsWoVersion: 1\n azureDist:\n type: vault:keymgmt:DistributeKey\n name: azure_dist\n properties:\n mount: ${keymgmt.path}\n kmsName: ${azure.name}\n keyName: ${signingKey.name}\n purposes:\n - sign\n - verify\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Distribute to GCP Cloud KMS\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpKey = new vault.keymgmt.Key(\"gcp_key\", {\n mount: keymgmt.path,\n name: \"gcp-encryption-key\",\n type: \"aes256-gcm96\",\n});\nconst gcp = new vault.keymgmt.GcpKms(\"gcp\", {\n mount: keymgmt.path,\n name: \"gcp-kms\",\n keyCollection: \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n credentialsWo: {\n service_account_file: std.file({\n input: \"gcp-credentials.json\",\n }).then(invoke =\u003e invoke.result),\n project: \"my-project\",\n location: \"us-central1\",\n },\n credentialsWoVersion: 1,\n});\nconst gcpDist = new vault.keymgmt.DistributeKey(\"gcp_dist\", {\n mount: keymgmt.path,\n kmsName: gcp.name,\n keyName: gcpKey.name,\n purposes: [\n \"encrypt\",\n \"decrypt\",\n ],\n protection: \"software\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp_key = vault.keymgmt.Key(\"gcp_key\",\n mount=keymgmt[\"path\"],\n name=\"gcp-encryption-key\",\n type=\"aes256-gcm96\")\ngcp = vault.keymgmt.GcpKms(\"gcp\",\n mount=keymgmt[\"path\"],\n name=\"gcp-kms\",\n key_collection=\"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n credentials_wo={\n \"service_account_file\": std.file(input=\"gcp-credentials.json\").result,\n \"project\": \"my-project\",\n \"location\": \"us-central1\",\n },\n credentials_wo_version=1)\ngcp_dist = vault.keymgmt.DistributeKey(\"gcp_dist\",\n mount=keymgmt[\"path\"],\n kms_name=gcp.name,\n key_name=gcp_key.name,\n purposes=[\n \"encrypt\",\n \"decrypt\",\n ],\n protection=\"software\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpKey = new Vault.KeyMgmt.Key(\"gcp_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"gcp-encryption-key\",\n Type = \"aes256-gcm96\",\n });\n\n var gcp = new Vault.KeyMgmt.GcpKms(\"gcp\", new()\n {\n Mount = keymgmt.Path,\n Name = \"gcp-kms\",\n KeyCollection = \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n CredentialsWo = \n {\n { \"service_account_file\", Std.File.Invoke(new()\n {\n Input = \"gcp-credentials.json\",\n }).Apply(invoke =\u003e invoke.Result) },\n { \"project\", \"my-project\" },\n { \"location\", \"us-central1\" },\n },\n CredentialsWoVersion = 1,\n });\n\n var gcpDist = new Vault.KeyMgmt.DistributeKey(\"gcp_dist\", new()\n {\n Mount = keymgmt.Path,\n KmsName = gcp.Name,\n KeyName = gcpKey.Name,\n Purposes = new[]\n {\n \"encrypt\",\n \"decrypt\",\n },\n Protection = \"software\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tgcpKey, err := keymgmt.NewKey(ctx, \"gcp_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"gcp-encryption-key\"),\n\t\t\tType: pulumi.String(\"aes256-gcm96\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"gcp-credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tgcp, err := keymgmt.NewGcpKms(ctx, \"gcp\", \u0026keymgmt.GcpKmsArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"gcp-kms\"),\n\t\t\tKeyCollection: pulumi.String(\"projects/my-project/locations/us-central1/keyRings/my-keyring\"),\n\t\t\tCredentialsWo: pulumi.StringMap{\n\t\t\t\t\"service_account_file\": pulumi.String(invokeFile.Result),\n\t\t\t\t\"project\": pulumi.String(\"my-project\"),\n\t\t\t\t\"location\": pulumi.String(\"us-central1\"),\n\t\t\t},\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewDistributeKey(ctx, \"gcp_dist\", \u0026keymgmt.DistributeKeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tKmsName: gcp.Name,\n\t\t\tKeyName: gcpKey.Name,\n\t\t\tPurposes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"encrypt\"),\n\t\t\t\tpulumi.String(\"decrypt\"),\n\t\t\t},\n\t\t\tProtection: pulumi.String(\"software\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_keymgmt_key\" \"gcp_key\" {\n mount = keymgmt.path\n name = \"gcp-encryption-key\"\n type = \"aes256-gcm96\"\n}\nresource \"vault_keymgmt_gcpkms\" \"gcp\" {\n mount = keymgmt.path\n name = \"gcp-kms\"\n key_collection = \"projects/my-project/locations/us-central1/keyRings/my-keyring\"\n credentials_wo = {\n \"service_account_file\" = file(\"gcp-credentials.json\")\n \"project\" = \"my-project\"\n \"location\" = \"us-central1\"\n }\n credentials_wo_version = 1\n}\nresource \"vault_keymgmt_distributekey\" \"gcp_dist\" {\n mount = keymgmt.path\n kms_name = vault_keymgmt_gcpkms.gcp.name\n key_name = vault_keymgmt_key.gcp_key.name\n purposes = [\"encrypt\", \"decrypt\"]\n protection = \"software\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport com.pulumi.vault.keymgmt.GcpKms;\nimport com.pulumi.vault.keymgmt.GcpKmsArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.vault.keymgmt.DistributeKey;\nimport com.pulumi.vault.keymgmt.DistributeKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpKey = new Key(\"gcpKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"gcp-encryption-key\")\n .type(\"aes256-gcm96\")\n .build());\n\n var gcp = new GcpKms(\"gcp\", GcpKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"gcp-kms\")\n .keyCollection(\"projects/my-project/locations/us-central1/keyRings/my-keyring\")\n .credentialsWo(Map.ofEntries(\n Map.entry(\"service_account_file\", StdFunctions.file(FileArgs.builder()\n .input(\"gcp-credentials.json\")\n .build()).result()),\n Map.entry(\"project\", \"my-project\"),\n Map.entry(\"location\", \"us-central1\")\n ))\n .credentialsWoVersion(1)\n .build());\n\n var gcpDist = new DistributeKey(\"gcpDist\", DistributeKeyArgs.builder()\n .mount(keymgmt.path())\n .kmsName(gcp.name())\n .keyName(gcpKey.name())\n .purposes( \n \"encrypt\",\n \"decrypt\")\n .protection(\"software\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpKey:\n type: vault:keymgmt:Key\n name: gcp_key\n properties:\n mount: ${keymgmt.path}\n name: gcp-encryption-key\n type: aes256-gcm96\n gcp:\n type: vault:keymgmt:GcpKms\n properties:\n mount: ${keymgmt.path}\n name: gcp-kms\n keyCollection: projects/my-project/locations/us-central1/keyRings/my-keyring\n credentialsWo:\n service_account_file:\n fn::invoke:\n function: std:file\n arguments:\n input: gcp-credentials.json\n return: result\n project: my-project\n location: us-central1\n credentialsWoVersion: 1\n gcpDist:\n type: vault:keymgmt:DistributeKey\n name: gcp_dist\n properties:\n mount: ${keymgmt.path}\n kmsName: ${gcp.name}\n keyName: ${gcpKey.name}\n purposes:\n - encrypt\n - decrypt\n protection: software\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKey distributions can be imported using the format `{path}/kms/{kms_name}/key/{key_name}`, e.g.\n\n```sh\n$ pulumi import vault:keymgmt/distributeKey:DistributeKey aws_dist keymgmt/kms/aws-kms/key/aws-encryption-key\n```\n\n\u003e **Note:** When importing, the \u003cspan pulumi-lang-nodejs=\"`purpose`\" pulumi-lang-dotnet=\"`Purpose`\" pulumi-lang-go=\"`purpose`\" pulumi-lang-python=\"`purpose`\" pulumi-lang-yaml=\"`purpose`\" pulumi-lang-java=\"`purpose`\" pulumi-lang-hcl=\"`purpose`\"\u003e`purpose`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`protection`\" pulumi-lang-dotnet=\"`Protection`\" pulumi-lang-go=\"`protection`\" pulumi-lang-python=\"`protection`\" pulumi-lang-yaml=\"`protection`\" pulumi-lang-java=\"`protection`\" pulumi-lang-hcl=\"`protection`\"\u003e`protection`\u003c/span\u003e fields are not returned by the Vault API and will not be populated in state. Both fields carry `Forces new resource`, so a missing or mismatched value will trigger a destroy+recreate on the next `pulumi up`. Always set \u003cspan pulumi-lang-nodejs=\"`purpose`\" pulumi-lang-dotnet=\"`Purpose`\" pulumi-lang-go=\"`purpose`\" pulumi-lang-python=\"`purpose`\" pulumi-lang-yaml=\"`purpose`\" pulumi-lang-java=\"`purpose`\" pulumi-lang-hcl=\"`purpose`\"\u003e`purpose`\u003c/span\u003e (and \u003cspan pulumi-lang-nodejs=\"`protection`\" pulumi-lang-dotnet=\"`Protection`\" pulumi-lang-go=\"`protection`\" pulumi-lang-python=\"`protection`\" pulumi-lang-yaml=\"`protection`\" pulumi-lang-java=\"`protection`\" pulumi-lang-hcl=\"`protection`\"\u003e`protection`\u003c/span\u003e if not using the default \u003cspan pulumi-lang-nodejs=\"`hsm`\" pulumi-lang-dotnet=\"`Hsm`\" pulumi-lang-go=\"`hsm`\" pulumi-lang-python=\"`hsm`\" pulumi-lang-yaml=\"`hsm`\" pulumi-lang-java=\"`hsm`\" pulumi-lang-hcl=\"`hsm`\"\u003e`hsm`\u003c/span\u003e) explicitly in your configuration after import.\n\n", "properties": { "keyName": { "type": "string", "description": "Specifies the name of the key to distribute to the given KMS provider.\n" }, "kmsName": { "type": "string", "description": "Specifies the name of the KMS provider to distribute the given key to.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "protection": { "type": "string", "description": "Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: \u003cspan pulumi-lang-nodejs=\"`hsm`\" pulumi-lang-dotnet=\"`Hsm`\" pulumi-lang-go=\"`hsm`\" pulumi-lang-python=\"`hsm`\" pulumi-lang-yaml=\"`hsm`\" pulumi-lang-java=\"`hsm`\" pulumi-lang-hcl=\"`hsm`\"\u003e`hsm`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`software`\" pulumi-lang-dotnet=\"`Software`\" pulumi-lang-go=\"`software`\" pulumi-lang-python=\"`software`\" pulumi-lang-yaml=\"`software`\" pulumi-lang-java=\"`software`\" pulumi-lang-hcl=\"`software`\"\u003e`software`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`hsm`\" pulumi-lang-dotnet=\"`Hsm`\" pulumi-lang-go=\"`hsm`\" pulumi-lang-python=\"`hsm`\" pulumi-lang-yaml=\"`hsm`\" pulumi-lang-java=\"`hsm`\" pulumi-lang-hcl=\"`hsm`\"\u003e`hsm`\u003c/span\u003e.\n" }, "purposes": { "type": "array", "items": { "type": "string" }, "description": "Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.\n" }, "versions": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of distributed key versions to their identifiers in the KMS provider.\n" } }, "required": [ "keyName", "kmsName", "mount", "protection", "purposes", "versions" ], "inputProperties": { "keyName": { "type": "string", "description": "Specifies the name of the key to distribute to the given KMS provider.\n" }, "kmsName": { "type": "string", "description": "Specifies the name of the KMS provider to distribute the given key to.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "protection": { "type": "string", "description": "Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: \u003cspan pulumi-lang-nodejs=\"`hsm`\" pulumi-lang-dotnet=\"`Hsm`\" pulumi-lang-go=\"`hsm`\" pulumi-lang-python=\"`hsm`\" pulumi-lang-yaml=\"`hsm`\" pulumi-lang-java=\"`hsm`\" pulumi-lang-hcl=\"`hsm`\"\u003e`hsm`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`software`\" pulumi-lang-dotnet=\"`Software`\" pulumi-lang-go=\"`software`\" pulumi-lang-python=\"`software`\" pulumi-lang-yaml=\"`software`\" pulumi-lang-java=\"`software`\" pulumi-lang-hcl=\"`software`\"\u003e`software`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`hsm`\" pulumi-lang-dotnet=\"`Hsm`\" pulumi-lang-go=\"`hsm`\" pulumi-lang-python=\"`hsm`\" pulumi-lang-yaml=\"`hsm`\" pulumi-lang-java=\"`hsm`\" pulumi-lang-hcl=\"`hsm`\"\u003e`hsm`\u003c/span\u003e.\n" }, "purposes": { "type": "array", "items": { "type": "string" }, "description": "Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.\n" } }, "requiredInputs": [ "keyName", "kmsName", "mount", "purposes" ], "stateInputs": { "description": "Input properties used for looking up and filtering DistributeKey resources.\n", "properties": { "keyName": { "type": "string", "description": "Specifies the name of the key to distribute to the given KMS provider.\n" }, "kmsName": { "type": "string", "description": "Specifies the name of the KMS provider to distribute the given key to.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "protection": { "type": "string", "description": "Specifies the protection of the key. The protection defines where cryptographic operations are performed with the key in the KMS provider. The following values are supported: \u003cspan pulumi-lang-nodejs=\"`hsm`\" pulumi-lang-dotnet=\"`Hsm`\" pulumi-lang-go=\"`hsm`\" pulumi-lang-python=\"`hsm`\" pulumi-lang-yaml=\"`hsm`\" pulumi-lang-java=\"`hsm`\" pulumi-lang-hcl=\"`hsm`\"\u003e`hsm`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`software`\" pulumi-lang-dotnet=\"`Software`\" pulumi-lang-go=\"`software`\" pulumi-lang-python=\"`software`\" pulumi-lang-yaml=\"`software`\" pulumi-lang-java=\"`software`\" pulumi-lang-hcl=\"`software`\"\u003e`software`\u003c/span\u003e. Defaults to \u003cspan pulumi-lang-nodejs=\"`hsm`\" pulumi-lang-dotnet=\"`Hsm`\" pulumi-lang-go=\"`hsm`\" pulumi-lang-python=\"`hsm`\" pulumi-lang-yaml=\"`hsm`\" pulumi-lang-java=\"`hsm`\" pulumi-lang-hcl=\"`hsm`\"\u003e`hsm`\u003c/span\u003e.\n" }, "purposes": { "type": "array", "items": { "type": "string" }, "description": "Specifies the purpose of the key. The purpose defines a set of cryptographic capabilities that the key will have in the KMS provider. A key must have at least one of the supported purposes. The following values are supported : encrypt, decrypt, sign, verify, wrap, unwrap.\n" }, "versions": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of distributed key versions to their identifiers in the KMS provider.\n" } }, "type": "object" } }, "vault:keymgmt/gcpKms:GcpKms": { "description": "Manages a GCP Cloud KMS provider in the Vault Key Management secrets engine. This resource configures Vault to integrate with Google Cloud Platform's Key Management Service, allowing keys created in Vault to be distributed to GCP Cloud KMS for use in GCP services.\n\nOnce configured, keys can be distributed to GCP Cloud KMS using the \u003cspan pulumi-lang-nodejs=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-dotnet=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-go=\"`keymgmt.DistributeKey`\" pulumi-lang-python=\"`keymgmt.DistributeKey`\" pulumi-lang-yaml=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-java=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-hcl=\"`vault_keymgmt_distribute_key`\"\u003e`vault.keymgmt.DistributeKey`\u003c/span\u003e resource.\n\n\u003e **Important** This resource requires **Terraform 1.11+** for write-only attribute support.\nThe \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e field is write-only and will never be stored in Terraform state.\nSee the main provider documentation for more details.\n\nFor more information on managing GCP Cloud KMS with Vault, please refer to the Vault [documentation](https://developer.hashicorp.com/vault/docs/secrets/key-management).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n### Using Explicit Credentials\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst keymgmt = new vault.Mount(\"keymgmt\", {\n path: \"keymgmt\",\n type: \"keymgmt\",\n});\nconst production = new vault.keymgmt.GcpKms(\"production\", {\n mount: keymgmt.path,\n name: \"gcp-production\",\n keyCollection: \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n credentialsWo: {\n service_account_file: std.file({\n input: \"gcp-credentials.json\",\n }).then(invoke =\u003e invoke.result),\n project: \"my-project\",\n location: \"us-central1\",\n },\n credentialsWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nkeymgmt = vault.Mount(\"keymgmt\",\n path=\"keymgmt\",\n type=\"keymgmt\")\nproduction = vault.keymgmt.GcpKms(\"production\",\n mount=keymgmt.path,\n name=\"gcp-production\",\n key_collection=\"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n credentials_wo={\n \"service_account_file\": std.file(input=\"gcp-credentials.json\").result,\n \"project\": \"my-project\",\n \"location\": \"us-central1\",\n },\n credentials_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var keymgmt = new Vault.Mount(\"keymgmt\", new()\n {\n Path = \"keymgmt\",\n Type = \"keymgmt\",\n });\n\n var production = new Vault.KeyMgmt.GcpKms(\"production\", new()\n {\n Mount = keymgmt.Path,\n Name = \"gcp-production\",\n KeyCollection = \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n CredentialsWo = \n {\n { \"service_account_file\", Std.File.Invoke(new()\n {\n Input = \"gcp-credentials.json\",\n }).Apply(invoke =\u003e invoke.Result) },\n { \"project\", \"my-project\" },\n { \"location\", \"us-central1\" },\n },\n CredentialsWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkeymgmt2, err := vault.NewMount(ctx, \"keymgmt\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"keymgmt\"),\n\t\t\tType: pulumi.String(\"keymgmt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"gcp-credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewGcpKms(ctx, \"production\", \u0026keymgmt.GcpKmsArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"gcp-production\"),\n\t\t\tKeyCollection: pulumi.String(\"projects/my-project/locations/us-central1/keyRings/my-keyring\"),\n\t\t\tCredentialsWo: pulumi.StringMap{\n\t\t\t\t\"service_account_file\": pulumi.String(invokeFile.Result),\n\t\t\t\t\"project\": pulumi.String(\"my-project\"),\n\t\t\t\t\"location\": pulumi.String(\"us-central1\"),\n\t\t\t},\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"keymgmt\" {\n path = \"keymgmt\"\n type = \"keymgmt\"\n}\nresource \"vault_keymgmt_gcpkms\" \"production\" {\n mount = vault_mount.keymgmt.path\n name = \"gcp-production\"\n key_collection = \"projects/my-project/locations/us-central1/keyRings/my-keyring\"\n credentials_wo = {\n \"service_account_file\" = file(\"gcp-credentials.json\")\n \"project\" = \"my-project\"\n \"location\" = \"us-central1\"\n }\n credentials_wo_version = 1\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.keymgmt.GcpKms;\nimport com.pulumi.vault.keymgmt.GcpKmsArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var keymgmt = new Mount(\"keymgmt\", MountArgs.builder()\n .path(\"keymgmt\")\n .type(\"keymgmt\")\n .build());\n\n var production = new GcpKms(\"production\", GcpKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"gcp-production\")\n .keyCollection(\"projects/my-project/locations/us-central1/keyRings/my-keyring\")\n .credentialsWo(Map.ofEntries(\n Map.entry(\"service_account_file\", StdFunctions.file(FileArgs.builder()\n .input(\"gcp-credentials.json\")\n .build()).result()),\n Map.entry(\"project\", \"my-project\"),\n Map.entry(\"location\", \"us-central1\")\n ))\n .credentialsWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n keymgmt:\n type: vault:Mount\n properties:\n path: keymgmt\n type: keymgmt\n production:\n type: vault:keymgmt:GcpKms\n properties:\n mount: ${keymgmt.path}\n name: gcp-production\n keyCollection: projects/my-project/locations/us-central1/keyRings/my-keyring\n credentialsWo:\n service_account_file:\n fn::invoke:\n function: std:file\n arguments:\n input: gcp-credentials.json\n return: result\n project: my-project\n location: us-central1\n credentialsWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using GCP Application Default Credentials\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\n// When credentials_wo is not provided, Vault uses its own environment to\n// authenticate with GCP. Supported options include:\n// 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault\n// server, pointing to a service account key file.\n// 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure\n// with an attached service account.\nconst keymgmt = new vault.Mount(\"keymgmt\", {\n path: \"keymgmt\",\n type: \"keymgmt\",\n});\nconst production = new vault.keymgmt.GcpKms(\"production\", {\n mount: keymgmt.path,\n name: \"gcp-production\",\n keyCollection: \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\n# When credentials_wo is not provided, Vault uses its own environment to\n# authenticate with GCP. Supported options include:\n# 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault\n# server, pointing to a service account key file.\n# 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure\n# with an attached service account.\nkeymgmt = vault.Mount(\"keymgmt\",\n path=\"keymgmt\",\n type=\"keymgmt\")\nproduction = vault.keymgmt.GcpKms(\"production\",\n mount=keymgmt.path,\n name=\"gcp-production\",\n key_collection=\"projects/my-project/locations/us-central1/keyRings/my-keyring\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n // When credentials_wo is not provided, Vault uses its own environment to\n // authenticate with GCP. Supported options include:\n // 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault\n // server, pointing to a service account key file.\n // 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure\n // with an attached service account.\n var keymgmt = new Vault.Mount(\"keymgmt\", new()\n {\n Path = \"keymgmt\",\n Type = \"keymgmt\",\n });\n\n var production = new Vault.KeyMgmt.GcpKms(\"production\", new()\n {\n Mount = keymgmt.Path,\n Name = \"gcp-production\",\n KeyCollection = \"projects/my-project/locations/us-central1/keyRings/my-keyring\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t// When credentials_wo is not provided, Vault uses its own environment to\n\t\t// authenticate with GCP. Supported options include:\n\t\t// 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault\n\t\t// server, pointing to a service account key file.\n\t\t// 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure\n\t\t// with an attached service account.\n\t\tkeymgmt2, err := vault.NewMount(ctx, \"keymgmt\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"keymgmt\"),\n\t\t\tType: pulumi.String(\"keymgmt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewGcpKms(ctx, \"production\", \u0026keymgmt.GcpKmsArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"gcp-production\"),\n\t\t\tKeyCollection: pulumi.String(\"projects/my-project/locations/us-central1/keyRings/my-keyring\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\n# When credentials_wo is not provided, Vault uses its own environment to\n# authenticate with GCP. Supported options include:\n# 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault\n# server, pointing to a service account key file.\n# 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure\n# with an attached service account.\nresource \"vault_mount\" \"keymgmt\" {\n path = \"keymgmt\"\n type = \"keymgmt\"\n}\nresource \"vault_keymgmt_gcpkms\" \"production\" {\n mount = vault_mount.keymgmt.path\n name = \"gcp-production\"\n key_collection = \"projects/my-project/locations/us-central1/keyRings/my-keyring\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.keymgmt.GcpKms;\nimport com.pulumi.vault.keymgmt.GcpKmsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n // When credentials_wo is not provided, Vault uses its own environment to\n // authenticate with GCP. Supported options include:\n // 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault\n // server, pointing to a service account key file.\n // 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure\n // with an attached service account.\n var keymgmt = new Mount(\"keymgmt\", MountArgs.builder()\n .path(\"keymgmt\")\n .type(\"keymgmt\")\n .build());\n\n var production = new GcpKms(\"production\", GcpKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"gcp-production\")\n .keyCollection(\"projects/my-project/locations/us-central1/keyRings/my-keyring\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n # When credentials_wo is not provided, Vault uses its own environment to\n # authenticate with GCP. Supported options include:\n # 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault\n # server, pointing to a service account key file.\n # 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure\n # with an attached service account.\n keymgmt:\n type: vault:Mount\n properties:\n path: keymgmt\n type: keymgmt\n production:\n type: vault:keymgmt:GcpKms\n properties:\n mount: ${keymgmt.path}\n name: gcp-production\n keyCollection: projects/my-project/locations/us-central1/keyRings/my-keyring\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Required GCP Permissions\n\nThe service account must be authorized with the following minimum IAM permissions on the target key ring resource:\n\n- `cloudkms.cryptoKeys.create`\n- `cloudkms.cryptoKeys.update`\n- `cloudkms.importJobs.create`\n- `cloudkms.importJobs.get`\n- `cloudkms.importJobs.useToImport`\n- `cloudkms.cryptoKeyVersions.list`\n- `cloudkms.cryptoKeyVersions.destroy`\n- `cloudkms.cryptoKeyVersions.update`\n- `cloudkms.cryptoKeyVersions.create`\n\n## Import\n\nGCP Cloud KMS providers can be imported using the format `{path}/kms/{name}`, e.g.\n\n```sh\n$ pulumi import vault:keymgmt/gcpKms:GcpKms production keymgmt/kms/gcp-production\n```\n\n\u003e **Note:** Import sets the \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e attribute from the import ID. The \u003cspan pulumi-lang-nodejs=\"`credentialsWo`\" pulumi-lang-dotnet=\"`CredentialsWo`\" pulumi-lang-go=\"`credentialsWo`\" pulumi-lang-python=\"`credentials_wo`\" pulumi-lang-yaml=\"`credentialsWo`\" pulumi-lang-java=\"`credentialsWo`\" pulumi-lang-hcl=\"`credentials_wo`\"\u003e`credentialsWo`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`credentialsWoVersion`\" pulumi-lang-dotnet=\"`CredentialsWoVersion`\" pulumi-lang-go=\"`credentialsWoVersion`\" pulumi-lang-python=\"`credentials_wo_version`\" pulumi-lang-yaml=\"`credentialsWoVersion`\" pulumi-lang-java=\"`credentialsWoVersion`\" pulumi-lang-hcl=\"`credentials_wo_version`\"\u003e`credentialsWoVersion`\u003c/span\u003e fields will not be populated as they are not returned by the Vault API. You must supply these values in your configuration after import. The corresponding \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource must also be present in your configuration (or separately imported).\n\n", "properties": { "credentialsWo": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state.\nThe following values are supported:\n", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.\n" }, "keyCollection": { "type": "string", "description": "Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "keyCollection", "mount", "name" ], "inputProperties": { "credentialsWo": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state.\nThe following values are supported:\n", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.\n" }, "keyCollection": { "type": "string", "description": "Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "keyCollection", "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering GcpKms resources.\n", "properties": { "credentialsWo": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state.\nThe following values are supported:\n", "secret": true }, "credentialsWoVersion": { "type": "integer", "description": "Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.\n" }, "keyCollection": { "type": "string", "description": "Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:keymgmt/key:Key": { "description": "Manages keys in the Vault Key Management secrets engine. This resource creates and manages cryptographic keys that can be distributed to external Key Management Services (KMS).\n\nKeys created with this resource can be distributed to AWS KMS, Azure Key Vault, or GCP Cloud KMS using the appropriate distribution resources.\n\n\u003e **Important**\nAll data provided in the resource configuration will be written in cleartext to\nstate and plan files generated by Terraform, and will appear in the console\noutput when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.\n\nFor more information on Key Management in Vault, please refer to the Vault [documentation](https://developer.hashicorp.com/vault/docs/secrets/key-management).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n### Basic Symmetric Key\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst keymgmt = new vault.Mount(\"keymgmt\", {\n path: \"keymgmt\",\n type: \"keymgmt\",\n});\nconst aesKey = new vault.keymgmt.Key(\"aes_key\", {\n mount: keymgmt.path,\n name: \"aes-encryption-key\",\n type: \"aes256-gcm96\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkeymgmt = vault.Mount(\"keymgmt\",\n path=\"keymgmt\",\n type=\"keymgmt\")\naes_key = vault.keymgmt.Key(\"aes_key\",\n mount=keymgmt.path,\n name=\"aes-encryption-key\",\n type=\"aes256-gcm96\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var keymgmt = new Vault.Mount(\"keymgmt\", new()\n {\n Path = \"keymgmt\",\n Type = \"keymgmt\",\n });\n\n var aesKey = new Vault.KeyMgmt.Key(\"aes_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"aes-encryption-key\",\n Type = \"aes256-gcm96\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkeymgmt2, err := vault.NewMount(ctx, \"keymgmt\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"keymgmt\"),\n\t\t\tType: pulumi.String(\"keymgmt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewKey(ctx, \"aes_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"aes-encryption-key\"),\n\t\t\tType: pulumi.String(\"aes256-gcm96\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"keymgmt\" {\n path = \"keymgmt\"\n type = \"keymgmt\"\n}\nresource \"vault_keymgmt_key\" \"aes_key\" {\n mount = vault_mount.keymgmt.path\n name = \"aes-encryption-key\"\n type = \"aes256-gcm96\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var keymgmt = new Mount(\"keymgmt\", MountArgs.builder()\n .path(\"keymgmt\")\n .type(\"keymgmt\")\n .build());\n\n var aesKey = new Key(\"aesKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"aes-encryption-key\")\n .type(\"aes256-gcm96\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n keymgmt:\n type: vault:Mount\n properties:\n path: keymgmt\n type: keymgmt\n aesKey:\n type: vault:keymgmt:Key\n name: aes_key\n properties:\n mount: ${keymgmt.path}\n name: aes-encryption-key\n type: aes256-gcm96\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Default RSA Key (type omitted)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst defaultKey = new vault.keymgmt.Key(\"default_key\", {\n mount: keymgmt.path,\n name: \"my-key\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndefault_key = vault.keymgmt.Key(\"default_key\",\n mount=keymgmt[\"path\"],\n name=\"my-key\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var defaultKey = new Vault.KeyMgmt.Key(\"default_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"my-key\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := keymgmt.NewKey(ctx, \"default_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"my-key\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_keymgmt_key\" \"default_key\" {\n mount = keymgmt.path\n name = \"my-key\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var defaultKey = new Key(\"defaultKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"my-key\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n defaultKey:\n type: vault:keymgmt:Key\n name: default_key\n properties:\n mount: ${keymgmt.path}\n name: my-key\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### RSA Key with Deletion Protection\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst rsaKey = new vault.keymgmt.Key(\"rsa_key\", {\n mount: keymgmt.path,\n name: \"rsa-signing-key\",\n deletionAllowed: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nrsa_key = vault.keymgmt.Key(\"rsa_key\",\n mount=keymgmt[\"path\"],\n name=\"rsa-signing-key\",\n deletion_allowed=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var rsaKey = new Vault.KeyMgmt.Key(\"rsa_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"rsa-signing-key\",\n DeletionAllowed = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := keymgmt.NewKey(ctx, \"rsa_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"rsa-signing-key\"),\n\t\t\tDeletionAllowed: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_keymgmt_key\" \"rsa_key\" {\n mount = keymgmt.path\n name = \"rsa-signing-key\"\n deletion_allowed = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var rsaKey = new Key(\"rsaKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"rsa-signing-key\")\n .deletionAllowed(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n rsaKey:\n type: vault:keymgmt:Key\n name: rsa_key\n properties:\n mount: ${keymgmt.path}\n name: rsa-signing-key\n deletionAllowed: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Key with Minimum Enabled Version\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst versionedKey = new vault.keymgmt.Key(\"versioned_key\", {\n mount: keymgmt.path,\n name: \"versioned-key\",\n type: \"aes256-gcm96\",\n minEnabledVersion: 2,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nversioned_key = vault.keymgmt.Key(\"versioned_key\",\n mount=keymgmt[\"path\"],\n name=\"versioned-key\",\n type=\"aes256-gcm96\",\n min_enabled_version=2)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var versionedKey = new Vault.KeyMgmt.Key(\"versioned_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"versioned-key\",\n Type = \"aes256-gcm96\",\n MinEnabledVersion = 2,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := keymgmt.NewKey(ctx, \"versioned_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"versioned-key\"),\n\t\t\tType: pulumi.String(\"aes256-gcm96\"),\n\t\t\tMinEnabledVersion: pulumi.Int(2),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_keymgmt_key\" \"versioned_key\" {\n mount = keymgmt.path\n name = \"versioned-key\"\n type = \"aes256-gcm96\"\n min_enabled_version = 2\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var versionedKey = new Key(\"versionedKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"versioned-key\")\n .type(\"aes256-gcm96\")\n .minEnabledVersion(2)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n versionedKey:\n type: vault:keymgmt:Key\n name: versioned_key\n properties:\n mount: ${keymgmt.path}\n name: versioned-key\n type: aes256-gcm96\n minEnabledVersion: 2\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Key with Replication to Multiple Regions\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst replicatedKey = new vault.keymgmt.Key(\"replicated_key\", {\n mount: keymgmt.path,\n name: \"multi-region-key\",\n type: \"aes256-gcm96\",\n replicaRegions: [\n \"us-west-1\",\n \"us-east-1\",\n \"eu-west-1\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nreplicated_key = vault.keymgmt.Key(\"replicated_key\",\n mount=keymgmt[\"path\"],\n name=\"multi-region-key\",\n type=\"aes256-gcm96\",\n replica_regions=[\n \"us-west-1\",\n \"us-east-1\",\n \"eu-west-1\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var replicatedKey = new Vault.KeyMgmt.Key(\"replicated_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"multi-region-key\",\n Type = \"aes256-gcm96\",\n ReplicaRegions = new[]\n {\n \"us-west-1\",\n \"us-east-1\",\n \"eu-west-1\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := keymgmt.NewKey(ctx, \"replicated_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: pulumi.Any(keymgmt.Path),\n\t\t\tName: pulumi.String(\"multi-region-key\"),\n\t\t\tType: pulumi.String(\"aes256-gcm96\"),\n\t\t\tReplicaRegions: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"us-west-1\"),\n\t\t\t\tpulumi.String(\"us-east-1\"),\n\t\t\t\tpulumi.String(\"eu-west-1\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_keymgmt_key\" \"replicated_key\" {\n mount = keymgmt.path\n name = \"multi-region-key\"\n type = \"aes256-gcm96\"\n replica_regions = [\"us-west-1\", \"us-east-1\", \"eu-west-1\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var replicatedKey = new Key(\"replicatedKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"multi-region-key\")\n .type(\"aes256-gcm96\")\n .replicaRegions( \n \"us-west-1\",\n \"us-east-1\",\n \"eu-west-1\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n replicatedKey:\n type: vault:keymgmt:Key\n name: replicated_key\n properties:\n mount: ${keymgmt.path}\n name: multi-region-key\n type: aes256-gcm96\n replicaRegions:\n - us-west-1\n - us-east-1\n - eu-west-1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKey Management keys can be imported using the format `{path}/key/{name}`, e.g.\n\n```sh\n$ pulumi import vault:keymgmt/key:Key aes_key keymgmt/key/aes-encryption-key\n```\n\n", "properties": { "deletionAllowed": { "type": "boolean", "description": "Specifies if the key is allowed to be deleted.\n" }, "latestVersion": { "type": "integer", "description": "Specifies the latest version of the key.\n" }, "minEnabledVersion": { "type": "integer", "description": "Specifies the minimum enabled version of the key. All versions of the key\nless than the specified version will be disabled for cryptographic operations in the KMS provider that the key\nhas been distributed to. Setting this value to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e means that all versions will be enabled.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the key to create.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "replicaRegions": { "type": "array", "items": { "type": "string" }, "description": "Specifies the regions in which the key should be replicated. Supported only for AWS KMS.\n" }, "type": { "type": "string", "description": "Specifies the type of cryptographic key to create. Defaults to `rsa-2048`.\nThe following key types are supported:\n- `aes256-gcm96` - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)\n- `rsa-2048` - RSA with bit size of 2048 (asymmetric) (**default**)\n- `rsa-3072` - RSA with bit size of 3072 (asymmetric)\n- `rsa-4096` - RSA with bit size of 4096 (asymmetric)\n- `ecdsa-p256` - ECDSA using the P-256 elliptic curve (asymmetric)\n- `ecdsa-p384` - ECDSA using the P-384 elliptic curve (asymmetric)\n- `ecdsa-p521` - ECDSA using the P-521 elliptic curve (asymmetric)\n" } }, "required": [ "latestVersion", "minEnabledVersion", "mount", "name", "type" ], "inputProperties": { "deletionAllowed": { "type": "boolean", "description": "Specifies if the key is allowed to be deleted.\n" }, "minEnabledVersion": { "type": "integer", "description": "Specifies the minimum enabled version of the key. All versions of the key\nless than the specified version will be disabled for cryptographic operations in the KMS provider that the key\nhas been distributed to. Setting this value to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e means that all versions will be enabled.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the key to create.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "replicaRegions": { "type": "array", "items": { "type": "string" }, "description": "Specifies the regions in which the key should be replicated. Supported only for AWS KMS.\n" }, "type": { "type": "string", "description": "Specifies the type of cryptographic key to create. Defaults to `rsa-2048`.\nThe following key types are supported:\n- `aes256-gcm96` - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)\n- `rsa-2048` - RSA with bit size of 2048 (asymmetric) (**default**)\n- `rsa-3072` - RSA with bit size of 3072 (asymmetric)\n- `rsa-4096` - RSA with bit size of 4096 (asymmetric)\n- `ecdsa-p256` - ECDSA using the P-256 elliptic curve (asymmetric)\n- `ecdsa-p384` - ECDSA using the P-384 elliptic curve (asymmetric)\n- `ecdsa-p521` - ECDSA using the P-521 elliptic curve (asymmetric)\n" } }, "requiredInputs": [ "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering Key resources.\n", "properties": { "deletionAllowed": { "type": "boolean", "description": "Specifies if the key is allowed to be deleted.\n" }, "latestVersion": { "type": "integer", "description": "Specifies the latest version of the key.\n" }, "minEnabledVersion": { "type": "integer", "description": "Specifies the minimum enabled version of the key. All versions of the key\nless than the specified version will be disabled for cryptographic operations in the KMS provider that the key\nhas been distributed to. Setting this value to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e means that all versions will be enabled.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the key to create.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "replicaRegions": { "type": "array", "items": { "type": "string" }, "description": "Specifies the regions in which the key should be replicated. Supported only for AWS KMS.\n" }, "type": { "type": "string", "description": "Specifies the type of cryptographic key to create. Defaults to `rsa-2048`.\nThe following key types are supported:\n- `aes256-gcm96` - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)\n- `rsa-2048` - RSA with bit size of 2048 (asymmetric) (**default**)\n- `rsa-3072` - RSA with bit size of 3072 (asymmetric)\n- `rsa-4096` - RSA with bit size of 4096 (asymmetric)\n- `ecdsa-p256` - ECDSA using the P-256 elliptic curve (asymmetric)\n- `ecdsa-p384` - ECDSA using the P-384 elliptic curve (asymmetric)\n- `ecdsa-p521` - ECDSA using the P-521 elliptic curve (asymmetric)\n" } }, "type": "object" } }, "vault:keymgmt/keyRotate:KeyRotate": { "description": "Rotates a key in the Vault Key Management secrets engine. This resource creates a new version of an existing key, which is useful for implementing key rotation policies and maintaining security best practices.\n\nKey rotation creates a new cryptographic key version while keeping the old versions available for decryption of data encrypted with previous versions.\n\n\u003e **Important**\nAll data provided in the resource configuration will be written in cleartext to\nstate and plan files generated by Terraform, and will appear in the console\noutput when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.\n\nFor more information on key rotation in Vault, please refer to the Vault [documentation](https://developer.hashicorp.com/vault/docs/secrets/key-management).\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n### Basic Key Rotation\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst keymgmt = new vault.Mount(\"keymgmt\", {\n path: \"keymgmt\",\n type: \"keymgmt\",\n});\nconst encryptionKey = new vault.keymgmt.Key(\"encryption_key\", {\n mount: keymgmt.path,\n name: \"rotation-example\",\n type: \"aes256-gcm96\",\n});\nconst rotate = new vault.keymgmt.KeyRotate(\"rotate\", {\n mount: keymgmt.path,\n name: encryptionKey.name,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkeymgmt = vault.Mount(\"keymgmt\",\n path=\"keymgmt\",\n type=\"keymgmt\")\nencryption_key = vault.keymgmt.Key(\"encryption_key\",\n mount=keymgmt.path,\n name=\"rotation-example\",\n type=\"aes256-gcm96\")\nrotate = vault.keymgmt.KeyRotate(\"rotate\",\n mount=keymgmt.path,\n name=encryption_key.name)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var keymgmt = new Vault.Mount(\"keymgmt\", new()\n {\n Path = \"keymgmt\",\n Type = \"keymgmt\",\n });\n\n var encryptionKey = new Vault.KeyMgmt.Key(\"encryption_key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"rotation-example\",\n Type = \"aes256-gcm96\",\n });\n\n var rotate = new Vault.KeyMgmt.KeyRotate(\"rotate\", new()\n {\n Mount = keymgmt.Path,\n Name = encryptionKey.Name,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkeymgmt2, err := vault.NewMount(ctx, \"keymgmt\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"keymgmt\"),\n\t\t\tType: pulumi.String(\"keymgmt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tencryptionKey, err := keymgmt.NewKey(ctx, \"encryption_key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"rotation-example\"),\n\t\t\tType: pulumi.String(\"aes256-gcm96\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewKeyRotate(ctx, \"rotate\", \u0026keymgmt.KeyRotateArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: encryptionKey.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"keymgmt\" {\n path = \"keymgmt\"\n type = \"keymgmt\"\n}\nresource \"vault_keymgmt_key\" \"encryption_key\" {\n mount = vault_mount.keymgmt.path\n name = \"rotation-example\"\n type = \"aes256-gcm96\"\n}\nresource \"vault_keymgmt_keyrotate\" \"rotate\" {\n mount = vault_mount.keymgmt.path\n name = vault_keymgmt_key.encryption_key.name\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport com.pulumi.vault.keymgmt.KeyRotate;\nimport com.pulumi.vault.keymgmt.KeyRotateArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var keymgmt = new Mount(\"keymgmt\", MountArgs.builder()\n .path(\"keymgmt\")\n .type(\"keymgmt\")\n .build());\n\n var encryptionKey = new Key(\"encryptionKey\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"rotation-example\")\n .type(\"aes256-gcm96\")\n .build());\n\n var rotate = new KeyRotate(\"rotate\", KeyRotateArgs.builder()\n .mount(keymgmt.path())\n .name(encryptionKey.name())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n keymgmt:\n type: vault:Mount\n properties:\n path: keymgmt\n type: keymgmt\n encryptionKey:\n type: vault:keymgmt:Key\n name: encryption_key\n properties:\n mount: ${keymgmt.path}\n name: rotation-example\n type: aes256-gcm96\n rotate:\n type: vault:keymgmt:KeyRotate\n properties:\n mount: ${keymgmt.path}\n name: ${encryptionKey.name}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKey rotation resources can be imported using the format `{path}/key/{name}/rotate`, e.g.\n\n```sh\n$ pulumi import vault:keymgmt/keyRotate:KeyRotate rotate keymgmt/key/rotation-example/rotate\n```\n\n\u003e **Note:** This resource rotates the key once when created. Subsequent `pulumi up` operations will not trigger additional rotations unless the resource is destroyed and recreated.\n\n", "properties": { "latestVersion": { "type": "integer", "description": "Specifies the latest version of the key.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the key to rotate.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "latestVersion", "mount", "name" ], "inputProperties": { "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the key to rotate.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering KeyRotate resources.\n", "properties": { "latestVersion": { "type": "integer", "description": "Specifies the latest version of the key.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "name": { "type": "string", "description": "Specifies the name of the key to rotate.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:keymgmt/replicateKey:ReplicateKey": { "description": "Manages key replication across multiple AWS regions in AWS KMS. This resource enables AWS KMS multi-region keys, allowing the same key material to be used across different AWS regions for high availability and disaster recovery.\n\n**Note:** This resource is only applicable to AWS KMS and does not work with Azure Key Vault or GCP Cloud KMS.\n\nWhen you replicate a key to AWS KMS, it becomes a multi-region key that can be used for encryption and decryption operations in multiple AWS regions while maintaining the same key material.\n\n\u003e **Important**\nAll data provided in the resource configuration will be written in cleartext to\nstate and plan files generated by Terraform, and will appear in the console\noutput when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.\n\nFor more information on AWS KMS multi-region keys with Vault, please refer to the Vault [documentation](https://developer.hashicorp.com/vault/docs/secrets/key-management).\n\n**Note** this feature is available only with Vault Enterprise and requires a configured AWS KMS provider.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst keymgmt = new vault.Mount(\"keymgmt\", {\n path: \"keymgmt\",\n type: \"keymgmt\",\n});\nconst key = new vault.keymgmt.Key(\"key\", {\n mount: keymgmt.path,\n name: \"multi-region-key\",\n type: \"aes256-gcm96\",\n replicaRegions: [\n \"us-east-1\",\n \"eu-west-1\",\n ],\n});\nconst aws = new vault.keymgmt.AwsKms(\"aws\", {\n mount: keymgmt.path,\n name: \"aws-kms\",\n keyCollection: \"us-west-2\",\n credentialsWo: {\n access_key: awsAccessKeyId,\n secret_key: awsSecretAccessKey,\n },\n credentialsWoVersion: 1,\n});\nconst dist = new vault.keymgmt.DistributeKey(\"dist\", {\n mount: keymgmt.path,\n kmsName: aws.name,\n keyName: key.name,\n purposes: [\n \"encrypt\",\n \"decrypt\",\n ],\n});\nconst replicate = new vault.keymgmt.ReplicateKey(\"replicate\", {\n mount: keymgmt.path,\n kmsName: aws.name,\n keyName: key.name,\n}, {\n dependsOn: [dist],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkeymgmt = vault.Mount(\"keymgmt\",\n path=\"keymgmt\",\n type=\"keymgmt\")\nkey = vault.keymgmt.Key(\"key\",\n mount=keymgmt.path,\n name=\"multi-region-key\",\n type=\"aes256-gcm96\",\n replica_regions=[\n \"us-east-1\",\n \"eu-west-1\",\n ])\naws = vault.keymgmt.AwsKms(\"aws\",\n mount=keymgmt.path,\n name=\"aws-kms\",\n key_collection=\"us-west-2\",\n credentials_wo={\n \"access_key\": aws_access_key_id,\n \"secret_key\": aws_secret_access_key,\n },\n credentials_wo_version=1)\ndist = vault.keymgmt.DistributeKey(\"dist\",\n mount=keymgmt.path,\n kms_name=aws.name,\n key_name=key.name,\n purposes=[\n \"encrypt\",\n \"decrypt\",\n ])\nreplicate = vault.keymgmt.ReplicateKey(\"replicate\",\n mount=keymgmt.path,\n kms_name=aws.name,\n key_name=key.name,\n opts = pulumi.ResourceOptions(depends_on=[dist]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var keymgmt = new Vault.Mount(\"keymgmt\", new()\n {\n Path = \"keymgmt\",\n Type = \"keymgmt\",\n });\n\n var key = new Vault.KeyMgmt.Key(\"key\", new()\n {\n Mount = keymgmt.Path,\n Name = \"multi-region-key\",\n Type = \"aes256-gcm96\",\n ReplicaRegions = new[]\n {\n \"us-east-1\",\n \"eu-west-1\",\n },\n });\n\n var aws = new Vault.KeyMgmt.AwsKms(\"aws\", new()\n {\n Mount = keymgmt.Path,\n Name = \"aws-kms\",\n KeyCollection = \"us-west-2\",\n CredentialsWo = \n {\n { \"access_key\", awsAccessKeyId },\n { \"secret_key\", awsSecretAccessKey },\n },\n CredentialsWoVersion = 1,\n });\n\n var dist = new Vault.KeyMgmt.DistributeKey(\"dist\", new()\n {\n Mount = keymgmt.Path,\n KmsName = aws.Name,\n KeyName = key.Name,\n Purposes = new[]\n {\n \"encrypt\",\n \"decrypt\",\n },\n });\n\n var replicate = new Vault.KeyMgmt.ReplicateKey(\"replicate\", new()\n {\n Mount = keymgmt.Path,\n KmsName = aws.Name,\n KeyName = key.Name,\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n dist,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkeymgmt2, err := vault.NewMount(ctx, \"keymgmt\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"keymgmt\"),\n\t\t\tType: pulumi.String(\"keymgmt\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tkey, err := keymgmt.NewKey(ctx, \"key\", \u0026keymgmt.KeyArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"multi-region-key\"),\n\t\t\tType: pulumi.String(\"aes256-gcm96\"),\n\t\t\tReplicaRegions: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"us-east-1\"),\n\t\t\t\tpulumi.String(\"eu-west-1\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\taws, err := keymgmt.NewAwsKms(ctx, \"aws\", \u0026keymgmt.AwsKmsArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tName: pulumi.String(\"aws-kms\"),\n\t\t\tKeyCollection: pulumi.String(\"us-west-2\"),\n\t\t\tCredentialsWo: pulumi.StringMap{\n\t\t\t\t\"access_key\": pulumi.Any(awsAccessKeyId),\n\t\t\t\t\"secret_key\": pulumi.Any(awsSecretAccessKey),\n\t\t\t},\n\t\t\tCredentialsWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdist, err := keymgmt.NewDistributeKey(ctx, \"dist\", \u0026keymgmt.DistributeKeyArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tKmsName: aws.Name,\n\t\t\tKeyName: key.Name,\n\t\t\tPurposes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"encrypt\"),\n\t\t\t\tpulumi.String(\"decrypt\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = keymgmt.NewReplicateKey(ctx, \"replicate\", \u0026keymgmt.ReplicateKeyArgs{\n\t\t\tMount: keymgmt2.Path,\n\t\t\tKmsName: aws.Name,\n\t\t\tKeyName: key.Name,\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tdist,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"keymgmt\" {\n path = \"keymgmt\"\n type = \"keymgmt\"\n}\nresource \"vault_keymgmt_key\" \"key\" {\n mount = vault_mount.keymgmt.path\n name = \"multi-region-key\"\n type = \"aes256-gcm96\"\n replica_regions = [\"us-east-1\", \"eu-west-1\"]\n}\nresource \"vault_keymgmt_awskms\" \"aws\" {\n mount = vault_mount.keymgmt.path\n name = \"aws-kms\"\n key_collection = \"us-west-2\"\n credentials_wo = {\n \"access_key\" = awsAccessKeyId\n \"secret_key\" = awsSecretAccessKey\n }\n credentials_wo_version = 1\n}\nresource \"vault_keymgmt_distributekey\" \"dist\" {\n mount = vault_mount.keymgmt.path\n kms_name = vault_keymgmt_awskms.aws.name\n key_name = vault_keymgmt_key.key.name\n purposes = [\"encrypt\", \"decrypt\"]\n}\nresource \"vault_keymgmt_replicatekey\" \"replicate\" {\n depends_on = [vault_keymgmt_distributekey.dist]\n mount = vault_mount.keymgmt.path\n kms_name = vault_keymgmt_awskms.aws.name\n key_name = vault_keymgmt_key.key.name\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.keymgmt.Key;\nimport com.pulumi.vault.keymgmt.KeyArgs;\nimport com.pulumi.vault.keymgmt.AwsKms;\nimport com.pulumi.vault.keymgmt.AwsKmsArgs;\nimport com.pulumi.vault.keymgmt.DistributeKey;\nimport com.pulumi.vault.keymgmt.DistributeKeyArgs;\nimport com.pulumi.vault.keymgmt.ReplicateKey;\nimport com.pulumi.vault.keymgmt.ReplicateKeyArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var keymgmt = new Mount(\"keymgmt\", MountArgs.builder()\n .path(\"keymgmt\")\n .type(\"keymgmt\")\n .build());\n\n var key = new Key(\"key\", KeyArgs.builder()\n .mount(keymgmt.path())\n .name(\"multi-region-key\")\n .type(\"aes256-gcm96\")\n .replicaRegions( \n \"us-east-1\",\n \"eu-west-1\")\n .build());\n\n var aws = new AwsKms(\"aws\", AwsKmsArgs.builder()\n .mount(keymgmt.path())\n .name(\"aws-kms\")\n .keyCollection(\"us-west-2\")\n .credentialsWo(Map.ofEntries(\n Map.entry(\"access_key\", awsAccessKeyId),\n Map.entry(\"secret_key\", awsSecretAccessKey)\n ))\n .credentialsWoVersion(1)\n .build());\n\n var dist = new DistributeKey(\"dist\", DistributeKeyArgs.builder()\n .mount(keymgmt.path())\n .kmsName(aws.name())\n .keyName(key.name())\n .purposes( \n \"encrypt\",\n \"decrypt\")\n .build());\n\n var replicate = new ReplicateKey(\"replicate\", ReplicateKeyArgs.builder()\n .mount(keymgmt.path())\n .kmsName(aws.name())\n .keyName(key.name())\n .build(), CustomResourceOptions.builder()\n .dependsOn(dist)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n keymgmt:\n type: vault:Mount\n properties:\n path: keymgmt\n type: keymgmt\n key:\n type: vault:keymgmt:Key\n properties:\n mount: ${keymgmt.path}\n name: multi-region-key\n type: aes256-gcm96\n replicaRegions:\n - us-east-1\n - eu-west-1\n aws:\n type: vault:keymgmt:AwsKms\n properties:\n mount: ${keymgmt.path}\n name: aws-kms\n keyCollection: us-west-2\n credentialsWo:\n access_key: ${awsAccessKeyId}\n secret_key: ${awsSecretAccessKey}\n credentialsWoVersion: 1\n dist:\n type: vault:keymgmt:DistributeKey\n properties:\n mount: ${keymgmt.path}\n kmsName: ${aws.name}\n keyName: ${key.name}\n purposes:\n - encrypt\n - decrypt\n replicate:\n type: vault:keymgmt:ReplicateKey\n properties:\n mount: ${keymgmt.path}\n kmsName: ${aws.name}\n keyName: ${key.name}\n options:\n dependsOn:\n - ${dist}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKey replication resources can be imported using the format `{path}/kms/{kms_name}/key/{key_name}/replicate`, e.g.\n\n```sh\n$ pulumi import vault:keymgmt/replicateKey:ReplicateKey us_east keymgmt/kms/aws-us-west-2/key/multi-region-key/replicate\n```\n\n**Note**: The key must have \u003cspan pulumi-lang-nodejs=\"`replicaRegions`\" pulumi-lang-dotnet=\"`ReplicaRegions`\" pulumi-lang-go=\"`replicaRegions`\" pulumi-lang-python=\"`replica_regions`\" pulumi-lang-yaml=\"`replicaRegions`\" pulumi-lang-java=\"`replicaRegions`\" pulumi-lang-hcl=\"`replica_regions`\"\u003e`replicaRegions`\u003c/span\u003e configured in \u003cspan pulumi-lang-nodejs=\"`vault.keymgmt.Key`\" pulumi-lang-dotnet=\"`vault.keymgmt.Key`\" pulumi-lang-go=\"`keymgmt.Key`\" pulumi-lang-python=\"`keymgmt.Key`\" pulumi-lang-yaml=\"`vault.keymgmt.Key`\" pulumi-lang-java=\"`vault.keymgmt.Key`\" pulumi-lang-hcl=\"`vault_keymgmt_key`\"\u003e`vault.keymgmt.Key`\u003c/span\u003e and must be distributed to the AWS KMS provider using \u003cspan pulumi-lang-nodejs=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-dotnet=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-go=\"`keymgmt.DistributeKey`\" pulumi-lang-python=\"`keymgmt.DistributeKey`\" pulumi-lang-yaml=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-java=\"`vault.keymgmt.DistributeKey`\" pulumi-lang-hcl=\"`vault_keymgmt_distribute_key`\"\u003e`vault.keymgmt.DistributeKey`\u003c/span\u003e before replication.\n\n", "properties": { "keyName": { "type": "string", "description": "Specifies the name of the key to replicate. The key must have \u003cspan pulumi-lang-nodejs=\"`replicaRegions`\" pulumi-lang-dotnet=\"`ReplicaRegions`\" pulumi-lang-go=\"`replicaRegions`\" pulumi-lang-python=\"`replica_regions`\" pulumi-lang-yaml=\"`replicaRegions`\" pulumi-lang-java=\"`replicaRegions`\" pulumi-lang-hcl=\"`replica_regions`\"\u003e`replicaRegions`\u003c/span\u003e configured and must already be distributed to the AWS KMS provider.\n" }, "kmsName": { "type": "string", "description": "Specifies the name of the AWS KMS provider.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "keyName", "kmsName", "mount" ], "inputProperties": { "keyName": { "type": "string", "description": "Specifies the name of the key to replicate. The key must have \u003cspan pulumi-lang-nodejs=\"`replicaRegions`\" pulumi-lang-dotnet=\"`ReplicaRegions`\" pulumi-lang-go=\"`replicaRegions`\" pulumi-lang-python=\"`replica_regions`\" pulumi-lang-yaml=\"`replicaRegions`\" pulumi-lang-java=\"`replicaRegions`\" pulumi-lang-hcl=\"`replica_regions`\"\u003e`replicaRegions`\u003c/span\u003e configured and must already be distributed to the AWS KMS provider.\n" }, "kmsName": { "type": "string", "description": "Specifies the name of the AWS KMS provider.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "keyName", "kmsName", "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering ReplicateKey resources.\n", "properties": { "keyName": { "type": "string", "description": "Specifies the name of the key to replicate. The key must have \u003cspan pulumi-lang-nodejs=\"`replicaRegions`\" pulumi-lang-dotnet=\"`ReplicaRegions`\" pulumi-lang-go=\"`replicaRegions`\" pulumi-lang-python=\"`replica_regions`\" pulumi-lang-yaml=\"`replicaRegions`\" pulumi-lang-java=\"`replicaRegions`\" pulumi-lang-hcl=\"`replica_regions`\"\u003e`replicaRegions`\u003c/span\u003e configured and must already be distributed to the AWS KMS provider.\n" }, "kmsName": { "type": "string", "description": "Specifies the name of the AWS KMS provider.\n" }, "mount": { "type": "string", "description": "Path of the Key Management secrets engine mount. Must match the\n\u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e of a \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e resource with `type = \"keymgmt\"`. Use\n`vault_mount.keymgmt.path` here.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured\n[namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:kmip/secretBackend:SecretBackend": { "description": "Manages KMIP Secret backends in a Vault server. This feature requires\nVault Enterprise. See the [Vault documentation](https://www.vaultproject.io/docs/secrets/kmip)\nfor more information.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n listenAddrs: [\n \"127.0.0.1:5696\",\n \"127.0.0.1:8080\",\n ],\n tlsCaKeyType: \"rsa\",\n tlsCaKeyBits: 4096,\n defaultTlsClientKeyType: \"rsa\",\n defaultTlsClientKeyBits: 4096,\n defaultTlsClientTtl: 86400,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\",\n listen_addrs=[\n \"127.0.0.1:5696\",\n \"127.0.0.1:8080\",\n ],\n tls_ca_key_type=\"rsa\",\n tls_ca_key_bits=4096,\n default_tls_client_key_type=\"rsa\",\n default_tls_client_key_bits=4096,\n default_tls_client_ttl=86400)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n ListenAddrs = new[]\n {\n \"127.0.0.1:5696\",\n \"127.0.0.1:8080\",\n },\n TlsCaKeyType = \"rsa\",\n TlsCaKeyBits = 4096,\n DefaultTlsClientKeyType = \"rsa\",\n DefaultTlsClientKeyBits = 4096,\n DefaultTlsClientTtl = 86400,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t\tListenAddrs: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"127.0.0.1:5696\"),\n\t\t\t\tpulumi.String(\"127.0.0.1:8080\"),\n\t\t\t},\n\t\t\tTlsCaKeyType: pulumi.String(\"rsa\"),\n\t\t\tTlsCaKeyBits: pulumi.Int(4096),\n\t\t\tDefaultTlsClientKeyType: pulumi.String(\"rsa\"),\n\t\t\tDefaultTlsClientKeyBits: pulumi.Int(4096),\n\t\t\tDefaultTlsClientTtl: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n listen_addrs = [\"127.0.0.1:5696\", \"127.0.0.1:8080\"]\n tls_ca_key_type = \"rsa\"\n tls_ca_key_bits = 4096\n default_tls_client_key_type = \"rsa\"\n default_tls_client_key_bits = 4096\n default_tls_client_ttl = 86400\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .listenAddrs( \n \"127.0.0.1:5696\",\n \"127.0.0.1:8080\")\n .tlsCaKeyType(\"rsa\")\n .tlsCaKeyBits(4096)\n .defaultTlsClientKeyType(\"rsa\")\n .defaultTlsClientKeyBits(4096)\n .defaultTlsClientTtl(86400)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n listenAddrs:\n - 127.0.0.1:5696\n - 127.0.0.1:8080\n tlsCaKeyType: rsa\n tlsCaKeyBits: 4096\n defaultTlsClientKeyType: rsa\n defaultTlsClientKeyBits: 4096\n defaultTlsClientTtl: 86400\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKMIP Secret backend can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:kmip/secretBackend:SecretBackend default kmip\n```\n\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "defaultTlsClientKeyBits": { "type": "integer", "description": "Client certificate key bits, valid values depend on key type.\n" }, "defaultTlsClientKeyType": { "type": "string", "description": "Client certificate key type, \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "defaultTlsClientTtl": { "type": "integer", "description": "Client certificate TTL in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listenAddrs": { "type": "array", "items": { "type": "string" }, "description": "Addresses the KMIP server should listen on (`host:port`).\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`kmip`\" pulumi-lang-dotnet=\"`Kmip`\" pulumi-lang-go=\"`kmip`\" pulumi-lang-python=\"`kmip`\" pulumi-lang-yaml=\"`kmip`\" pulumi-lang-java=\"`kmip`\" pulumi-lang-hcl=\"`kmip`\"\u003e`kmip`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "serverHostnames": { "type": "array", "items": { "type": "string" }, "description": "Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).\n" }, "serverIps": { "type": "array", "items": { "type": "string" }, "description": "IPs to include in the server's TLS certificate as SAN IP addresses.\n" }, "tlsCaKeyBits": { "type": "integer", "description": "CA key bits, valid values depend on key type.\n" }, "tlsCaKeyType": { "type": "string", "description": "CA key type, rsa or ec.\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to accept.\n" } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "defaultLeaseTtlSeconds", "defaultTlsClientKeyBits", "defaultTlsClientKeyType", "defaultTlsClientTtl", "forceNoCache", "maxLeaseTtlSeconds", "path", "sealWrap", "serverHostnames", "serverIps", "tlsCaKeyBits", "tlsCaKeyType", "tlsMinVersion" ], "inputProperties": { "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "defaultTlsClientKeyBits": { "type": "integer", "description": "Client certificate key bits, valid values depend on key type.\n" }, "defaultTlsClientKeyType": { "type": "string", "description": "Client certificate key type, \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "defaultTlsClientTtl": { "type": "integer", "description": "Client certificate TTL in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listenAddrs": { "type": "array", "items": { "type": "string" }, "description": "Addresses the KMIP server should listen on (`host:port`).\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`kmip`\" pulumi-lang-dotnet=\"`Kmip`\" pulumi-lang-go=\"`kmip`\" pulumi-lang-python=\"`kmip`\" pulumi-lang-yaml=\"`kmip`\" pulumi-lang-java=\"`kmip`\" pulumi-lang-hcl=\"`kmip`\"\u003e`kmip`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "serverHostnames": { "type": "array", "items": { "type": "string" }, "description": "Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).\n" }, "serverIps": { "type": "array", "items": { "type": "string" }, "description": "IPs to include in the server's TLS certificate as SAN IP addresses.\n" }, "tlsCaKeyBits": { "type": "integer", "description": "CA key bits, valid values depend on key type.\n" }, "tlsCaKeyType": { "type": "string", "description": "CA key type, rsa or ec.\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to accept.\n" } }, "requiredInputs": [ "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "defaultTlsClientKeyBits": { "type": "integer", "description": "Client certificate key bits, valid values depend on key type.\n" }, "defaultTlsClientKeyType": { "type": "string", "description": "Client certificate key type, \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "defaultTlsClientTtl": { "type": "integer", "description": "Client certificate TTL in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listenAddrs": { "type": "array", "items": { "type": "string" }, "description": "Addresses the KMIP server should listen on (`host:port`).\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`kmip`\" pulumi-lang-dotnet=\"`Kmip`\" pulumi-lang-go=\"`kmip`\" pulumi-lang-python=\"`kmip`\" pulumi-lang-yaml=\"`kmip`\" pulumi-lang-java=\"`kmip`\" pulumi-lang-hcl=\"`kmip`\"\u003e`kmip`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "serverHostnames": { "type": "array", "items": { "type": "string" }, "description": "Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).\n" }, "serverIps": { "type": "array", "items": { "type": "string" }, "description": "IPs to include in the server's TLS certificate as SAN IP addresses.\n" }, "tlsCaKeyBits": { "type": "integer", "description": "CA key bits, valid values depend on key type.\n" }, "tlsCaKeyType": { "type": "string", "description": "CA key type, rsa or ec.\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to accept.\n" } }, "type": "object" } }, "vault:kmip/secretCaGenerated:SecretCaGenerated": { "description": "Manages generated KMIP Secret CAs in a Vault server. This resource generates a new CA certificate and private key. This feature requires Vault Enterprise. See the [Vault documentation](https://www.vaultproject.io/docs/secrets/kmip) for more information.\n\n## Example Usage\n\n### Generate an EC CA\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst ec = new vault.kmip.SecretCaGenerated(\"ec\", {\n path: _default.path,\n name: \"my-ec-ca\",\n keyType: \"ec\",\n keyBits: 256,\n ttl: 31536000,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\nec = vault.kmip.SecretCaGenerated(\"ec\",\n path=default.path,\n name=\"my-ec-ca\",\n key_type=\"ec\",\n key_bits=256,\n ttl=31536000)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var ec = new Vault.Kmip.SecretCaGenerated(\"ec\", new()\n {\n Path = @default.Path,\n Name = \"my-ec-ca\",\n KeyType = \"ec\",\n KeyBits = 256,\n Ttl = 31536000,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretCaGenerated(ctx, \"ec\", \u0026kmip.SecretCaGeneratedArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: pulumi.String(\"my-ec-ca\"),\n\t\t\tKeyType: pulumi.String(\"ec\"),\n\t\t\tKeyBits: pulumi.Int(256),\n\t\t\tTtl: pulumi.Int(31536000),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmip_secretcagenerated\" \"ec\" {\n path = vault_kmip_secretbackend.default.path\n name = \"my-ec-ca\"\n key_type = \"ec\"\n key_bits = 256\n ttl = 31536000 # 1 year in seconds\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.kmip.SecretCaGenerated;\nimport com.pulumi.vault.kmip.SecretCaGeneratedArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var ec = new SecretCaGenerated(\"ec\", SecretCaGeneratedArgs.builder()\n .path(default_.path())\n .name(\"my-ec-ca\")\n .keyType(\"ec\")\n .keyBits(256)\n .ttl(31536000)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n ec:\n type: vault:kmip:SecretCaGenerated\n properties:\n path: ${default.path}\n name: my-ec-ca\n keyType: ec\n keyBits: 256\n ttl: 3.1536e+07 # 1 year in seconds\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Generate an RSA CA\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst rsa = new vault.kmip.SecretCaGenerated(\"rsa\", {\n path: _default.path,\n name: \"my-rsa-ca\",\n keyType: \"rsa\",\n keyBits: 2048,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\nrsa = vault.kmip.SecretCaGenerated(\"rsa\",\n path=default.path,\n name=\"my-rsa-ca\",\n key_type=\"rsa\",\n key_bits=2048)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var rsa = new Vault.Kmip.SecretCaGenerated(\"rsa\", new()\n {\n Path = @default.Path,\n Name = \"my-rsa-ca\",\n KeyType = \"rsa\",\n KeyBits = 2048,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretCaGenerated(ctx, \"rsa\", \u0026kmip.SecretCaGeneratedArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: pulumi.String(\"my-rsa-ca\"),\n\t\t\tKeyType: pulumi.String(\"rsa\"),\n\t\t\tKeyBits: pulumi.Int(2048),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmip_secretcagenerated\" \"rsa\" {\n path = vault_kmip_secretbackend.default.path\n name = \"my-rsa-ca\"\n key_type = \"rsa\"\n key_bits = 2048\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.kmip.SecretCaGenerated;\nimport com.pulumi.vault.kmip.SecretCaGeneratedArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var rsa = new SecretCaGenerated(\"rsa\", SecretCaGeneratedArgs.builder()\n .path(default_.path())\n .name(\"my-rsa-ca\")\n .keyType(\"rsa\")\n .keyBits(2048)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n rsa:\n type: vault:kmip:SecretCaGenerated\n properties:\n path: ${default.path}\n name: my-rsa-ca\n keyType: rsa\n keyBits: 2048\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Generate a CA with Custom TTL\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst customTtl = new vault.kmip.SecretCaGenerated(\"custom_ttl\", {\n path: _default.path,\n name: \"long-lived-ca\",\n keyType: \"ec\",\n keyBits: 384,\n ttl: 63072000,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\ncustom_ttl = vault.kmip.SecretCaGenerated(\"custom_ttl\",\n path=default.path,\n name=\"long-lived-ca\",\n key_type=\"ec\",\n key_bits=384,\n ttl=63072000)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var customTtl = new Vault.Kmip.SecretCaGenerated(\"custom_ttl\", new()\n {\n Path = @default.Path,\n Name = \"long-lived-ca\",\n KeyType = \"ec\",\n KeyBits = 384,\n Ttl = 63072000,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretCaGenerated(ctx, \"custom_ttl\", \u0026kmip.SecretCaGeneratedArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: pulumi.String(\"long-lived-ca\"),\n\t\t\tKeyType: pulumi.String(\"ec\"),\n\t\t\tKeyBits: pulumi.Int(384),\n\t\t\tTtl: pulumi.Int(63072000),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmip_secretcagenerated\" \"custom_ttl\" {\n path = vault_kmip_secretbackend.default.path\n name = \"long-lived-ca\"\n key_type = \"ec\"\n key_bits = 384\n ttl = 63072000 # 2 years in seconds\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.kmip.SecretCaGenerated;\nimport com.pulumi.vault.kmip.SecretCaGeneratedArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var customTtl = new SecretCaGenerated(\"customTtl\", SecretCaGeneratedArgs.builder()\n .path(default_.path())\n .name(\"long-lived-ca\")\n .keyType(\"ec\")\n .keyBits(384)\n .ttl(63072000)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n customTtl:\n type: vault:kmip:SecretCaGenerated\n name: custom_ttl\n properties:\n path: ${default.path}\n name: long-lived-ca\n keyType: ec\n keyBits: 384\n ttl: 6.3072e+07 # 2 years in seconds\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKMIP Secret CA Generated can be imported using the format `\u003cpath\u003e/ca/\u003cname\u003e`, e.g.\n\n```sh\n$ pulumi import vault:kmip/secretCaGenerated:SecretCaGenerated example kmip/ca/my-ca\n```\n\n**Note:** When importing, the \u003cspan pulumi-lang-nodejs=\"`keyType`\" pulumi-lang-dotnet=\"`KeyType`\" pulumi-lang-go=\"`keyType`\" pulumi-lang-python=\"`key_type`\" pulumi-lang-yaml=\"`keyType`\" pulumi-lang-java=\"`keyType`\" pulumi-lang-hcl=\"`key_type`\"\u003e`keyType`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`keyBits`\" pulumi-lang-dotnet=\"`KeyBits`\" pulumi-lang-go=\"`keyBits`\" pulumi-lang-python=\"`key_bits`\" pulumi-lang-yaml=\"`keyBits`\" pulumi-lang-java=\"`keyBits`\" pulumi-lang-hcl=\"`key_bits`\"\u003e`keyBits`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`ttl`\" pulumi-lang-dotnet=\"`Ttl`\" pulumi-lang-go=\"`ttl`\" pulumi-lang-python=\"`ttl`\" pulumi-lang-yaml=\"`ttl`\" pulumi-lang-java=\"`ttl`\" pulumi-lang-hcl=\"`ttl`\"\u003e`ttl`\u003c/span\u003e values cannot be retrieved from Vault and will need to be set in your configuration. These values will be ignored during import verification.\n\n", "properties": { "caPem": { "type": "string", "description": "The generated CA certificate in PEM format.\n" }, "keyBits": { "type": "integer", "description": "CA key bits. Valid values depend on \u003cspan pulumi-lang-nodejs=\"`keyType`\" pulumi-lang-dotnet=\"`KeyType`\" pulumi-lang-go=\"`keyType`\" pulumi-lang-python=\"`key_type`\" pulumi-lang-yaml=\"`keyType`\" pulumi-lang-java=\"`keyType`\" pulumi-lang-hcl=\"`key_type`\"\u003e`keyType`\u003c/span\u003e:\n- For \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e: 2048, 3072, 4096\n- For \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e: 224, 256, 384, 521\n" }, "keyType": { "type": "string", "description": "CA key type. Valid values are \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "name": { "type": "string", "description": "Name to identify the CA. This will be used in the CA's path.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "path": { "type": "string", "description": "Path where KMIP backend is mounted. Must not begin or end with a `/`.\n" }, "ttl": { "type": "integer", "description": "CA TTL in seconds. Defaults to 365 days (31536000 seconds).\n" } }, "required": [ "caPem", "keyBits", "keyType", "name", "path", "ttl" ], "inputProperties": { "keyBits": { "type": "integer", "description": "CA key bits. Valid values depend on \u003cspan pulumi-lang-nodejs=\"`keyType`\" pulumi-lang-dotnet=\"`KeyType`\" pulumi-lang-go=\"`keyType`\" pulumi-lang-python=\"`key_type`\" pulumi-lang-yaml=\"`keyType`\" pulumi-lang-java=\"`keyType`\" pulumi-lang-hcl=\"`key_type`\"\u003e`keyType`\u003c/span\u003e:\n- For \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e: 2048, 3072, 4096\n- For \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e: 224, 256, 384, 521\n" }, "keyType": { "type": "string", "description": "CA key type. Valid values are \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "name": { "type": "string", "description": "Name to identify the CA. This will be used in the CA's path.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "path": { "type": "string", "description": "Path where KMIP backend is mounted. Must not begin or end with a `/`.\n" }, "ttl": { "type": "integer", "description": "CA TTL in seconds. Defaults to 365 days (31536000 seconds).\n" } }, "requiredInputs": [ "keyBits", "keyType", "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretCaGenerated resources.\n", "properties": { "caPem": { "type": "string", "description": "The generated CA certificate in PEM format.\n" }, "keyBits": { "type": "integer", "description": "CA key bits. Valid values depend on \u003cspan pulumi-lang-nodejs=\"`keyType`\" pulumi-lang-dotnet=\"`KeyType`\" pulumi-lang-go=\"`keyType`\" pulumi-lang-python=\"`key_type`\" pulumi-lang-yaml=\"`keyType`\" pulumi-lang-java=\"`keyType`\" pulumi-lang-hcl=\"`key_type`\"\u003e`keyType`\u003c/span\u003e:\n- For \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e: 2048, 3072, 4096\n- For \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e: 224, 256, 384, 521\n" }, "keyType": { "type": "string", "description": "CA key type. Valid values are \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "name": { "type": "string", "description": "Name to identify the CA. This will be used in the CA's path.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "path": { "type": "string", "description": "Path where KMIP backend is mounted. Must not begin or end with a `/`.\n" }, "ttl": { "type": "integer", "description": "CA TTL in seconds. Defaults to 365 days (31536000 seconds).\n" } }, "type": "object" } }, "vault:kmip/secretCaImported:SecretCaImported": { "description": "Manages imported KMIP Secret CAs in a Vault server. This resource imports an existing CA certificate. This feature requires Vault Enterprise. See the [Vault documentation](https://www.vaultproject.io/docs/secrets/kmip) for more information.\n\n## Example Usage\n\n### Import CA with Named Scope and Role\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst named = new vault.kmip.SecretCaImported(\"named\", {\n path: _default.path,\n name: \"imported-ca\",\n caPem: std.file({\n input: \"path/to/ca-certificate.pem\",\n }).then(invoke =\u003e invoke.result),\n scopeName: \"production\",\n roleName: \"admin\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\nnamed = vault.kmip.SecretCaImported(\"named\",\n path=default.path,\n name=\"imported-ca\",\n ca_pem=std.file(input=\"path/to/ca-certificate.pem\").result,\n scope_name=\"production\",\n role_name=\"admin\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var named = new Vault.Kmip.SecretCaImported(\"named\", new()\n {\n Path = @default.Path,\n Name = \"imported-ca\",\n CaPem = Std.File.Invoke(new()\n {\n Input = \"path/to/ca-certificate.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n ScopeName = \"production\",\n RoleName = \"admin\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"path/to/ca-certificate.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretCaImported(ctx, \"named\", \u0026kmip.SecretCaImportedArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: pulumi.String(\"imported-ca\"),\n\t\t\tCaPem: pulumi.String(invokeFile.Result),\n\t\t\tScopeName: pulumi.String(\"production\"),\n\t\t\tRoleName: pulumi.String(\"admin\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmip_secretcaimported\" \"named\" {\n path = vault_kmip_secretbackend.default.path\n name = \"imported-ca\"\n ca_pem = file(\"path/to/ca-certificate.pem\")\n scope_name = \"production\"\n role_name = \"admin\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.kmip.SecretCaImported;\nimport com.pulumi.vault.kmip.SecretCaImportedArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var named = new SecretCaImported(\"named\", SecretCaImportedArgs.builder()\n .path(default_.path())\n .name(\"imported-ca\")\n .caPem(StdFunctions.file(FileArgs.builder()\n .input(\"path/to/ca-certificate.pem\")\n .build()).result())\n .scopeName(\"production\")\n .roleName(\"admin\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n named:\n type: vault:kmip:SecretCaImported\n properties:\n path: ${default.path}\n name: imported-ca\n caPem:\n fn::invoke:\n function: std:file\n arguments:\n input: path/to/ca-certificate.pem\n return: result\n scopeName: production\n roleName: admin\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Import CA with Field-Based Mapping\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst fieldBased = new vault.kmip.SecretCaImported(\"field_based\", {\n path: _default.path,\n name: \"imported-ca-fields\",\n caPem: std.file({\n input: \"path/to/ca-certificate.pem\",\n }).then(invoke =\u003e invoke.result),\n scopeField: \"O\",\n roleField: \"OU\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\nfield_based = vault.kmip.SecretCaImported(\"field_based\",\n path=default.path,\n name=\"imported-ca-fields\",\n ca_pem=std.file(input=\"path/to/ca-certificate.pem\").result,\n scope_field=\"O\",\n role_field=\"OU\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var fieldBased = new Vault.Kmip.SecretCaImported(\"field_based\", new()\n {\n Path = @default.Path,\n Name = \"imported-ca-fields\",\n CaPem = Std.File.Invoke(new()\n {\n Input = \"path/to/ca-certificate.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n ScopeField = \"O\",\n RoleField = \"OU\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"path/to/ca-certificate.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretCaImported(ctx, \"field_based\", \u0026kmip.SecretCaImportedArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: pulumi.String(\"imported-ca-fields\"),\n\t\t\tCaPem: pulumi.String(invokeFile.Result),\n\t\t\tScopeField: pulumi.String(\"O\"),\n\t\t\tRoleField: pulumi.String(\"OU\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmip_secretcaimported\" \"field_based\" {\n path = vault_kmip_secretbackend.default.path\n name = \"imported-ca-fields\"\n ca_pem = file(\"path/to/ca-certificate.pem\")\n scope_field = \"O\"\n role_field = \"OU\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.kmip.SecretCaImported;\nimport com.pulumi.vault.kmip.SecretCaImportedArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var fieldBased = new SecretCaImported(\"fieldBased\", SecretCaImportedArgs.builder()\n .path(default_.path())\n .name(\"imported-ca-fields\")\n .caPem(StdFunctions.file(FileArgs.builder()\n .input(\"path/to/ca-certificate.pem\")\n .build()).result())\n .scopeField(\"O\")\n .roleField(\"OU\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n fieldBased:\n type: vault:kmip:SecretCaImported\n name: field_based\n properties:\n path: ${default.path}\n name: imported-ca-fields\n caPem:\n fn::invoke:\n function: std:file\n arguments:\n input: path/to/ca-certificate.pem\n return: result\n scopeField: O\n roleField: OU\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Import CA with Mixed Mapping\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst mixed = new vault.kmip.SecretCaImported(\"mixed\", {\n path: _default.path,\n name: \"imported-ca-mixed\",\n caPem: std.file({\n input: \"path/to/ca-certificate.pem\",\n }).then(invoke =\u003e invoke.result),\n scopeName: \"production\",\n roleField: \"CN\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\nmixed = vault.kmip.SecretCaImported(\"mixed\",\n path=default.path,\n name=\"imported-ca-mixed\",\n ca_pem=std.file(input=\"path/to/ca-certificate.pem\").result,\n scope_name=\"production\",\n role_field=\"CN\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var mixed = new Vault.Kmip.SecretCaImported(\"mixed\", new()\n {\n Path = @default.Path,\n Name = \"imported-ca-mixed\",\n CaPem = Std.File.Invoke(new()\n {\n Input = \"path/to/ca-certificate.pem\",\n }).Apply(invoke =\u003e invoke.Result),\n ScopeName = \"production\",\n RoleField = \"CN\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"path/to/ca-certificate.pem\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretCaImported(ctx, \"mixed\", \u0026kmip.SecretCaImportedArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: pulumi.String(\"imported-ca-mixed\"),\n\t\t\tCaPem: pulumi.String(invokeFile.Result),\n\t\t\tScopeName: pulumi.String(\"production\"),\n\t\t\tRoleField: pulumi.String(\"CN\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmip_secretcaimported\" \"mixed\" {\n path = vault_kmip_secretbackend.default.path\n name = \"imported-ca-mixed\"\n ca_pem = file(\"path/to/ca-certificate.pem\")\n scope_name = \"production\"\n role_field = \"CN\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.kmip.SecretCaImported;\nimport com.pulumi.vault.kmip.SecretCaImportedArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var mixed = new SecretCaImported(\"mixed\", SecretCaImportedArgs.builder()\n .path(default_.path())\n .name(\"imported-ca-mixed\")\n .caPem(StdFunctions.file(FileArgs.builder()\n .input(\"path/to/ca-certificate.pem\")\n .build()).result())\n .scopeName(\"production\")\n .roleField(\"CN\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n mixed:\n type: vault:kmip:SecretCaImported\n properties:\n path: ${default.path}\n name: imported-ca-mixed\n caPem:\n fn::invoke:\n function: std:file\n arguments:\n input: path/to/ca-certificate.pem\n return: result\n scopeName: production\n roleField: CN\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Configuration Requirements\n\nWhen configuring an imported CA, you must specify:\n\n* Exactly one of \u003cspan pulumi-lang-nodejs=\"`scopeName`\" pulumi-lang-dotnet=\"`ScopeName`\" pulumi-lang-go=\"`scopeName`\" pulumi-lang-python=\"`scope_name`\" pulumi-lang-yaml=\"`scopeName`\" pulumi-lang-java=\"`scopeName`\" pulumi-lang-hcl=\"`scope_name`\"\u003e`scopeName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`scopeField`\" pulumi-lang-dotnet=\"`ScopeField`\" pulumi-lang-go=\"`scopeField`\" pulumi-lang-python=\"`scope_field`\" pulumi-lang-yaml=\"`scopeField`\" pulumi-lang-java=\"`scopeField`\" pulumi-lang-hcl=\"`scope_field`\"\u003e`scopeField`\u003c/span\u003e\n* Exactly one of \u003cspan pulumi-lang-nodejs=\"`roleName`\" pulumi-lang-dotnet=\"`RoleName`\" pulumi-lang-go=\"`roleName`\" pulumi-lang-python=\"`role_name`\" pulumi-lang-yaml=\"`roleName`\" pulumi-lang-java=\"`roleName`\" pulumi-lang-hcl=\"`role_name`\"\u003e`roleName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`roleField`\" pulumi-lang-dotnet=\"`RoleField`\" pulumi-lang-go=\"`roleField`\" pulumi-lang-python=\"`role_field`\" pulumi-lang-yaml=\"`roleField`\" pulumi-lang-java=\"`roleField`\" pulumi-lang-hcl=\"`role_field`\"\u003e`roleField`\u003c/span\u003e\n\nYou can mix and match name-based and field-based configurations. For example, you can use \u003cspan pulumi-lang-nodejs=\"`scopeName`\" pulumi-lang-dotnet=\"`ScopeName`\" pulumi-lang-go=\"`scopeName`\" pulumi-lang-python=\"`scope_name`\" pulumi-lang-yaml=\"`scopeName`\" pulumi-lang-java=\"`scopeName`\" pulumi-lang-hcl=\"`scope_name`\"\u003e`scopeName`\u003c/span\u003e with \u003cspan pulumi-lang-nodejs=\"`roleField`\" pulumi-lang-dotnet=\"`RoleField`\" pulumi-lang-go=\"`roleField`\" pulumi-lang-python=\"`role_field`\" pulumi-lang-yaml=\"`roleField`\" pulumi-lang-java=\"`roleField`\" pulumi-lang-hcl=\"`role_field`\"\u003e`roleField`\u003c/span\u003e.\n\n## Updating\n\nThe \u003cspan pulumi-lang-nodejs=\"`scopeName`\" pulumi-lang-dotnet=\"`ScopeName`\" pulumi-lang-go=\"`scopeName`\" pulumi-lang-python=\"`scope_name`\" pulumi-lang-yaml=\"`scopeName`\" pulumi-lang-java=\"`scopeName`\" pulumi-lang-hcl=\"`scope_name`\"\u003e`scopeName`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`scopeField`\" pulumi-lang-dotnet=\"`ScopeField`\" pulumi-lang-go=\"`scopeField`\" pulumi-lang-python=\"`scope_field`\" pulumi-lang-yaml=\"`scopeField`\" pulumi-lang-java=\"`scopeField`\" pulumi-lang-hcl=\"`scope_field`\"\u003e`scopeField`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`roleName`\" pulumi-lang-dotnet=\"`RoleName`\" pulumi-lang-go=\"`roleName`\" pulumi-lang-python=\"`role_name`\" pulumi-lang-yaml=\"`roleName`\" pulumi-lang-java=\"`roleName`\" pulumi-lang-hcl=\"`role_name`\"\u003e`roleName`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`roleField`\" pulumi-lang-dotnet=\"`RoleField`\" pulumi-lang-go=\"`roleField`\" pulumi-lang-python=\"`role_field`\" pulumi-lang-yaml=\"`roleField`\" pulumi-lang-java=\"`roleField`\" pulumi-lang-hcl=\"`role_field`\"\u003e`roleField`\u003c/span\u003e parameters can be updated after creation. All other parameters require replacement if changed.\n\n## Import\n\nKMIP Secret CA Imported can be imported using the format `\u003cpath\u003e/ca/\u003cname\u003e`, e.g.\n\n```sh\n$ pulumi import vault:kmip/secretCaImported:SecretCaImported example kmip/ca/my-ca\n```\n\n**Note:** When importing, the \u003cspan pulumi-lang-nodejs=\"`caPem`\" pulumi-lang-dotnet=\"`CaPem`\" pulumi-lang-go=\"`caPem`\" pulumi-lang-python=\"`ca_pem`\" pulumi-lang-yaml=\"`caPem`\" pulumi-lang-java=\"`caPem`\" pulumi-lang-hcl=\"`ca_pem`\"\u003e`caPem`\u003c/span\u003e value cannot be retrieved from Vault and will need to be set in your configuration. This value will be ignored during import verification.\n\n", "properties": { "caPem": { "type": "string", "description": "CA certificate in PEM format.\n" }, "name": { "type": "string", "description": "Name to identify the CA. This will be used in the CA's path.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "path": { "type": "string", "description": "Path where KMIP backend is mounted. Must not begin or end with a `/`.\n" }, "roleField": { "type": "string", "description": "The field in the certificate to use for the role. Valid values are `CN`, `O`, `OU`, or `UID`. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`roleName`\" pulumi-lang-dotnet=\"`RoleName`\" pulumi-lang-go=\"`roleName`\" pulumi-lang-python=\"`role_name`\" pulumi-lang-yaml=\"`roleName`\" pulumi-lang-java=\"`roleName`\" pulumi-lang-hcl=\"`role_name`\"\u003e`roleName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`roleField`\" pulumi-lang-dotnet=\"`RoleField`\" pulumi-lang-go=\"`roleField`\" pulumi-lang-python=\"`role_field`\" pulumi-lang-yaml=\"`roleField`\" pulumi-lang-java=\"`roleField`\" pulumi-lang-hcl=\"`role_field`\"\u003e`roleField`\u003c/span\u003e.\n" }, "roleName": { "type": "string", "description": "The role name to associate with this CA. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`roleName`\" pulumi-lang-dotnet=\"`RoleName`\" pulumi-lang-go=\"`roleName`\" pulumi-lang-python=\"`role_name`\" pulumi-lang-yaml=\"`roleName`\" pulumi-lang-java=\"`roleName`\" pulumi-lang-hcl=\"`role_name`\"\u003e`roleName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`roleField`\" pulumi-lang-dotnet=\"`RoleField`\" pulumi-lang-go=\"`roleField`\" pulumi-lang-python=\"`role_field`\" pulumi-lang-yaml=\"`roleField`\" pulumi-lang-java=\"`roleField`\" pulumi-lang-hcl=\"`role_field`\"\u003e`roleField`\u003c/span\u003e.\n" }, "scopeField": { "type": "string", "description": "The field in the certificate to use for the scope. Valid values are `CN`, `O`, `OU`, or `UID`. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`scopeName`\" pulumi-lang-dotnet=\"`ScopeName`\" pulumi-lang-go=\"`scopeName`\" pulumi-lang-python=\"`scope_name`\" pulumi-lang-yaml=\"`scopeName`\" pulumi-lang-java=\"`scopeName`\" pulumi-lang-hcl=\"`scope_name`\"\u003e`scopeName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`scopeField`\" pulumi-lang-dotnet=\"`ScopeField`\" pulumi-lang-go=\"`scopeField`\" pulumi-lang-python=\"`scope_field`\" pulumi-lang-yaml=\"`scopeField`\" pulumi-lang-java=\"`scopeField`\" pulumi-lang-hcl=\"`scope_field`\"\u003e`scopeField`\u003c/span\u003e.\n" }, "scopeName": { "type": "string", "description": "The scope name to associate with this CA. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`scopeName`\" pulumi-lang-dotnet=\"`ScopeName`\" pulumi-lang-go=\"`scopeName`\" pulumi-lang-python=\"`scope_name`\" pulumi-lang-yaml=\"`scopeName`\" pulumi-lang-java=\"`scopeName`\" pulumi-lang-hcl=\"`scope_name`\"\u003e`scopeName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`scopeField`\" pulumi-lang-dotnet=\"`ScopeField`\" pulumi-lang-go=\"`scopeField`\" pulumi-lang-python=\"`scope_field`\" pulumi-lang-yaml=\"`scopeField`\" pulumi-lang-java=\"`scopeField`\" pulumi-lang-hcl=\"`scope_field`\"\u003e`scopeField`\u003c/span\u003e.\n" } }, "required": [ "caPem", "name", "path" ], "inputProperties": { "caPem": { "type": "string", "description": "CA certificate in PEM format.\n" }, "name": { "type": "string", "description": "Name to identify the CA. This will be used in the CA's path.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "path": { "type": "string", "description": "Path where KMIP backend is mounted. Must not begin or end with a `/`.\n" }, "roleField": { "type": "string", "description": "The field in the certificate to use for the role. Valid values are `CN`, `O`, `OU`, or `UID`. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`roleName`\" pulumi-lang-dotnet=\"`RoleName`\" pulumi-lang-go=\"`roleName`\" pulumi-lang-python=\"`role_name`\" pulumi-lang-yaml=\"`roleName`\" pulumi-lang-java=\"`roleName`\" pulumi-lang-hcl=\"`role_name`\"\u003e`roleName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`roleField`\" pulumi-lang-dotnet=\"`RoleField`\" pulumi-lang-go=\"`roleField`\" pulumi-lang-python=\"`role_field`\" pulumi-lang-yaml=\"`roleField`\" pulumi-lang-java=\"`roleField`\" pulumi-lang-hcl=\"`role_field`\"\u003e`roleField`\u003c/span\u003e.\n" }, "roleName": { "type": "string", "description": "The role name to associate with this CA. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`roleName`\" pulumi-lang-dotnet=\"`RoleName`\" pulumi-lang-go=\"`roleName`\" pulumi-lang-python=\"`role_name`\" pulumi-lang-yaml=\"`roleName`\" pulumi-lang-java=\"`roleName`\" pulumi-lang-hcl=\"`role_name`\"\u003e`roleName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`roleField`\" pulumi-lang-dotnet=\"`RoleField`\" pulumi-lang-go=\"`roleField`\" pulumi-lang-python=\"`role_field`\" pulumi-lang-yaml=\"`roleField`\" pulumi-lang-java=\"`roleField`\" pulumi-lang-hcl=\"`role_field`\"\u003e`roleField`\u003c/span\u003e.\n" }, "scopeField": { "type": "string", "description": "The field in the certificate to use for the scope. Valid values are `CN`, `O`, `OU`, or `UID`. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`scopeName`\" pulumi-lang-dotnet=\"`ScopeName`\" pulumi-lang-go=\"`scopeName`\" pulumi-lang-python=\"`scope_name`\" pulumi-lang-yaml=\"`scopeName`\" pulumi-lang-java=\"`scopeName`\" pulumi-lang-hcl=\"`scope_name`\"\u003e`scopeName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`scopeField`\" pulumi-lang-dotnet=\"`ScopeField`\" pulumi-lang-go=\"`scopeField`\" pulumi-lang-python=\"`scope_field`\" pulumi-lang-yaml=\"`scopeField`\" pulumi-lang-java=\"`scopeField`\" pulumi-lang-hcl=\"`scope_field`\"\u003e`scopeField`\u003c/span\u003e.\n" }, "scopeName": { "type": "string", "description": "The scope name to associate with this CA. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`scopeName`\" pulumi-lang-dotnet=\"`ScopeName`\" pulumi-lang-go=\"`scopeName`\" pulumi-lang-python=\"`scope_name`\" pulumi-lang-yaml=\"`scopeName`\" pulumi-lang-java=\"`scopeName`\" pulumi-lang-hcl=\"`scope_name`\"\u003e`scopeName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`scopeField`\" pulumi-lang-dotnet=\"`ScopeField`\" pulumi-lang-go=\"`scopeField`\" pulumi-lang-python=\"`scope_field`\" pulumi-lang-yaml=\"`scopeField`\" pulumi-lang-java=\"`scopeField`\" pulumi-lang-hcl=\"`scope_field`\"\u003e`scopeField`\u003c/span\u003e.\n" } }, "requiredInputs": [ "caPem", "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretCaImported resources.\n", "properties": { "caPem": { "type": "string", "description": "CA certificate in PEM format.\n" }, "name": { "type": "string", "description": "Name to identify the CA. This will be used in the CA's path.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "path": { "type": "string", "description": "Path where KMIP backend is mounted. Must not begin or end with a `/`.\n" }, "roleField": { "type": "string", "description": "The field in the certificate to use for the role. Valid values are `CN`, `O`, `OU`, or `UID`. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`roleName`\" pulumi-lang-dotnet=\"`RoleName`\" pulumi-lang-go=\"`roleName`\" pulumi-lang-python=\"`role_name`\" pulumi-lang-yaml=\"`roleName`\" pulumi-lang-java=\"`roleName`\" pulumi-lang-hcl=\"`role_name`\"\u003e`roleName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`roleField`\" pulumi-lang-dotnet=\"`RoleField`\" pulumi-lang-go=\"`roleField`\" pulumi-lang-python=\"`role_field`\" pulumi-lang-yaml=\"`roleField`\" pulumi-lang-java=\"`roleField`\" pulumi-lang-hcl=\"`role_field`\"\u003e`roleField`\u003c/span\u003e.\n" }, "roleName": { "type": "string", "description": "The role name to associate with this CA. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`roleName`\" pulumi-lang-dotnet=\"`RoleName`\" pulumi-lang-go=\"`roleName`\" pulumi-lang-python=\"`role_name`\" pulumi-lang-yaml=\"`roleName`\" pulumi-lang-java=\"`roleName`\" pulumi-lang-hcl=\"`role_name`\"\u003e`roleName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`roleField`\" pulumi-lang-dotnet=\"`RoleField`\" pulumi-lang-go=\"`roleField`\" pulumi-lang-python=\"`role_field`\" pulumi-lang-yaml=\"`roleField`\" pulumi-lang-java=\"`roleField`\" pulumi-lang-hcl=\"`role_field`\"\u003e`roleField`\u003c/span\u003e.\n" }, "scopeField": { "type": "string", "description": "The field in the certificate to use for the scope. Valid values are `CN`, `O`, `OU`, or `UID`. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`scopeName`\" pulumi-lang-dotnet=\"`ScopeName`\" pulumi-lang-go=\"`scopeName`\" pulumi-lang-python=\"`scope_name`\" pulumi-lang-yaml=\"`scopeName`\" pulumi-lang-java=\"`scopeName`\" pulumi-lang-hcl=\"`scope_name`\"\u003e`scopeName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`scopeField`\" pulumi-lang-dotnet=\"`ScopeField`\" pulumi-lang-go=\"`scopeField`\" pulumi-lang-python=\"`scope_field`\" pulumi-lang-yaml=\"`scopeField`\" pulumi-lang-java=\"`scopeField`\" pulumi-lang-hcl=\"`scope_field`\"\u003e`scopeField`\u003c/span\u003e.\n" }, "scopeName": { "type": "string", "description": "The scope name to associate with this CA. Must specify exactly one of \u003cspan pulumi-lang-nodejs=\"`scopeName`\" pulumi-lang-dotnet=\"`ScopeName`\" pulumi-lang-go=\"`scopeName`\" pulumi-lang-python=\"`scope_name`\" pulumi-lang-yaml=\"`scopeName`\" pulumi-lang-java=\"`scopeName`\" pulumi-lang-hcl=\"`scope_name`\"\u003e`scopeName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`scopeField`\" pulumi-lang-dotnet=\"`ScopeField`\" pulumi-lang-go=\"`scopeField`\" pulumi-lang-python=\"`scope_field`\" pulumi-lang-yaml=\"`scopeField`\" pulumi-lang-java=\"`scopeField`\" pulumi-lang-hcl=\"`scope_field`\"\u003e`scopeField`\u003c/span\u003e.\n" } }, "type": "object" } }, "vault:kmip/secretListener:SecretListener": { "description": "Manages KMIP Secret listeners in a Vault server. This feature requires\nVault Enterprise. See the [Vault documentation](https://www.vaultproject.io/docs/secrets/kmip)\nfor more information.\n\nListeners define the network configuration for KMIP servers, including the address to listen on,\nTLS settings, and which CA to use for generating server certificates and verifying client certificates.\n\n## Example Usage\n\n### Basic Listener\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst example = new vault.index.KmipSecretCa(\"example\", {\n path: _default.path,\n name: \"example-ca\",\n keyType: \"ec\",\n keyBits: 256,\n});\nconst exampleSecretListener = new vault.kmip.SecretListener(\"example\", {\n path: _default.path,\n name: \"example-listener\",\n ca: example.name,\n address: \"0.0.0.0:5696\",\n serverHostnames: [\"kmip.example.com\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\nexample = vault.KmipSecretCa(\"example\",\n path=default.path,\n name=example-ca,\n key_type=ec,\n key_bits=256)\nexample_secret_listener = vault.kmip.SecretListener(\"example\",\n path=default.path,\n name=\"example-listener\",\n ca=example[\"name\"],\n address=\"0.0.0.0:5696\",\n server_hostnames=[\"kmip.example.com\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var example = new Vault.KmipSecretCa(\"example\", new()\n {\n Path = @default.Path,\n Name = \"example-ca\",\n KeyType = \"ec\",\n KeyBits = 256,\n });\n\n var exampleSecretListener = new Vault.Kmip.SecretListener(\"example\", new()\n {\n Path = @default.Path,\n Name = \"example-listener\",\n Ca = example.Name,\n Address = \"0.0.0.0:5696\",\n ServerHostnames = new[]\n {\n \"kmip.example.com\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texample, err := vault.NewKmipSecretCa(ctx, \"example\", \u0026vault.KmipSecretCaArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: \"example-ca\",\n\t\t\tKeyType: \"ec\",\n\t\t\tKeyBits: 256,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretListener(ctx, \"example\", \u0026kmip.SecretListenerArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: pulumi.String(\"example-listener\"),\n\t\t\tCa: example.Name,\n\t\t\tAddress: pulumi.String(\"0.0.0.0:5696\"),\n\t\t\tServerHostnames: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"kmip.example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmipsecretca\" \"example\" {\n path = vault_kmip_secretbackend.default.path\n name = \"example-ca\"\n key_type = \"ec\"\n key_bits = 256\n}\nresource \"vault_kmip_secretlistener\" \"example\" {\n path = vault_kmip_secretbackend.default.path\n name = \"example-listener\"\n ca = vault_kmipsecretca.example.name\n address = \"0.0.0.0:5696\"\n server_hostnames = [\"kmip.example.com\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.KmipSecretCa;\nimport com.pulumi.vault.KmipSecretCaArgs;\nimport com.pulumi.vault.kmip.SecretListener;\nimport com.pulumi.vault.kmip.SecretListenerArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var example = new KmipSecretCa(\"example\", KmipSecretCaArgs.builder()\n .path(default_.path())\n .name(\"example-ca\")\n .keyType(\"ec\")\n .keyBits(256)\n .build());\n\n var exampleSecretListener = new SecretListener(\"exampleSecretListener\", SecretListenerArgs.builder()\n .path(default_.path())\n .name(\"example-listener\")\n .ca(example.name())\n .address(\"0.0.0.0:5696\")\n .serverHostnames(\"kmip.example.com\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n example:\n type: vault:KmipSecretCa\n properties:\n path: ${default.path}\n name: example-ca\n keyType: ec\n keyBits: 256\n exampleSecretListener:\n type: vault:kmip:SecretListener\n name: example\n properties:\n path: ${default.path}\n name: example-listener\n ca: ${example.name}\n address: 0.0.0.0:5696\n serverHostnames:\n - kmip.example.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Listener with Advanced TLS Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst primary = new vault.index.KmipSecretCa(\"primary\", {\n path: _default.path,\n name: \"primary-ca\",\n keyType: \"rsa\",\n keyBits: 4096,\n});\nconst secondary = new vault.index.KmipSecretCa(\"secondary\", {\n path: _default.path,\n name: \"secondary-ca\",\n keyType: \"ec\",\n keyBits: 256,\n});\nconst advanced = new vault.kmip.SecretListener(\"advanced\", {\n path: _default.path,\n name: \"advanced-listener\",\n ca: primary.name,\n address: \"0.0.0.0:5696\",\n additionalClientCas: [secondary.name],\n alsoUseLegacyCa: true,\n serverIps: [\n \"192.168.1.100\",\n \"10.0.0.50\",\n ],\n serverHostnames: [\n \"kmip.example.com\",\n \"kmip-backup.example.com\",\n ],\n tlsMinVersion: \"tls13\",\n tlsCipherSuites: \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\nprimary = vault.KmipSecretCa(\"primary\",\n path=default.path,\n name=primary-ca,\n key_type=rsa,\n key_bits=4096)\nsecondary = vault.KmipSecretCa(\"secondary\",\n path=default.path,\n name=secondary-ca,\n key_type=ec,\n key_bits=256)\nadvanced = vault.kmip.SecretListener(\"advanced\",\n path=default.path,\n name=\"advanced-listener\",\n ca=primary[\"name\"],\n address=\"0.0.0.0:5696\",\n additional_client_cas=[secondary[\"name\"]],\n also_use_legacy_ca=True,\n server_ips=[\n \"192.168.1.100\",\n \"10.0.0.50\",\n ],\n server_hostnames=[\n \"kmip.example.com\",\n \"kmip-backup.example.com\",\n ],\n tls_min_version=\"tls13\",\n tls_cipher_suites=\"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var primary = new Vault.KmipSecretCa(\"primary\", new()\n {\n Path = @default.Path,\n Name = \"primary-ca\",\n KeyType = \"rsa\",\n KeyBits = 4096,\n });\n\n var secondary = new Vault.KmipSecretCa(\"secondary\", new()\n {\n Path = @default.Path,\n Name = \"secondary-ca\",\n KeyType = \"ec\",\n KeyBits = 256,\n });\n\n var advanced = new Vault.Kmip.SecretListener(\"advanced\", new()\n {\n Path = @default.Path,\n Name = \"advanced-listener\",\n Ca = primary.Name,\n Address = \"0.0.0.0:5696\",\n AdditionalClientCas = new[]\n {\n secondary.Name,\n },\n AlsoUseLegacyCa = true,\n ServerIps = new[]\n {\n \"192.168.1.100\",\n \"10.0.0.50\",\n },\n ServerHostnames = new[]\n {\n \"kmip.example.com\",\n \"kmip-backup.example.com\",\n },\n TlsMinVersion = \"tls13\",\n TlsCipherSuites = \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tprimary, err := vault.NewKmipSecretCa(ctx, \"primary\", \u0026vault.KmipSecretCaArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: \"primary-ca\",\n\t\t\tKeyType: \"rsa\",\n\t\t\tKeyBits: 4096,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tsecondary, err := vault.NewKmipSecretCa(ctx, \"secondary\", \u0026vault.KmipSecretCaArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: \"secondary-ca\",\n\t\t\tKeyType: \"ec\",\n\t\t\tKeyBits: 256,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretListener(ctx, \"advanced\", \u0026kmip.SecretListenerArgs{\n\t\t\tPath: _default.Path,\n\t\t\tName: pulumi.String(\"advanced-listener\"),\n\t\t\tCa: primary.Name,\n\t\t\tAddress: pulumi.String(\"0.0.0.0:5696\"),\n\t\t\tAdditionalClientCas: pulumi.StringArray{\n\t\t\t\tsecondary.Name,\n\t\t\t},\n\t\t\tAlsoUseLegacyCa: pulumi.Bool(true),\n\t\t\tServerIps: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"192.168.1.100\"),\n\t\t\t\tpulumi.String(\"10.0.0.50\"),\n\t\t\t},\n\t\t\tServerHostnames: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"kmip.example.com\"),\n\t\t\t\tpulumi.String(\"kmip-backup.example.com\"),\n\t\t\t},\n\t\t\tTlsMinVersion: pulumi.String(\"tls13\"),\n\t\t\tTlsCipherSuites: pulumi.String(\"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmipsecretca\" \"primary\" {\n path = vault_kmip_secretbackend.default.path\n name = \"primary-ca\"\n key_type = \"rsa\"\n key_bits = 4096\n}\nresource \"vault_kmipsecretca\" \"secondary\" {\n path = vault_kmip_secretbackend.default.path\n name = \"secondary-ca\"\n key_type = \"ec\"\n key_bits = 256\n}\nresource \"vault_kmip_secretlistener\" \"advanced\" {\n path = vault_kmip_secretbackend.default.path\n name = \"advanced-listener\"\n ca = vault_kmipsecretca.primary.name\n address = \"0.0.0.0:5696\"\n additional_client_cas = [vault_kmipsecretca.secondary.name]\n also_use_legacy_ca = true\n server_ips = [\"192.168.1.100\", \"10.0.0.50\"]\n server_hostnames = [\"kmip.example.com\", \"kmip-backup.example.com\"]\n tls_min_version = \"tls13\"\n tls_cipher_suites = \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.KmipSecretCa;\nimport com.pulumi.vault.KmipSecretCaArgs;\nimport com.pulumi.vault.kmip.SecretListener;\nimport com.pulumi.vault.kmip.SecretListenerArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var primary = new KmipSecretCa(\"primary\", KmipSecretCaArgs.builder()\n .path(default_.path())\n .name(\"primary-ca\")\n .keyType(\"rsa\")\n .keyBits(4096)\n .build());\n\n var secondary = new KmipSecretCa(\"secondary\", KmipSecretCaArgs.builder()\n .path(default_.path())\n .name(\"secondary-ca\")\n .keyType(\"ec\")\n .keyBits(256)\n .build());\n\n var advanced = new SecretListener(\"advanced\", SecretListenerArgs.builder()\n .path(default_.path())\n .name(\"advanced-listener\")\n .ca(primary.name())\n .address(\"0.0.0.0:5696\")\n .additionalClientCas(secondary.name())\n .alsoUseLegacyCa(true)\n .serverIps( \n \"192.168.1.100\",\n \"10.0.0.50\")\n .serverHostnames( \n \"kmip.example.com\",\n \"kmip-backup.example.com\")\n .tlsMinVersion(\"tls13\")\n .tlsCipherSuites(\"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n primary:\n type: vault:KmipSecretCa\n properties:\n path: ${default.path}\n name: primary-ca\n keyType: rsa\n keyBits: 4096\n secondary:\n type: vault:KmipSecretCa\n properties:\n path: ${default.path}\n name: secondary-ca\n keyType: ec\n keyBits: 256\n advanced:\n type: vault:kmip:SecretListener\n properties:\n path: ${default.path}\n name: advanced-listener\n ca: ${primary.name}\n address: 0.0.0.0:5696\n additionalClientCas:\n - ${secondary.name}\n alsoUseLegacyCa: true\n serverIps:\n - 192.168.1.100\n - 10.0.0.50\n serverHostnames:\n - kmip.example.com\n - kmip-backup.example.com\n tlsMinVersion: tls13\n tlsCipherSuites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Notes\n\n* The listener requires a CA to be configured first using \u003cspan pulumi-lang-nodejs=\"`vaultKmipSecretCa`\" pulumi-lang-dotnet=\"`VaultKmipSecretCa`\" pulumi-lang-go=\"`vaultKmipSecretCa`\" pulumi-lang-python=\"`vault_kmip_secret_ca`\" pulumi-lang-yaml=\"`vaultKmipSecretCa`\" pulumi-lang-java=\"`vaultKmipSecretCa`\" pulumi-lang-hcl=\"`vault_kmip_secret_ca`\"\u003e`vaultKmipSecretCa`\u003c/span\u003e.\n* The \u003cspan pulumi-lang-nodejs=\"`address`\" pulumi-lang-dotnet=\"`Address`\" pulumi-lang-go=\"`address`\" pulumi-lang-python=\"`address`\" pulumi-lang-yaml=\"`address`\" pulumi-lang-java=\"`address`\" pulumi-lang-hcl=\"`address`\"\u003e`address`\u003c/span\u003e must be a valid host:port combination.\n* When \u003cspan pulumi-lang-nodejs=\"`serverIps`\" pulumi-lang-dotnet=\"`ServerIps`\" pulumi-lang-go=\"`serverIps`\" pulumi-lang-python=\"`server_ips`\" pulumi-lang-yaml=\"`serverIps`\" pulumi-lang-java=\"`serverIps`\" pulumi-lang-hcl=\"`server_ips`\"\u003e`serverIps`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`serverHostnames`\" pulumi-lang-dotnet=\"`ServerHostnames`\" pulumi-lang-go=\"`serverHostnames`\" pulumi-lang-python=\"`server_hostnames`\" pulumi-lang-yaml=\"`serverHostnames`\" pulumi-lang-java=\"`serverHostnames`\" pulumi-lang-hcl=\"`server_hostnames`\"\u003e`serverHostnames`\u003c/span\u003e are specified, they will be included in the server certificate as Subject Alternative Names (SANs).\n* The \u003cspan pulumi-lang-nodejs=\"`additionalClientCas`\" pulumi-lang-dotnet=\"`AdditionalClientCas`\" pulumi-lang-go=\"`additionalClientCas`\" pulumi-lang-python=\"`additional_client_cas`\" pulumi-lang-yaml=\"`additionalClientCas`\" pulumi-lang-java=\"`additionalClientCas`\" pulumi-lang-hcl=\"`additional_client_cas`\"\u003e`additionalClientCas`\u003c/span\u003e parameter allows you to accept client certificates from multiple CAs, useful for certificate rotation scenarios.\n* TLS cipher suites configuration only applies to TLS 1.2 and earlier versions.\n\n## Import\n\nKMIP Secret listener can be imported using the format `\u003cpath\u003e/listener/\u003cname\u003e`, e.g.\n\n```sh\n$ pulumi import vault:kmip/secretListener:SecretListener example kmip/listener/example-listener\n```\n\n", "properties": { "additionalClientCas": { "type": "array", "items": { "type": "string" }, "description": "Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.\n" }, "address": { "type": "string", "description": "Host:port address to listen on (e.g., `0.0.0.0:5696` or `127.0.0.1:8080`).\n" }, "alsoUseLegacyCa": { "type": "boolean", "description": "Use the legacy unnamed CA for verifying client certificates as well. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "ca": { "type": "string", "description": "Name of the CA to use to generate the server certificate and verify client certificates.\n" }, "name": { "type": "string", "description": "Unique name for the listener.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Path where KMIP backend is mounted. Must not begin or end with a `/`.\n" }, "serverHostnames": { "type": "array", "items": { "type": "string" }, "description": "DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.\n" }, "serverIps": { "type": "array", "items": { "type": "string" }, "description": "IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.\n" }, "tlsCipherSuites": { "type": "string", "description": "Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`.\n" }, "tlsMaxVersion": { "type": "string", "description": "Maximum TLS version to accept. Valid values are \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e.\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to accept. Valid values are \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e.\n" } }, "required": [ "address", "alsoUseLegacyCa", "ca", "name", "path", "serverIps", "tlsMinVersion" ], "inputProperties": { "additionalClientCas": { "type": "array", "items": { "type": "string" }, "description": "Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.\n" }, "address": { "type": "string", "description": "Host:port address to listen on (e.g., `0.0.0.0:5696` or `127.0.0.1:8080`).\n" }, "alsoUseLegacyCa": { "type": "boolean", "description": "Use the legacy unnamed CA for verifying client certificates as well. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "ca": { "type": "string", "description": "Name of the CA to use to generate the server certificate and verify client certificates.\n" }, "name": { "type": "string", "description": "Unique name for the listener.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Path where KMIP backend is mounted. Must not begin or end with a `/`.\n" }, "serverHostnames": { "type": "array", "items": { "type": "string" }, "description": "DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.\n" }, "serverIps": { "type": "array", "items": { "type": "string" }, "description": "IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.\n" }, "tlsCipherSuites": { "type": "string", "description": "Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`.\n" }, "tlsMaxVersion": { "type": "string", "description": "Maximum TLS version to accept. Valid values are \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e.\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to accept. Valid values are \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e.\n" } }, "requiredInputs": [ "address", "ca", "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretListener resources.\n", "properties": { "additionalClientCas": { "type": "array", "items": { "type": "string" }, "description": "Names of additional TLS CAs to use to verify client certificates. This allows accepting client certificates from multiple CAs.\n" }, "address": { "type": "string", "description": "Host:port address to listen on (e.g., `0.0.0.0:5696` or `127.0.0.1:8080`).\n" }, "alsoUseLegacyCa": { "type": "boolean", "description": "Use the legacy unnamed CA for verifying client certificates as well. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "ca": { "type": "string", "description": "Name of the CA to use to generate the server certificate and verify client certificates.\n" }, "name": { "type": "string", "description": "Unique name for the listener.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Path where KMIP backend is mounted. Must not begin or end with a `/`.\n" }, "serverHostnames": { "type": "array", "items": { "type": "string" }, "description": "DNS SANs to include in the listener's server certificate. These hostnames will be added as Subject Alternative Names in the certificate.\n" }, "serverIps": { "type": "array", "items": { "type": "string" }, "description": "IP SANs to include in the listener's server certificate. These IPs will be added as Subject Alternative Names in the certificate.\n" }, "tlsCipherSuites": { "type": "string", "description": "Comma-separated list of TLS cipher suites to allow. This setting does not apply to TLS 1.3 and later. Example: `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`.\n" }, "tlsMaxVersion": { "type": "string", "description": "Maximum TLS version to accept. Valid values are \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e.\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum TLS version to accept. Valid values are \u003cspan pulumi-lang-nodejs=\"`tls12`\" pulumi-lang-dotnet=\"`Tls12`\" pulumi-lang-go=\"`tls12`\" pulumi-lang-python=\"`tls12`\" pulumi-lang-yaml=\"`tls12`\" pulumi-lang-java=\"`tls12`\" pulumi-lang-hcl=\"`tls12`\"\u003e`tls12`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`tls13`\" pulumi-lang-dotnet=\"`Tls13`\" pulumi-lang-go=\"`tls13`\" pulumi-lang-python=\"`tls13`\" pulumi-lang-yaml=\"`tls13`\" pulumi-lang-java=\"`tls13`\" pulumi-lang-hcl=\"`tls13`\"\u003e`tls13`\u003c/span\u003e.\n" } }, "type": "object" } }, "vault:kmip/secretRole:SecretRole": { "description": "Manages KMIP Secret roles in a Vault server. This feature requires\nVault Enterprise. See the [Vault documentation](https://www.vaultproject.io/docs/secrets/kmip)\nfor more information.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst dev = new vault.kmip.SecretScope(\"dev\", {\n path: _default.path,\n scope: \"dev\",\n force: true,\n});\nconst admin = new vault.kmip.SecretRole(\"admin\", {\n path: dev.path,\n scope: dev.scope,\n role: \"admin\",\n tlsClientKeyType: \"ec\",\n tlsClientKeyBits: 256,\n operationActivate: true,\n operationGet: true,\n operationGetAttributes: true,\n operationCreate: true,\n operationDestroy: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\ndev = vault.kmip.SecretScope(\"dev\",\n path=default.path,\n scope=\"dev\",\n force=True)\nadmin = vault.kmip.SecretRole(\"admin\",\n path=dev.path,\n scope=dev.scope,\n role=\"admin\",\n tls_client_key_type=\"ec\",\n tls_client_key_bits=256,\n operation_activate=True,\n operation_get=True,\n operation_get_attributes=True,\n operation_create=True,\n operation_destroy=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var dev = new Vault.Kmip.SecretScope(\"dev\", new()\n {\n Path = @default.Path,\n Scope = \"dev\",\n Force = true,\n });\n\n var admin = new Vault.Kmip.SecretRole(\"admin\", new()\n {\n Path = dev.Path,\n Scope = dev.Scope,\n Role = \"admin\",\n TlsClientKeyType = \"ec\",\n TlsClientKeyBits = 256,\n OperationActivate = true,\n OperationGet = true,\n OperationGetAttributes = true,\n OperationCreate = true,\n OperationDestroy = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdev, err := kmip.NewSecretScope(ctx, \"dev\", \u0026kmip.SecretScopeArgs{\n\t\t\tPath: _default.Path,\n\t\t\tScope: pulumi.String(\"dev\"),\n\t\t\tForce: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretRole(ctx, \"admin\", \u0026kmip.SecretRoleArgs{\n\t\t\tPath: dev.Path,\n\t\t\tScope: dev.Scope,\n\t\t\tRole: pulumi.String(\"admin\"),\n\t\t\tTlsClientKeyType: pulumi.String(\"ec\"),\n\t\t\tTlsClientKeyBits: pulumi.Int(256),\n\t\t\tOperationActivate: pulumi.Bool(true),\n\t\t\tOperationGet: pulumi.Bool(true),\n\t\t\tOperationGetAttributes: pulumi.Bool(true),\n\t\t\tOperationCreate: pulumi.Bool(true),\n\t\t\tOperationDestroy: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmip_secretscope\" \"dev\" {\n path = vault_kmip_secretbackend.default.path\n scope = \"dev\"\n force = true\n}\nresource \"vault_kmip_secretrole\" \"admin\" {\n path = vault_kmip_secretscope.dev.path\n scope = vault_kmip_secretscope.dev.scope\n role = \"admin\"\n tls_client_key_type = \"ec\"\n tls_client_key_bits = 256\n operation_activate = true\n operation_get = true\n operation_get_attributes = true\n operation_create = true\n operation_destroy = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.kmip.SecretScope;\nimport com.pulumi.vault.kmip.SecretScopeArgs;\nimport com.pulumi.vault.kmip.SecretRole;\nimport com.pulumi.vault.kmip.SecretRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var dev = new SecretScope(\"dev\", SecretScopeArgs.builder()\n .path(default_.path())\n .scope(\"dev\")\n .force(true)\n .build());\n\n var admin = new SecretRole(\"admin\", SecretRoleArgs.builder()\n .path(dev.path())\n .scope(dev.scope())\n .role(\"admin\")\n .tlsClientKeyType(\"ec\")\n .tlsClientKeyBits(256)\n .operationActivate(true)\n .operationGet(true)\n .operationGetAttributes(true)\n .operationCreate(true)\n .operationDestroy(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n dev:\n type: vault:kmip:SecretScope\n properties:\n path: ${default.path}\n scope: dev\n force: true\n admin:\n type: vault:kmip:SecretRole\n properties:\n path: ${dev.path}\n scope: ${dev.scope}\n role: admin\n tlsClientKeyType: ec\n tlsClientKeyBits: 256\n operationActivate: true\n operationGet: true\n operationGetAttributes: true\n operationCreate: true\n operationDestroy: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKMIP Secret role can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:kmip/secretRole:SecretRole admin kmip\n```\n\n", "properties": { "ca": { "type": "string", "description": "Name of the ca to use, if absent use legacy ca" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "operationActivate": { "type": "boolean", "description": "Grant permission to use the KMIP Activate operation.\n" }, "operationAddAttribute": { "type": "boolean", "description": "Grant permission to use the KMIP Add Attribute operation.\n" }, "operationAll": { "type": "boolean", "description": "Grant all permissions to this role. May not be specified with any other `operation_*` params.\n" }, "operationCreate": { "type": "boolean", "description": "Grant permission to use the KMIP Create operation.\n" }, "operationCreateKeyPair": { "type": "boolean", "description": "Grant permission to use the KMIP Create Key Pair operation.\n" }, "operationDecrypt": { "type": "boolean", "description": "Grant permission to use the KMIP Decrypt operation.\n" }, "operationDeleteAttribute": { "type": "boolean", "description": "Grant permission to use the KMIP Delete Attribute operation.\n" }, "operationDestroy": { "type": "boolean", "description": "Grant permission to use the KMIP Destroy operation.\n" }, "operationDiscoverVersions": { "type": "boolean", "description": "Grant permission to use the KMIP Discover Version operation.\n" }, "operationEncrypt": { "type": "boolean", "description": "Grant permission to use the KMIP Encrypt operation.\n" }, "operationGet": { "type": "boolean", "description": "Grant permission to use the KMIP Get operation.\n" }, "operationGetAttributeList": { "type": "boolean", "description": "Grant permission to use the KMIP Get Atrribute List operation.\n" }, "operationGetAttributes": { "type": "boolean", "description": "Grant permission to use the KMIP Get Atrributes operation.\n" }, "operationImport": { "type": "boolean", "description": "Grant permission to use the KMIP Import operation.\n" }, "operationLocate": { "type": "boolean", "description": "Grant permission to use the KMIP Get Locate operation.\n" }, "operationMac": { "type": "boolean", "description": "Grant permission to use the KMIP MAC operation.\n" }, "operationMacVerify": { "type": "boolean", "description": "Grant permission to use the KMIP MAC Verify operation.\n" }, "operationModifyAttribute": { "type": "boolean", "description": "Grant permission to use the KMIP Modify Attribute operation.\n" }, "operationNone": { "type": "boolean", "description": "Remove all permissions from this role. May not be specified with any other `operation_*` params.\n" }, "operationQuery": { "type": "boolean", "description": "Grant permission to use the KMIP Query operation.\n" }, "operationRegister": { "type": "boolean", "description": "Grant permission to use the KMIP Register operation.\n" }, "operationRekey": { "type": "boolean", "description": "Grant permission to use the KMIP Rekey operation.\n" }, "operationRekeyKeyPair": { "type": "boolean", "description": "Grant permission to use the KMIP Rekey Key Pair operation.\n" }, "operationRevoke": { "type": "boolean", "description": "Grant permission to use the KMIP Revoke operation.\n" }, "operationRngRetrieve": { "type": "boolean", "description": "Grant permission to use the KMIP RNG Retrieve operation.\n" }, "operationRngSeed": { "type": "boolean", "description": "Grant permission to use the KMIP RNG Seed operation.\n" }, "operationSign": { "type": "boolean", "description": "Grant permission to use the KMIP Sign operation.\n" }, "operationSignatureVerify": { "type": "boolean", "description": "Grant permission to use the KMIP Signature Verify operation.\n" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`kmip`\" pulumi-lang-dotnet=\"`Kmip`\" pulumi-lang-go=\"`kmip`\" pulumi-lang-python=\"`kmip`\" pulumi-lang-yaml=\"`kmip`\" pulumi-lang-java=\"`kmip`\" pulumi-lang-hcl=\"`kmip`\"\u003e`kmip`\u003c/span\u003e.\n" }, "role": { "type": "string", "description": "Name of the role.\n" }, "scope": { "type": "string", "description": "Name of the scope.\n" }, "tlsClientKeyBits": { "type": "integer", "description": "Client certificate key bits, valid values depend on key type.\n" }, "tlsClientKeyType": { "type": "string", "description": "Client certificate key type, \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "tlsClientTtl": { "type": "integer", "description": "Client certificate TTL in seconds.\n" } }, "required": [ "operationActivate", "operationAddAttribute", "operationAll", "operationCreate", "operationCreateKeyPair", "operationDecrypt", "operationDeleteAttribute", "operationDestroy", "operationDiscoverVersions", "operationEncrypt", "operationGet", "operationGetAttributeList", "operationGetAttributes", "operationImport", "operationLocate", "operationMac", "operationMacVerify", "operationModifyAttribute", "operationNone", "operationQuery", "operationRegister", "operationRekey", "operationRekeyKeyPair", "operationRevoke", "operationRngRetrieve", "operationRngSeed", "operationSign", "operationSignatureVerify", "path", "role", "scope" ], "inputProperties": { "ca": { "type": "string", "description": "Name of the ca to use, if absent use legacy ca" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "operationActivate": { "type": "boolean", "description": "Grant permission to use the KMIP Activate operation.\n" }, "operationAddAttribute": { "type": "boolean", "description": "Grant permission to use the KMIP Add Attribute operation.\n" }, "operationAll": { "type": "boolean", "description": "Grant all permissions to this role. May not be specified with any other `operation_*` params.\n" }, "operationCreate": { "type": "boolean", "description": "Grant permission to use the KMIP Create operation.\n" }, "operationCreateKeyPair": { "type": "boolean", "description": "Grant permission to use the KMIP Create Key Pair operation.\n" }, "operationDecrypt": { "type": "boolean", "description": "Grant permission to use the KMIP Decrypt operation.\n" }, "operationDeleteAttribute": { "type": "boolean", "description": "Grant permission to use the KMIP Delete Attribute operation.\n" }, "operationDestroy": { "type": "boolean", "description": "Grant permission to use the KMIP Destroy operation.\n" }, "operationDiscoverVersions": { "type": "boolean", "description": "Grant permission to use the KMIP Discover Version operation.\n" }, "operationEncrypt": { "type": "boolean", "description": "Grant permission to use the KMIP Encrypt operation.\n" }, "operationGet": { "type": "boolean", "description": "Grant permission to use the KMIP Get operation.\n" }, "operationGetAttributeList": { "type": "boolean", "description": "Grant permission to use the KMIP Get Atrribute List operation.\n" }, "operationGetAttributes": { "type": "boolean", "description": "Grant permission to use the KMIP Get Atrributes operation.\n" }, "operationImport": { "type": "boolean", "description": "Grant permission to use the KMIP Import operation.\n" }, "operationLocate": { "type": "boolean", "description": "Grant permission to use the KMIP Get Locate operation.\n" }, "operationMac": { "type": "boolean", "description": "Grant permission to use the KMIP MAC operation.\n" }, "operationMacVerify": { "type": "boolean", "description": "Grant permission to use the KMIP MAC Verify operation.\n" }, "operationModifyAttribute": { "type": "boolean", "description": "Grant permission to use the KMIP Modify Attribute operation.\n" }, "operationNone": { "type": "boolean", "description": "Remove all permissions from this role. May not be specified with any other `operation_*` params.\n" }, "operationQuery": { "type": "boolean", "description": "Grant permission to use the KMIP Query operation.\n" }, "operationRegister": { "type": "boolean", "description": "Grant permission to use the KMIP Register operation.\n" }, "operationRekey": { "type": "boolean", "description": "Grant permission to use the KMIP Rekey operation.\n" }, "operationRekeyKeyPair": { "type": "boolean", "description": "Grant permission to use the KMIP Rekey Key Pair operation.\n" }, "operationRevoke": { "type": "boolean", "description": "Grant permission to use the KMIP Revoke operation.\n" }, "operationRngRetrieve": { "type": "boolean", "description": "Grant permission to use the KMIP RNG Retrieve operation.\n" }, "operationRngSeed": { "type": "boolean", "description": "Grant permission to use the KMIP RNG Seed operation.\n" }, "operationSign": { "type": "boolean", "description": "Grant permission to use the KMIP Sign operation.\n" }, "operationSignatureVerify": { "type": "boolean", "description": "Grant permission to use the KMIP Signature Verify operation.\n" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`kmip`\" pulumi-lang-dotnet=\"`Kmip`\" pulumi-lang-go=\"`kmip`\" pulumi-lang-python=\"`kmip`\" pulumi-lang-yaml=\"`kmip`\" pulumi-lang-java=\"`kmip`\" pulumi-lang-hcl=\"`kmip`\"\u003e`kmip`\u003c/span\u003e.\n" }, "role": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "scope": { "type": "string", "description": "Name of the scope.\n", "willReplaceOnChanges": true }, "tlsClientKeyBits": { "type": "integer", "description": "Client certificate key bits, valid values depend on key type.\n" }, "tlsClientKeyType": { "type": "string", "description": "Client certificate key type, \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "tlsClientTtl": { "type": "integer", "description": "Client certificate TTL in seconds.\n" } }, "requiredInputs": [ "path", "role", "scope" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretRole resources.\n", "properties": { "ca": { "type": "string", "description": "Name of the ca to use, if absent use legacy ca" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "operationActivate": { "type": "boolean", "description": "Grant permission to use the KMIP Activate operation.\n" }, "operationAddAttribute": { "type": "boolean", "description": "Grant permission to use the KMIP Add Attribute operation.\n" }, "operationAll": { "type": "boolean", "description": "Grant all permissions to this role. May not be specified with any other `operation_*` params.\n" }, "operationCreate": { "type": "boolean", "description": "Grant permission to use the KMIP Create operation.\n" }, "operationCreateKeyPair": { "type": "boolean", "description": "Grant permission to use the KMIP Create Key Pair operation.\n" }, "operationDecrypt": { "type": "boolean", "description": "Grant permission to use the KMIP Decrypt operation.\n" }, "operationDeleteAttribute": { "type": "boolean", "description": "Grant permission to use the KMIP Delete Attribute operation.\n" }, "operationDestroy": { "type": "boolean", "description": "Grant permission to use the KMIP Destroy operation.\n" }, "operationDiscoverVersions": { "type": "boolean", "description": "Grant permission to use the KMIP Discover Version operation.\n" }, "operationEncrypt": { "type": "boolean", "description": "Grant permission to use the KMIP Encrypt operation.\n" }, "operationGet": { "type": "boolean", "description": "Grant permission to use the KMIP Get operation.\n" }, "operationGetAttributeList": { "type": "boolean", "description": "Grant permission to use the KMIP Get Atrribute List operation.\n" }, "operationGetAttributes": { "type": "boolean", "description": "Grant permission to use the KMIP Get Atrributes operation.\n" }, "operationImport": { "type": "boolean", "description": "Grant permission to use the KMIP Import operation.\n" }, "operationLocate": { "type": "boolean", "description": "Grant permission to use the KMIP Get Locate operation.\n" }, "operationMac": { "type": "boolean", "description": "Grant permission to use the KMIP MAC operation.\n" }, "operationMacVerify": { "type": "boolean", "description": "Grant permission to use the KMIP MAC Verify operation.\n" }, "operationModifyAttribute": { "type": "boolean", "description": "Grant permission to use the KMIP Modify Attribute operation.\n" }, "operationNone": { "type": "boolean", "description": "Remove all permissions from this role. May not be specified with any other `operation_*` params.\n" }, "operationQuery": { "type": "boolean", "description": "Grant permission to use the KMIP Query operation.\n" }, "operationRegister": { "type": "boolean", "description": "Grant permission to use the KMIP Register operation.\n" }, "operationRekey": { "type": "boolean", "description": "Grant permission to use the KMIP Rekey operation.\n" }, "operationRekeyKeyPair": { "type": "boolean", "description": "Grant permission to use the KMIP Rekey Key Pair operation.\n" }, "operationRevoke": { "type": "boolean", "description": "Grant permission to use the KMIP Revoke operation.\n" }, "operationRngRetrieve": { "type": "boolean", "description": "Grant permission to use the KMIP RNG Retrieve operation.\n" }, "operationRngSeed": { "type": "boolean", "description": "Grant permission to use the KMIP RNG Seed operation.\n" }, "operationSign": { "type": "boolean", "description": "Grant permission to use the KMIP Sign operation.\n" }, "operationSignatureVerify": { "type": "boolean", "description": "Grant permission to use the KMIP Signature Verify operation.\n" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`kmip`\" pulumi-lang-dotnet=\"`Kmip`\" pulumi-lang-go=\"`kmip`\" pulumi-lang-python=\"`kmip`\" pulumi-lang-yaml=\"`kmip`\" pulumi-lang-java=\"`kmip`\" pulumi-lang-hcl=\"`kmip`\"\u003e`kmip`\u003c/span\u003e.\n" }, "role": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "scope": { "type": "string", "description": "Name of the scope.\n", "willReplaceOnChanges": true }, "tlsClientKeyBits": { "type": "integer", "description": "Client certificate key bits, valid values depend on key type.\n" }, "tlsClientKeyType": { "type": "string", "description": "Client certificate key type, \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "tlsClientTtl": { "type": "integer", "description": "Client certificate TTL in seconds.\n" } }, "type": "object" } }, "vault:kmip/secretScope:SecretScope": { "description": "Manages KMIP Secret Scopes in a Vault server. This feature requires\nVault Enterprise. See the [Vault documentation](https://www.vaultproject.io/docs/secrets/kmip)\nfor more information.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst _default = new vault.kmip.SecretBackend(\"default\", {\n path: \"kmip\",\n description: \"Vault KMIP backend\",\n});\nconst dev = new vault.kmip.SecretScope(\"dev\", {\n path: _default.path,\n scope: \"dev\",\n force: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ndefault = vault.kmip.SecretBackend(\"default\",\n path=\"kmip\",\n description=\"Vault KMIP backend\")\ndev = vault.kmip.SecretScope(\"dev\",\n path=default.path,\n scope=\"dev\",\n force=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var @default = new Vault.Kmip.SecretBackend(\"default\", new()\n {\n Path = \"kmip\",\n Description = \"Vault KMIP backend\",\n });\n\n var dev = new Vault.Kmip.SecretScope(\"dev\", new()\n {\n Path = @default.Path,\n Scope = \"dev\",\n Force = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kmip\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_default, err := kmip.NewSecretBackend(ctx, \"default\", \u0026kmip.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kmip\"),\n\t\t\tDescription: pulumi.String(\"Vault KMIP backend\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kmip.NewSecretScope(ctx, \"dev\", \u0026kmip.SecretScopeArgs{\n\t\t\tPath: _default.Path,\n\t\t\tScope: pulumi.String(\"dev\"),\n\t\t\tForce: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kmip_secretbackend\" \"default\" {\n path = \"kmip\"\n description = \"Vault KMIP backend\"\n}\nresource \"vault_kmip_secretscope\" \"dev\" {\n path = vault_kmip_secretbackend.default.path\n scope = \"dev\"\n force = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kmip.SecretBackend;\nimport com.pulumi.vault.kmip.SecretBackendArgs;\nimport com.pulumi.vault.kmip.SecretScope;\nimport com.pulumi.vault.kmip.SecretScopeArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var default_ = new SecretBackend(\"default\", SecretBackendArgs.builder()\n .path(\"kmip\")\n .description(\"Vault KMIP backend\")\n .build());\n\n var dev = new SecretScope(\"dev\", SecretScopeArgs.builder()\n .path(default_.path())\n .scope(\"dev\")\n .force(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n default:\n type: vault:kmip:SecretBackend\n properties:\n path: kmip\n description: Vault KMIP backend\n dev:\n type: vault:kmip:SecretScope\n properties:\n path: ${default.path}\n scope: dev\n force: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKMIP Secret scope can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:kmip/secretScope:SecretScope dev kmip\n```\n\n", "properties": { "force": { "type": "boolean", "description": "Boolean field to force deletion even if there are managed objects in the scope.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`kmip`\" pulumi-lang-dotnet=\"`Kmip`\" pulumi-lang-go=\"`kmip`\" pulumi-lang-python=\"`kmip`\" pulumi-lang-yaml=\"`kmip`\" pulumi-lang-java=\"`kmip`\" pulumi-lang-hcl=\"`kmip`\"\u003e`kmip`\u003c/span\u003e.\n" }, "scope": { "type": "string", "description": "Name of the scope.\n" } }, "required": [ "path", "scope" ], "inputProperties": { "force": { "type": "boolean", "description": "Boolean field to force deletion even if there are managed objects in the scope.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`kmip`\" pulumi-lang-dotnet=\"`Kmip`\" pulumi-lang-go=\"`kmip`\" pulumi-lang-python=\"`kmip`\" pulumi-lang-yaml=\"`kmip`\" pulumi-lang-java=\"`kmip`\" pulumi-lang-hcl=\"`kmip`\"\u003e`kmip`\u003c/span\u003e.\n" }, "scope": { "type": "string", "description": "Name of the scope.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "path", "scope" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretScope resources.\n", "properties": { "force": { "type": "boolean", "description": "Boolean field to force deletion even if there are managed objects in the scope.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`kmip`\" pulumi-lang-dotnet=\"`Kmip`\" pulumi-lang-go=\"`kmip`\" pulumi-lang-python=\"`kmip`\" pulumi-lang-yaml=\"`kmip`\" pulumi-lang-java=\"`kmip`\" pulumi-lang-hcl=\"`kmip`\"\u003e`kmip`\u003c/span\u003e.\n" }, "scope": { "type": "string", "description": "Name of the scope.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:kubernetes/authBackendConfig:AuthBackendConfig": { "description": "Manages an Kubernetes auth backend config in a Vault server. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/kubernetes.html) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kubernetes = new vault.AuthBackend(\"kubernetes\", {type: \"kubernetes\"});\nconst example = new vault.kubernetes.AuthBackendConfig(\"example\", {\n backend: kubernetes.path,\n kubernetesHost: \"http://example.com:443\",\n kubernetesCaCert: `-----BEGIN CERTIFICATE-----\nexample\n-----END CERTIFICATE-----`,\n tokenReviewerJwt: \"ZXhhbXBsZQo=\",\n issuer: \"api\",\n disableIssValidation: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkubernetes = vault.AuthBackend(\"kubernetes\", type=\"kubernetes\")\nexample = vault.kubernetes.AuthBackendConfig(\"example\",\n backend=kubernetes.path,\n kubernetes_host=\"http://example.com:443\",\n kubernetes_ca_cert=\"\"\"-----BEGIN CERTIFICATE-----\nexample\n-----END CERTIFICATE-----\"\"\",\n token_reviewer_jwt=\"ZXhhbXBsZQo=\",\n issuer=\"api\",\n disable_iss_validation=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kubernetes = new Vault.AuthBackend(\"kubernetes\", new()\n {\n Type = \"kubernetes\",\n });\n\n var example = new Vault.Kubernetes.AuthBackendConfig(\"example\", new()\n {\n Backend = kubernetes.Path,\n KubernetesHost = \"http://example.com:443\",\n KubernetesCaCert = @\"-----BEGIN CERTIFICATE-----\nexample\n-----END CERTIFICATE-----\",\n TokenReviewerJwt = \"ZXhhbXBsZQo=\",\n Issuer = \"api\",\n DisableIssValidation = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kubernetes\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkubernetes2, err := vault.NewAuthBackend(ctx, \"kubernetes\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kubernetes\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kubernetes.NewAuthBackendConfig(ctx, \"example\", \u0026kubernetes.AuthBackendConfigArgs{\n\t\t\tBackend: kubernetes2.Path,\n\t\t\tKubernetesHost: pulumi.String(\"http://example.com:443\"),\n\t\t\tKubernetesCaCert: pulumi.String(\"-----BEGIN CERTIFICATE-----\\nexample\\n-----END CERTIFICATE-----\"),\n\t\t\tTokenReviewerJwt: pulumi.String(\"ZXhhbXBsZQo=\"),\n\t\t\tIssuer: pulumi.String(\"api\"),\n\t\t\tDisableIssValidation: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kubernetes\" {\n type = \"kubernetes\"\n}\nresource \"vault_kubernetes_authbackendconfig\" \"example\" {\n backend = vault_authbackend.kubernetes.path\n kubernetes_host = \"http://example.com:443\"\n kubernetes_ca_cert = \"-----BEGIN CERTIFICATE-----\\nexample\\n-----END CERTIFICATE-----\"\n token_reviewer_jwt = \"ZXhhbXBsZQo=\"\n issuer = \"api\"\n disable_iss_validation = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.kubernetes.AuthBackendConfig;\nimport com.pulumi.vault.kubernetes.AuthBackendConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kubernetes = new AuthBackend(\"kubernetes\", AuthBackendArgs.builder()\n .type(\"kubernetes\")\n .build());\n\n var example = new AuthBackendConfig(\"example\", AuthBackendConfigArgs.builder()\n .backend(kubernetes.path())\n .kubernetesHost(\"http://example.com:443\")\n .kubernetesCaCert(\"\"\"\n-----BEGIN CERTIFICATE-----\nexample\n-----END CERTIFICATE----- \"\"\")\n .tokenReviewerJwt(\"ZXhhbXBsZQo=\")\n .issuer(\"api\")\n .disableIssValidation(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kubernetes:\n type: vault:AuthBackend\n properties:\n type: kubernetes\n example:\n type: vault:kubernetes:AuthBackendConfig\n properties:\n backend: ${kubernetes.path}\n kubernetesHost: http://example.com:443\n kubernetesCaCert: |-\n -----BEGIN CERTIFICATE-----\n example\n -----END CERTIFICATE-----\n tokenReviewerJwt: ZXhhbXBsZQo=\n issuer: api\n disableIssValidation: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Example Usage with Write-Only JWT\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kubernetes = new vault.AuthBackend(\"kubernetes\", {type: \"kubernetes\"});\nconst example = new vault.kubernetes.AuthBackendConfig(\"example\", {\n backend: kubernetes.path,\n kubernetesHost: \"http://example.com:443\",\n kubernetesCaCert: `-----BEGIN CERTIFICATE-----\nexample\n-----END CERTIFICATE-----`,\n tokenReviewerJwtWo: k8sTokenReviewerJwt,\n tokenReviewerJwtWoVersion: 1,\n issuer: \"api\",\n disableIssValidation: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkubernetes = vault.AuthBackend(\"kubernetes\", type=\"kubernetes\")\nexample = vault.kubernetes.AuthBackendConfig(\"example\",\n backend=kubernetes.path,\n kubernetes_host=\"http://example.com:443\",\n kubernetes_ca_cert=\"\"\"-----BEGIN CERTIFICATE-----\nexample\n-----END CERTIFICATE-----\"\"\",\n token_reviewer_jwt_wo=k8s_token_reviewer_jwt,\n token_reviewer_jwt_wo_version=1,\n issuer=\"api\",\n disable_iss_validation=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kubernetes = new Vault.AuthBackend(\"kubernetes\", new()\n {\n Type = \"kubernetes\",\n });\n\n var example = new Vault.Kubernetes.AuthBackendConfig(\"example\", new()\n {\n Backend = kubernetes.Path,\n KubernetesHost = \"http://example.com:443\",\n KubernetesCaCert = @\"-----BEGIN CERTIFICATE-----\nexample\n-----END CERTIFICATE-----\",\n TokenReviewerJwtWo = k8sTokenReviewerJwt,\n TokenReviewerJwtWoVersion = 1,\n Issuer = \"api\",\n DisableIssValidation = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kubernetes\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkubernetes2, err := vault.NewAuthBackend(ctx, \"kubernetes\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kubernetes\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kubernetes.NewAuthBackendConfig(ctx, \"example\", \u0026kubernetes.AuthBackendConfigArgs{\n\t\t\tBackend: kubernetes2.Path,\n\t\t\tKubernetesHost: pulumi.String(\"http://example.com:443\"),\n\t\t\tKubernetesCaCert: pulumi.String(\"-----BEGIN CERTIFICATE-----\\nexample\\n-----END CERTIFICATE-----\"),\n\t\t\tTokenReviewerJwtWo: pulumi.Any(k8sTokenReviewerJwt),\n\t\t\tTokenReviewerJwtWoVersion: pulumi.Int(1),\n\t\t\tIssuer: pulumi.String(\"api\"),\n\t\t\tDisableIssValidation: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kubernetes\" {\n type = \"kubernetes\"\n}\nresource \"vault_kubernetes_authbackendconfig\" \"example\" {\n backend = vault_authbackend.kubernetes.path\n kubernetes_host = \"http://example.com:443\"\n kubernetes_ca_cert = \"-----BEGIN CERTIFICATE-----\\nexample\\n-----END CERTIFICATE-----\"\n token_reviewer_jwt_wo = k8sTokenReviewerJwt\n token_reviewer_jwt_wo_version = 1\n issuer = \"api\"\n disable_iss_validation = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.kubernetes.AuthBackendConfig;\nimport com.pulumi.vault.kubernetes.AuthBackendConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kubernetes = new AuthBackend(\"kubernetes\", AuthBackendArgs.builder()\n .type(\"kubernetes\")\n .build());\n\n var example = new AuthBackendConfig(\"example\", AuthBackendConfigArgs.builder()\n .backend(kubernetes.path())\n .kubernetesHost(\"http://example.com:443\")\n .kubernetesCaCert(\"\"\"\n-----BEGIN CERTIFICATE-----\nexample\n-----END CERTIFICATE----- \"\"\")\n .tokenReviewerJwtWo(k8sTokenReviewerJwt)\n .tokenReviewerJwtWoVersion(1)\n .issuer(\"api\")\n .disableIssValidation(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kubernetes:\n type: vault:AuthBackend\n properties:\n type: kubernetes\n example:\n type: vault:kubernetes:AuthBackendConfig\n properties:\n backend: ${kubernetes.path}\n kubernetesHost: http://example.com:443\n kubernetesCaCert: |-\n -----BEGIN CERTIFICATE-----\n example\n -----END CERTIFICATE-----\n tokenReviewerJwtWo: ${k8sTokenReviewerJwt}\n tokenReviewerJwtWoVersion: 1\n issuer: api\n disableIssValidation: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e - (Optional) A write-only service account JWT (or other token) used as a bearer token to access the \n TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. \n Conflicts with \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwt`\" pulumi-lang-dotnet=\"`TokenReviewerJwt`\" pulumi-lang-go=\"`tokenReviewerJwt`\" pulumi-lang-python=\"`token_reviewer_jwt`\" pulumi-lang-yaml=\"`tokenReviewerJwt`\" pulumi-lang-java=\"`tokenReviewerJwt`\" pulumi-lang-hcl=\"`token_reviewer_jwt`\"\u003e`tokenReviewerJwt`\u003c/span\u003e.\n **Note**: This property is write-only and will not be read from the API.\n\n## Import\n\nKubernetes authentication backend can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:kubernetes/authBackendConfig:AuthBackendConfig config auth/kubernetes/config\n```\n\n", "properties": { "backend": { "type": "string", "description": "Unique name of the kubernetes backend to configure." }, "disableIssValidation": { "type": "boolean", "description": "Disable JWT issuer validation. Allows to skip ISS validation. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`\n" }, "disableLocalCaJwt": { "type": "boolean", "description": "Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`\n" }, "issuer": { "type": "string", "description": "JWT issuer. If no issuer is specified, `kubernetes.io/serviceaccount` will be used as the default issuer.\n" }, "kubernetesCaCert": { "type": "string", "description": "PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.\n" }, "kubernetesHost": { "type": "string", "description": "Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n" }, "pemKeys": { "type": "array", "items": { "type": "string" }, "description": "List of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.\n" }, "tokenReviewerJwt": { "type": "string", "description": "A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. Conflicts with \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e.\n", "secret": true }, "tokenReviewerJwtWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nA write-only service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API.", "secret": true }, "tokenReviewerJwtWoVersion": { "type": "integer", "description": "The version of \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e to use during write operations. Required with \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" }, "useAnnotationsAsAliasMetadata": { "type": "boolean", "description": "Use annotations from the client token's associated service account as alias metadata for the Vault entity. Requires Vault `v1.16+` or Vault auth kubernetes plugin `v0.18.0+`\n" } }, "required": [ "disableIssValidation", "disableLocalCaJwt", "kubernetesCaCert", "kubernetesHost", "useAnnotationsAsAliasMetadata" ], "inputProperties": { "backend": { "type": "string", "description": "Unique name of the kubernetes backend to configure.", "willReplaceOnChanges": true }, "disableIssValidation": { "type": "boolean", "description": "Disable JWT issuer validation. Allows to skip ISS validation. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`\n" }, "disableLocalCaJwt": { "type": "boolean", "description": "Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`\n" }, "issuer": { "type": "string", "description": "JWT issuer. If no issuer is specified, `kubernetes.io/serviceaccount` will be used as the default issuer.\n" }, "kubernetesCaCert": { "type": "string", "description": "PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.\n" }, "kubernetesHost": { "type": "string", "description": "Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "pemKeys": { "type": "array", "items": { "type": "string" }, "description": "List of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.\n" }, "tokenReviewerJwt": { "type": "string", "description": "A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. Conflicts with \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e.\n", "secret": true }, "tokenReviewerJwtWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nA write-only service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API.", "secret": true }, "tokenReviewerJwtWoVersion": { "type": "integer", "description": "The version of \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e to use during write operations. Required with \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" }, "useAnnotationsAsAliasMetadata": { "type": "boolean", "description": "Use annotations from the client token's associated service account as alias metadata for the Vault entity. Requires Vault `v1.16+` or Vault auth kubernetes plugin `v0.18.0+`\n" } }, "requiredInputs": [ "kubernetesHost" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendConfig resources.\n", "properties": { "backend": { "type": "string", "description": "Unique name of the kubernetes backend to configure.", "willReplaceOnChanges": true }, "disableIssValidation": { "type": "boolean", "description": "Disable JWT issuer validation. Allows to skip ISS validation. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`\n" }, "disableLocalCaJwt": { "type": "boolean", "description": "Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`\n" }, "issuer": { "type": "string", "description": "JWT issuer. If no issuer is specified, `kubernetes.io/serviceaccount` will be used as the default issuer.\n" }, "kubernetesCaCert": { "type": "string", "description": "PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.\n" }, "kubernetesHost": { "type": "string", "description": "Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "pemKeys": { "type": "array", "items": { "type": "string" }, "description": "List of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.\n" }, "tokenReviewerJwt": { "type": "string", "description": "A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. Conflicts with \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e.\n", "secret": true }, "tokenReviewerJwtWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nA write-only service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API.", "secret": true }, "tokenReviewerJwtWoVersion": { "type": "integer", "description": "The version of \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e to use during write operations. Required with \u003cspan pulumi-lang-nodejs=\"`tokenReviewerJwtWo`\" pulumi-lang-dotnet=\"`TokenReviewerJwtWo`\" pulumi-lang-go=\"`tokenReviewerJwtWo`\" pulumi-lang-python=\"`token_reviewer_jwt_wo`\" pulumi-lang-yaml=\"`tokenReviewerJwtWo`\" pulumi-lang-java=\"`tokenReviewerJwtWo`\" pulumi-lang-hcl=\"`token_reviewer_jwt_wo`\"\u003e`tokenReviewerJwtWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" }, "useAnnotationsAsAliasMetadata": { "type": "boolean", "description": "Use annotations from the client token's associated service account as alias metadata for the Vault entity. Requires Vault `v1.16+` or Vault auth kubernetes plugin `v0.18.0+`\n" } }, "type": "object" } }, "vault:kubernetes/authBackendRole:AuthBackendRole": { "description": "Manages an Kubernetes auth backend role in a Vault server. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/kubernetes.html) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kubernetes = new vault.AuthBackend(\"kubernetes\", {type: \"kubernetes\"});\nconst example = new vault.kubernetes.AuthBackendRole(\"example\", {\n backend: kubernetes.path,\n roleName: \"example-role\",\n boundServiceAccountNames: [\"example\"],\n boundServiceAccountNamespaces: [\"example\"],\n tokenTtl: 3600,\n tokenPolicies: [\n \"default\",\n \"dev\",\n \"prod\",\n ],\n audience: \"vault\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkubernetes = vault.AuthBackend(\"kubernetes\", type=\"kubernetes\")\nexample = vault.kubernetes.AuthBackendRole(\"example\",\n backend=kubernetes.path,\n role_name=\"example-role\",\n bound_service_account_names=[\"example\"],\n bound_service_account_namespaces=[\"example\"],\n token_ttl=3600,\n token_policies=[\n \"default\",\n \"dev\",\n \"prod\",\n ],\n audience=\"vault\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kubernetes = new Vault.AuthBackend(\"kubernetes\", new()\n {\n Type = \"kubernetes\",\n });\n\n var example = new Vault.Kubernetes.AuthBackendRole(\"example\", new()\n {\n Backend = kubernetes.Path,\n RoleName = \"example-role\",\n BoundServiceAccountNames = new[]\n {\n \"example\",\n },\n BoundServiceAccountNamespaces = new[]\n {\n \"example\",\n },\n TokenTtl = 3600,\n TokenPolicies = new[]\n {\n \"default\",\n \"dev\",\n \"prod\",\n },\n Audience = \"vault\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kubernetes\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkubernetes2, err := vault.NewAuthBackend(ctx, \"kubernetes\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"kubernetes\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kubernetes.NewAuthBackendRole(ctx, \"example\", \u0026kubernetes.AuthBackendRoleArgs{\n\t\t\tBackend: kubernetes2.Path,\n\t\t\tRoleName: pulumi.String(\"example-role\"),\n\t\t\tBoundServiceAccountNames: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"example\"),\n\t\t\t},\n\t\t\tBoundServiceAccountNamespaces: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"example\"),\n\t\t\t},\n\t\t\tTokenTtl: pulumi.Int(3600),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev\"),\n\t\t\t\tpulumi.String(\"prod\"),\n\t\t\t},\n\t\t\tAudience: pulumi.String(\"vault\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"kubernetes\" {\n type = \"kubernetes\"\n}\nresource \"vault_kubernetes_authbackendrole\" \"example\" {\n backend = vault_authbackend.kubernetes.path\n role_name = \"example-role\"\n bound_service_account_names = [\"example\"]\n bound_service_account_namespaces = [\"example\"]\n token_ttl = 3600\n token_policies = [\"default\", \"dev\", \"prod\"]\n audience = \"vault\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.kubernetes.AuthBackendRole;\nimport com.pulumi.vault.kubernetes.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kubernetes = new AuthBackend(\"kubernetes\", AuthBackendArgs.builder()\n .type(\"kubernetes\")\n .build());\n\n var example = new AuthBackendRole(\"example\", AuthBackendRoleArgs.builder()\n .backend(kubernetes.path())\n .roleName(\"example-role\")\n .boundServiceAccountNames(\"example\")\n .boundServiceAccountNamespaces(\"example\")\n .tokenTtl(3600)\n .tokenPolicies( \n \"default\",\n \"dev\",\n \"prod\")\n .audience(\"vault\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kubernetes:\n type: vault:AuthBackend\n properties:\n type: kubernetes\n example:\n type: vault:kubernetes:AuthBackendRole\n properties:\n backend: ${kubernetes.path}\n roleName: example-role\n boundServiceAccountNames:\n - example\n boundServiceAccountNamespaces:\n - example\n tokenTtl: 3600\n tokenPolicies:\n - default\n - dev\n - prod\n audience: vault\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nKubernetes auth backend role can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:kubernetes/authBackendRole:AuthBackendRole foo auth/kubernetes/role/foo\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "aliasNameSource": { "type": "string", "description": "Configures how identity aliases are generated.\nValid choices are: \u003cspan pulumi-lang-nodejs=\"`serviceaccountUid`\" pulumi-lang-dotnet=\"`ServiceaccountUid`\" pulumi-lang-go=\"`serviceaccountUid`\" pulumi-lang-python=\"`serviceaccount_uid`\" pulumi-lang-yaml=\"`serviceaccountUid`\" pulumi-lang-java=\"`serviceaccountUid`\" pulumi-lang-hcl=\"`serviceaccount_uid`\"\u003e`serviceaccountUid`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceaccountName`\" pulumi-lang-dotnet=\"`ServiceaccountName`\" pulumi-lang-go=\"`serviceaccountName`\" pulumi-lang-python=\"`serviceaccount_name`\" pulumi-lang-yaml=\"`serviceaccountName`\" pulumi-lang-java=\"`serviceaccountName`\" pulumi-lang-hcl=\"`serviceaccount_name`\"\u003e`serviceaccountName`\u003c/span\u003e. (vault-1.9+)\n" }, "audience": { "type": "string", "description": "Audience claim to verify in the JWT.\n\n\u003e Please see \u003cspan pulumi-lang-nodejs=\"[aliasNameSource]\" pulumi-lang-dotnet=\"[AliasNameSource]\" pulumi-lang-go=\"[aliasNameSource]\" pulumi-lang-python=\"[alias_name_source]\" pulumi-lang-yaml=\"[aliasNameSource]\" pulumi-lang-java=\"[aliasNameSource]\" pulumi-lang-hcl=\"[alias_name_source]\"\u003e[aliasNameSource]\u003c/span\u003e(https://www.vaultproject.io/api-docs/auth/kubernetes#alias_name_source)\nbefore setting this to something other its default value. There are **important** security\nimplications to be aware of.\n" }, "backend": { "type": "string", "description": "Unique name of the kubernetes backend to configure.\n" }, "boundServiceAccountNames": { "type": "array", "items": { "type": "string" }, "description": "List of service account names able to access this role. If set to `[\"*\"]` all names are allowed, both this and\u003cspan pulumi-lang-nodejs=\" boundServiceAccountNamespaces \" pulumi-lang-dotnet=\" BoundServiceAccountNamespaces \" pulumi-lang-go=\" boundServiceAccountNamespaces \" pulumi-lang-python=\" bound_service_account_namespaces \" pulumi-lang-yaml=\" boundServiceAccountNamespaces \" pulumi-lang-java=\" boundServiceAccountNamespaces \" pulumi-lang-hcl=\" bound_service_account_namespaces \"\u003e boundServiceAccountNamespaces \u003c/span\u003ecan not be \"*\".\n" }, "boundServiceAccountNamespaceSelector": { "type": "string", "description": "A label selector for Kubernetes namespaces allowed to access this role. Accepts either a JSON or YAML object. The value should be of type LabelSelector. Currently, label selectors with matchExpressions are not supported. To use label selectors, Vault must have permission to read namespaces on the Kubernetes cluster. If set with bound_service_account_namespaces, the conditions are ORed. Requires Vault v1.16+.\n" }, "boundServiceAccountNamespaces": { "type": "array", "items": { "type": "string" }, "description": "List of namespaces allowed to access this role. If set to `[\"*\"]` all namespaces are allowed, both this and\u003cspan pulumi-lang-nodejs=\" boundServiceAccountNames \" pulumi-lang-dotnet=\" BoundServiceAccountNames \" pulumi-lang-go=\" boundServiceAccountNames \" pulumi-lang-python=\" bound_service_account_names \" pulumi-lang-yaml=\" boundServiceAccountNames \" pulumi-lang-java=\" boundServiceAccountNames \" pulumi-lang-hcl=\" bound_service_account_names \"\u003e boundServiceAccountNames \u003c/span\u003ecan not be set to \"*\".\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "roleName": { "type": "string", "description": "Name of the role.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "aliasNameSource", "boundServiceAccountNames", "roleName" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "aliasNameSource": { "type": "string", "description": "Configures how identity aliases are generated.\nValid choices are: \u003cspan pulumi-lang-nodejs=\"`serviceaccountUid`\" pulumi-lang-dotnet=\"`ServiceaccountUid`\" pulumi-lang-go=\"`serviceaccountUid`\" pulumi-lang-python=\"`serviceaccount_uid`\" pulumi-lang-yaml=\"`serviceaccountUid`\" pulumi-lang-java=\"`serviceaccountUid`\" pulumi-lang-hcl=\"`serviceaccount_uid`\"\u003e`serviceaccountUid`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceaccountName`\" pulumi-lang-dotnet=\"`ServiceaccountName`\" pulumi-lang-go=\"`serviceaccountName`\" pulumi-lang-python=\"`serviceaccount_name`\" pulumi-lang-yaml=\"`serviceaccountName`\" pulumi-lang-java=\"`serviceaccountName`\" pulumi-lang-hcl=\"`serviceaccount_name`\"\u003e`serviceaccountName`\u003c/span\u003e. (vault-1.9+)\n" }, "audience": { "type": "string", "description": "Audience claim to verify in the JWT.\n\n\u003e Please see \u003cspan pulumi-lang-nodejs=\"[aliasNameSource]\" pulumi-lang-dotnet=\"[AliasNameSource]\" pulumi-lang-go=\"[aliasNameSource]\" pulumi-lang-python=\"[alias_name_source]\" pulumi-lang-yaml=\"[aliasNameSource]\" pulumi-lang-java=\"[aliasNameSource]\" pulumi-lang-hcl=\"[alias_name_source]\"\u003e[aliasNameSource]\u003c/span\u003e(https://www.vaultproject.io/api-docs/auth/kubernetes#alias_name_source)\nbefore setting this to something other its default value. There are **important** security\nimplications to be aware of.\n" }, "backend": { "type": "string", "description": "Unique name of the kubernetes backend to configure.\n", "willReplaceOnChanges": true }, "boundServiceAccountNames": { "type": "array", "items": { "type": "string" }, "description": "List of service account names able to access this role. If set to `[\"*\"]` all names are allowed, both this and\u003cspan pulumi-lang-nodejs=\" boundServiceAccountNamespaces \" pulumi-lang-dotnet=\" BoundServiceAccountNamespaces \" pulumi-lang-go=\" boundServiceAccountNamespaces \" pulumi-lang-python=\" bound_service_account_namespaces \" pulumi-lang-yaml=\" boundServiceAccountNamespaces \" pulumi-lang-java=\" boundServiceAccountNamespaces \" pulumi-lang-hcl=\" bound_service_account_namespaces \"\u003e boundServiceAccountNamespaces \u003c/span\u003ecan not be \"*\".\n" }, "boundServiceAccountNamespaceSelector": { "type": "string", "description": "A label selector for Kubernetes namespaces allowed to access this role. Accepts either a JSON or YAML object. The value should be of type LabelSelector. Currently, label selectors with matchExpressions are not supported. To use label selectors, Vault must have permission to read namespaces on the Kubernetes cluster. If set with bound_service_account_namespaces, the conditions are ORed. Requires Vault v1.16+.\n" }, "boundServiceAccountNamespaces": { "type": "array", "items": { "type": "string" }, "description": "List of namespaces allowed to access this role. If set to `[\"*\"]` all namespaces are allowed, both this and\u003cspan pulumi-lang-nodejs=\" boundServiceAccountNames \" pulumi-lang-dotnet=\" BoundServiceAccountNames \" pulumi-lang-go=\" boundServiceAccountNames \" pulumi-lang-python=\" bound_service_account_names \" pulumi-lang-yaml=\" boundServiceAccountNames \" pulumi-lang-java=\" boundServiceAccountNames \" pulumi-lang-hcl=\" bound_service_account_names \"\u003e boundServiceAccountNames \u003c/span\u003ecan not be set to \"*\".\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "roleName": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "requiredInputs": [ "boundServiceAccountNames", "roleName" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "aliasNameSource": { "type": "string", "description": "Configures how identity aliases are generated.\nValid choices are: \u003cspan pulumi-lang-nodejs=\"`serviceaccountUid`\" pulumi-lang-dotnet=\"`ServiceaccountUid`\" pulumi-lang-go=\"`serviceaccountUid`\" pulumi-lang-python=\"`serviceaccount_uid`\" pulumi-lang-yaml=\"`serviceaccountUid`\" pulumi-lang-java=\"`serviceaccountUid`\" pulumi-lang-hcl=\"`serviceaccount_uid`\"\u003e`serviceaccountUid`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`serviceaccountName`\" pulumi-lang-dotnet=\"`ServiceaccountName`\" pulumi-lang-go=\"`serviceaccountName`\" pulumi-lang-python=\"`serviceaccount_name`\" pulumi-lang-yaml=\"`serviceaccountName`\" pulumi-lang-java=\"`serviceaccountName`\" pulumi-lang-hcl=\"`serviceaccount_name`\"\u003e`serviceaccountName`\u003c/span\u003e. (vault-1.9+)\n" }, "audience": { "type": "string", "description": "Audience claim to verify in the JWT.\n\n\u003e Please see \u003cspan pulumi-lang-nodejs=\"[aliasNameSource]\" pulumi-lang-dotnet=\"[AliasNameSource]\" pulumi-lang-go=\"[aliasNameSource]\" pulumi-lang-python=\"[alias_name_source]\" pulumi-lang-yaml=\"[aliasNameSource]\" pulumi-lang-java=\"[aliasNameSource]\" pulumi-lang-hcl=\"[alias_name_source]\"\u003e[aliasNameSource]\u003c/span\u003e(https://www.vaultproject.io/api-docs/auth/kubernetes#alias_name_source)\nbefore setting this to something other its default value. There are **important** security\nimplications to be aware of.\n" }, "backend": { "type": "string", "description": "Unique name of the kubernetes backend to configure.\n", "willReplaceOnChanges": true }, "boundServiceAccountNames": { "type": "array", "items": { "type": "string" }, "description": "List of service account names able to access this role. If set to `[\"*\"]` all names are allowed, both this and\u003cspan pulumi-lang-nodejs=\" boundServiceAccountNamespaces \" pulumi-lang-dotnet=\" BoundServiceAccountNamespaces \" pulumi-lang-go=\" boundServiceAccountNamespaces \" pulumi-lang-python=\" bound_service_account_namespaces \" pulumi-lang-yaml=\" boundServiceAccountNamespaces \" pulumi-lang-java=\" boundServiceAccountNamespaces \" pulumi-lang-hcl=\" bound_service_account_namespaces \"\u003e boundServiceAccountNamespaces \u003c/span\u003ecan not be \"*\".\n" }, "boundServiceAccountNamespaceSelector": { "type": "string", "description": "A label selector for Kubernetes namespaces allowed to access this role. Accepts either a JSON or YAML object. The value should be of type LabelSelector. Currently, label selectors with matchExpressions are not supported. To use label selectors, Vault must have permission to read namespaces on the Kubernetes cluster. If set with bound_service_account_namespaces, the conditions are ORed. Requires Vault v1.16+.\n" }, "boundServiceAccountNamespaces": { "type": "array", "items": { "type": "string" }, "description": "List of namespaces allowed to access this role. If set to `[\"*\"]` all namespaces are allowed, both this and\u003cspan pulumi-lang-nodejs=\" boundServiceAccountNames \" pulumi-lang-dotnet=\" BoundServiceAccountNames \" pulumi-lang-go=\" boundServiceAccountNames \" pulumi-lang-python=\" bound_service_account_names \" pulumi-lang-yaml=\" boundServiceAccountNames \" pulumi-lang-java=\" boundServiceAccountNames \" pulumi-lang-hcl=\" bound_service_account_names \"\u003e boundServiceAccountNames \u003c/span\u003ecan not be set to \"*\".\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "roleName": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:kubernetes/secretBackend:SecretBackend": { "description": "Creates a Kubernetes Secrets Backend for Vault.\n\nThe Kubernetes Secrets Engine for Vault generates Kubernetes service account tokens, and \noptionally service accounts, role bindings, and roles.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n\u003e **Note** Use the write-only arguments (for example \u003cspan pulumi-lang-nodejs=\"`serviceAccountJwtWo`\" pulumi-lang-dotnet=\"`ServiceAccountJwtWo`\" pulumi-lang-go=\"`serviceAccountJwtWo`\" pulumi-lang-python=\"`service_account_jwt_wo`\" pulumi-lang-yaml=\"`serviceAccountJwtWo`\" pulumi-lang-java=\"`serviceAccountJwtWo`\" pulumi-lang-hcl=\"`service_account_jwt_wo`\"\u003e`serviceAccountJwtWo`\u003c/span\u003e) to avoid storing sensitive values in Terraform state.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.kubernetes.SecretBackend(\"config\", {\n path: \"kubernetes\",\n description: \"kubernetes secrets engine description\",\n defaultLeaseTtlSeconds: 43200,\n maxLeaseTtlSeconds: 86400,\n kubernetesHost: \"https://127.0.0.1:61233\",\n kubernetesCaCert: std.file({\n input: \"/path/to/cert\",\n }).then(invoke =\u003e invoke.result),\n serviceAccountJwtWo: std.file({\n input: \"/path/to/token\",\n }).then(invoke =\u003e invoke.result),\n serviceAccountJwtWoVersion: 1,\n disableLocalCaJwt: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nconfig = vault.kubernetes.SecretBackend(\"config\",\n path=\"kubernetes\",\n description=\"kubernetes secrets engine description\",\n default_lease_ttl_seconds=43200,\n max_lease_ttl_seconds=86400,\n kubernetes_host=\"https://127.0.0.1:61233\",\n kubernetes_ca_cert=std.file(input=\"/path/to/cert\").result,\n service_account_jwt_wo=std.file(input=\"/path/to/token\").result,\n service_account_jwt_wo_version=1,\n disable_local_ca_jwt=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Kubernetes.SecretBackend(\"config\", new()\n {\n Path = \"kubernetes\",\n Description = \"kubernetes secrets engine description\",\n DefaultLeaseTtlSeconds = 43200,\n MaxLeaseTtlSeconds = 86400,\n KubernetesHost = \"https://127.0.0.1:61233\",\n KubernetesCaCert = Std.File.Invoke(new()\n {\n Input = \"/path/to/cert\",\n }).Apply(invoke =\u003e invoke.Result),\n ServiceAccountJwtWo = Std.File.Invoke(new()\n {\n Input = \"/path/to/token\",\n }).Apply(invoke =\u003e invoke.Result),\n ServiceAccountJwtWoVersion = 1,\n DisableLocalCaJwt = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kubernetes\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/cert\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile1, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/token\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kubernetes.NewSecretBackend(ctx, \"config\", \u0026kubernetes.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kubernetes\"),\n\t\t\tDescription: pulumi.String(\"kubernetes secrets engine description\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(43200),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t\tKubernetesHost: pulumi.String(\"https://127.0.0.1:61233\"),\n\t\t\tKubernetesCaCert: pulumi.String(invokeFile.Result),\n\t\t\tServiceAccountJwtWo: pulumi.String(invokeFile1.Result),\n\t\t\tServiceAccountJwtWoVersion: pulumi.Int(1),\n\t\t\tDisableLocalCaJwt: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kubernetes_secretbackend\" \"config\" {\n path = \"kubernetes\"\n description = \"kubernetes secrets engine description\"\n default_lease_ttl_seconds = 43200\n max_lease_ttl_seconds = 86400\n kubernetes_host = \"https://127.0.0.1:61233\"\n kubernetes_ca_cert = file(\"/path/to/cert\")\n service_account_jwt_wo = file(\"/path/to/token\")\n service_account_jwt_wo_version = 1\n disable_local_ca_jwt = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kubernetes.SecretBackend;\nimport com.pulumi.vault.kubernetes.SecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .path(\"kubernetes\")\n .description(\"kubernetes secrets engine description\")\n .defaultLeaseTtlSeconds(43200)\n .maxLeaseTtlSeconds(86400)\n .kubernetesHost(\"https://127.0.0.1:61233\")\n .kubernetesCaCert(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/cert\")\n .build()).result())\n .serviceAccountJwtWo(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/token\")\n .build()).result())\n .serviceAccountJwtWoVersion(1)\n .disableLocalCaJwt(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:kubernetes:SecretBackend\n properties:\n path: kubernetes\n description: kubernetes secrets engine description\n defaultLeaseTtlSeconds: 43200\n maxLeaseTtlSeconds: 86400\n kubernetesHost: https://127.0.0.1:61233\n kubernetesCaCert:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/cert\n return: result\n serviceAccountJwtWo:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/token\n return: result\n serviceAccountJwtWoVersion: 1\n disableLocalCaJwt: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`serviceAccountJwtWo`\" pulumi-lang-dotnet=\"`ServiceAccountJwtWo`\" pulumi-lang-go=\"`serviceAccountJwtWo`\" pulumi-lang-python=\"`service_account_jwt_wo`\" pulumi-lang-yaml=\"`serviceAccountJwtWo`\" pulumi-lang-java=\"`serviceAccountJwtWo`\" pulumi-lang-hcl=\"`service_account_jwt_wo`\"\u003e`serviceAccountJwtWo`\u003c/span\u003e - (Optional) Write-only JSON web token of the service account used by the secrets engine to manage Kubernetes credentials. This value is not stored in state.\n **Note**: This property is write-only and will not be read from the API.\n\n## Import\n\nThe Kubernetes secret backend can be imported using its \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e e.g.\n\n```sh\n$ pulumi import vault:kubernetes/secretBackend:SecretBackend config kubernetes\n```\n\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount" }, "disableLocalCaJwt": { "type": "boolean", "description": "Disable defaulting to the local CA certificate and \nservice account JWT when Vault is running in a Kubernetes pod.\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "kubernetesCaCert": { "type": "string", "description": "A PEM-encoded CA certificate used by the \nsecrets engine to verify the Kubernetes API server certificate. Defaults to the local\npod’s CA if Vault is running in Kubernetes. Otherwise, defaults to the root CA set where\nVault is running.\n" }, "kubernetesHost": { "type": "string", "description": "The Kubernetes API URL to connect to. Required if the \nstandard pod environment variables `KUBERNETES_SERVICE_HOST` or `KUBERNETES_SERVICE_PORT`\nare not set on the host that Vault is running on.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "Where the secret backend will be mounted" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "serviceAccountJwt": { "type": "string", "description": "The JSON web token of the service account used by the\nsecrets engine to manage Kubernetes credentials. Defaults to the local pod’s JWT if Vault\nis running in Kubernetes.\n", "secret": true }, "serviceAccountJwtWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only JSON web token of the service account used by the secrets engine to manage Kubernetes credentials. This value will not be stored in state.", "secret": true }, "serviceAccountJwtWoVersion": { "type": "integer", "description": "Version counter for \u003cspan pulumi-lang-nodejs=\"`serviceAccountJwtWo`\" pulumi-lang-dotnet=\"`ServiceAccountJwtWo`\" pulumi-lang-go=\"`serviceAccountJwtWo`\" pulumi-lang-python=\"`service_account_jwt_wo`\" pulumi-lang-yaml=\"`serviceAccountJwtWo`\" pulumi-lang-java=\"`serviceAccountJwtWo`\" pulumi-lang-hcl=\"`service_account_jwt_wo`\"\u003e`serviceAccountJwtWo`\u003c/span\u003e. Increment to force an update.\nFor more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "defaultLeaseTtlSeconds", "forceNoCache", "maxLeaseTtlSeconds", "path", "sealWrap" ], "inputProperties": { "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount" }, "disableLocalCaJwt": { "type": "boolean", "description": "Disable defaulting to the local CA certificate and \nservice account JWT when Vault is running in a Kubernetes pod.\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "kubernetesCaCert": { "type": "string", "description": "A PEM-encoded CA certificate used by the \nsecrets engine to verify the Kubernetes API server certificate. Defaults to the local\npod’s CA if Vault is running in Kubernetes. Otherwise, defaults to the root CA set where\nVault is running.\n" }, "kubernetesHost": { "type": "string", "description": "The Kubernetes API URL to connect to. Required if the \nstandard pod environment variables `KUBERNETES_SERVICE_HOST` or `KUBERNETES_SERVICE_PORT`\nare not set on the host that Vault is running on.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "Where the secret backend will be mounted" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "serviceAccountJwt": { "type": "string", "description": "The JSON web token of the service account used by the\nsecrets engine to manage Kubernetes credentials. Defaults to the local pod’s JWT if Vault\nis running in Kubernetes.\n", "secret": true }, "serviceAccountJwtWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only JSON web token of the service account used by the secrets engine to manage Kubernetes credentials. This value will not be stored in state.", "secret": true }, "serviceAccountJwtWoVersion": { "type": "integer", "description": "Version counter for \u003cspan pulumi-lang-nodejs=\"`serviceAccountJwtWo`\" pulumi-lang-dotnet=\"`ServiceAccountJwtWo`\" pulumi-lang-go=\"`serviceAccountJwtWo`\" pulumi-lang-python=\"`service_account_jwt_wo`\" pulumi-lang-yaml=\"`serviceAccountJwtWo`\" pulumi-lang-java=\"`serviceAccountJwtWo`\" pulumi-lang-hcl=\"`service_account_jwt_wo`\"\u003e`serviceAccountJwtWo`\u003c/span\u003e. Increment to force an update.\nFor more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" } }, "requiredInputs": [ "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount" }, "disableLocalCaJwt": { "type": "boolean", "description": "Disable defaulting to the local CA certificate and \nservice account JWT when Vault is running in a Kubernetes pod.\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "kubernetesCaCert": { "type": "string", "description": "A PEM-encoded CA certificate used by the \nsecrets engine to verify the Kubernetes API server certificate. Defaults to the local\npod’s CA if Vault is running in Kubernetes. Otherwise, defaults to the root CA set where\nVault is running.\n" }, "kubernetesHost": { "type": "string", "description": "The Kubernetes API URL to connect to. Required if the \nstandard pod environment variables `KUBERNETES_SERVICE_HOST` or `KUBERNETES_SERVICE_PORT`\nare not set on the host that Vault is running on.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "path": { "type": "string", "description": "Where the secret backend will be mounted" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "serviceAccountJwt": { "type": "string", "description": "The JSON web token of the service account used by the\nsecrets engine to manage Kubernetes credentials. Defaults to the local pod’s JWT if Vault\nis running in Kubernetes.\n", "secret": true }, "serviceAccountJwtWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only JSON web token of the service account used by the secrets engine to manage Kubernetes credentials. This value will not be stored in state.", "secret": true }, "serviceAccountJwtWoVersion": { "type": "integer", "description": "Version counter for \u003cspan pulumi-lang-nodejs=\"`serviceAccountJwtWo`\" pulumi-lang-dotnet=\"`ServiceAccountJwtWo`\" pulumi-lang-go=\"`serviceAccountJwtWo`\" pulumi-lang-python=\"`service_account_jwt_wo`\" pulumi-lang-yaml=\"`serviceAccountJwtWo`\" pulumi-lang-java=\"`serviceAccountJwtWo`\" pulumi-lang-hcl=\"`service_account_jwt_wo`\"\u003e`serviceAccountJwtWo`\u003c/span\u003e. Increment to force an update.\nFor more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" } }, "type": "object" } }, "vault:kubernetes/secretBackendRole:SecretBackendRole": { "description": "Creates a role for the Kubernetes Secrets Engine in Vault.\n\nA role configures what service account tokens can be generated, and what permissions will \nbe attached to them. The permissions attached to a service account token depend on the \nKubernetes roles applied to its service account.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\nExample using \u003cspan pulumi-lang-nodejs=\"`serviceAccountName`\" pulumi-lang-dotnet=\"`ServiceAccountName`\" pulumi-lang-go=\"`serviceAccountName`\" pulumi-lang-python=\"`service_account_name`\" pulumi-lang-yaml=\"`serviceAccountName`\" pulumi-lang-java=\"`serviceAccountName`\" pulumi-lang-hcl=\"`service_account_name`\"\u003e`serviceAccountName`\u003c/span\u003e mode:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.kubernetes.SecretBackend(\"config\", {\n path: \"kubernetes\",\n description: \"kubernetes secrets engine description\",\n kubernetesHost: \"https://127.0.0.1:61233\",\n kubernetesCaCert: std.file({\n input: \"/path/to/cert\",\n }).then(invoke =\u003e invoke.result),\n serviceAccountJwt: std.file({\n input: \"/path/to/token\",\n }).then(invoke =\u003e invoke.result),\n disableLocalCaJwt: false,\n});\nconst sa_example = new vault.kubernetes.SecretBackendRole(\"sa-example\", {\n backend: config.path,\n name: \"service-account-name-role\",\n allowedKubernetesNamespaces: [\"*\"],\n tokenMaxTtl: 43200,\n tokenDefaultTtl: 21600,\n tokenDefaultAudiences: [\"https://kubernetes.default.svc\"],\n serviceAccountName: \"test-service-account-with-generated-token\",\n extraLabels: {\n id: \"abc123\",\n name: \"some_name\",\n },\n extraAnnotations: {\n env: \"development\",\n location: \"earth\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nconfig = vault.kubernetes.SecretBackend(\"config\",\n path=\"kubernetes\",\n description=\"kubernetes secrets engine description\",\n kubernetes_host=\"https://127.0.0.1:61233\",\n kubernetes_ca_cert=std.file(input=\"/path/to/cert\").result,\n service_account_jwt=std.file(input=\"/path/to/token\").result,\n disable_local_ca_jwt=False)\nsa_example = vault.kubernetes.SecretBackendRole(\"sa-example\",\n backend=config.path,\n name=\"service-account-name-role\",\n allowed_kubernetes_namespaces=[\"*\"],\n token_max_ttl=43200,\n token_default_ttl=21600,\n token_default_audiences=[\"https://kubernetes.default.svc\"],\n service_account_name=\"test-service-account-with-generated-token\",\n extra_labels={\n \"id\": \"abc123\",\n \"name\": \"some_name\",\n },\n extra_annotations={\n \"env\": \"development\",\n \"location\": \"earth\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Kubernetes.SecretBackend(\"config\", new()\n {\n Path = \"kubernetes\",\n Description = \"kubernetes secrets engine description\",\n KubernetesHost = \"https://127.0.0.1:61233\",\n KubernetesCaCert = Std.File.Invoke(new()\n {\n Input = \"/path/to/cert\",\n }).Apply(invoke =\u003e invoke.Result),\n ServiceAccountJwt = Std.File.Invoke(new()\n {\n Input = \"/path/to/token\",\n }).Apply(invoke =\u003e invoke.Result),\n DisableLocalCaJwt = false,\n });\n\n var sa_example = new Vault.Kubernetes.SecretBackendRole(\"sa-example\", new()\n {\n Backend = config.Path,\n Name = \"service-account-name-role\",\n AllowedKubernetesNamespaces = new[]\n {\n \"*\",\n },\n TokenMaxTtl = 43200,\n TokenDefaultTtl = 21600,\n TokenDefaultAudiences = new[]\n {\n \"https://kubernetes.default.svc\",\n },\n ServiceAccountName = \"test-service-account-with-generated-token\",\n ExtraLabels = \n {\n { \"id\", \"abc123\" },\n { \"name\", \"some_name\" },\n },\n ExtraAnnotations = \n {\n { \"env\", \"development\" },\n { \"location\", \"earth\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kubernetes\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/cert\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile1, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/token\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tconfig, err := kubernetes.NewSecretBackend(ctx, \"config\", \u0026kubernetes.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kubernetes\"),\n\t\t\tDescription: pulumi.String(\"kubernetes secrets engine description\"),\n\t\t\tKubernetesHost: pulumi.String(\"https://127.0.0.1:61233\"),\n\t\t\tKubernetesCaCert: pulumi.String(invokeFile.Result),\n\t\t\tServiceAccountJwt: pulumi.String(invokeFile1.Result),\n\t\t\tDisableLocalCaJwt: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kubernetes.NewSecretBackendRole(ctx, \"sa-example\", \u0026kubernetes.SecretBackendRoleArgs{\n\t\t\tBackend: config.Path,\n\t\t\tName: pulumi.String(\"service-account-name-role\"),\n\t\t\tAllowedKubernetesNamespaces: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*\"),\n\t\t\t},\n\t\t\tTokenMaxTtl: pulumi.Int(43200),\n\t\t\tTokenDefaultTtl: pulumi.Int(21600),\n\t\t\tTokenDefaultAudiences: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://kubernetes.default.svc\"),\n\t\t\t},\n\t\t\tServiceAccountName: pulumi.String(\"test-service-account-with-generated-token\"),\n\t\t\tExtraLabels: pulumi.StringMap{\n\t\t\t\t\"id\": pulumi.String(\"abc123\"),\n\t\t\t\t\"name\": pulumi.String(\"some_name\"),\n\t\t\t},\n\t\t\tExtraAnnotations: pulumi.StringMap{\n\t\t\t\t\"env\": pulumi.String(\"development\"),\n\t\t\t\t\"location\": pulumi.String(\"earth\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kubernetes_secretbackend\" \"config\" {\n path = \"kubernetes\"\n description = \"kubernetes secrets engine description\"\n kubernetes_host = \"https://127.0.0.1:61233\"\n kubernetes_ca_cert = file(\"/path/to/cert\")\n service_account_jwt = file(\"/path/to/token\")\n disable_local_ca_jwt = false\n}\nresource \"vault_kubernetes_secretbackendrole\" \"sa-example\" {\n backend = vault_kubernetes_secretbackend.config.path\n name = \"service-account-name-role\"\n allowed_kubernetes_namespaces = [\"*\"]\n token_max_ttl = 43200\n token_default_ttl = 21600\n token_default_audiences = [\"https://kubernetes.default.svc\"]\n service_account_name = \"test-service-account-with-generated-token\"\n extra_labels = {\n \"id\" = \"abc123\"\n \"name\" = \"some_name\"\n }\n extra_annotations = {\n \"env\" = \"development\"\n \"location\" = \"earth\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kubernetes.SecretBackend;\nimport com.pulumi.vault.kubernetes.SecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.vault.kubernetes.SecretBackendRole;\nimport com.pulumi.vault.kubernetes.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .path(\"kubernetes\")\n .description(\"kubernetes secrets engine description\")\n .kubernetesHost(\"https://127.0.0.1:61233\")\n .kubernetesCaCert(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/cert\")\n .build()).result())\n .serviceAccountJwt(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/token\")\n .build()).result())\n .disableLocalCaJwt(false)\n .build());\n\n var sa_example = new SecretBackendRole(\"sa-example\", SecretBackendRoleArgs.builder()\n .backend(config.path())\n .name(\"service-account-name-role\")\n .allowedKubernetesNamespaces(\"*\")\n .tokenMaxTtl(43200)\n .tokenDefaultTtl(21600)\n .tokenDefaultAudiences(\"https://kubernetes.default.svc\")\n .serviceAccountName(\"test-service-account-with-generated-token\")\n .extraLabels(Map.ofEntries(\n Map.entry(\"id\", \"abc123\"),\n Map.entry(\"name\", \"some_name\")\n ))\n .extraAnnotations(Map.ofEntries(\n Map.entry(\"env\", \"development\"),\n Map.entry(\"location\", \"earth\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:kubernetes:SecretBackend\n properties:\n path: kubernetes\n description: kubernetes secrets engine description\n kubernetesHost: https://127.0.0.1:61233\n kubernetesCaCert:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/cert\n return: result\n serviceAccountJwt:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/token\n return: result\n disableLocalCaJwt: false\n sa-example:\n type: vault:kubernetes:SecretBackendRole\n properties:\n backend: ${config.path}\n name: service-account-name-role\n allowedKubernetesNamespaces:\n - '*'\n tokenMaxTtl: 43200\n tokenDefaultTtl: 21600\n tokenDefaultAudiences:\n - https://kubernetes.default.svc\n serviceAccountName: test-service-account-with-generated-token\n extraLabels:\n id: abc123\n name: some_name\n extraAnnotations:\n env: development\n location: earth\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nExample using \u003cspan pulumi-lang-nodejs=\"`kubernetesRoleName`\" pulumi-lang-dotnet=\"`KubernetesRoleName`\" pulumi-lang-go=\"`kubernetesRoleName`\" pulumi-lang-python=\"`kubernetes_role_name`\" pulumi-lang-yaml=\"`kubernetesRoleName`\" pulumi-lang-java=\"`kubernetesRoleName`\" pulumi-lang-hcl=\"`kubernetes_role_name`\"\u003e`kubernetesRoleName`\u003c/span\u003e mode:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.kubernetes.SecretBackend(\"config\", {\n path: \"kubernetes\",\n description: \"kubernetes secrets engine description\",\n kubernetesHost: \"https://127.0.0.1:61233\",\n kubernetesCaCert: std.file({\n input: \"/path/to/cert\",\n }).then(invoke =\u003e invoke.result),\n serviceAccountJwt: std.file({\n input: \"/path/to/token\",\n }).then(invoke =\u003e invoke.result),\n disableLocalCaJwt: false,\n});\nconst name_example = new vault.kubernetes.SecretBackendRole(\"name-example\", {\n backend: config.path,\n name: \"service-account-name-role\",\n allowedKubernetesNamespaces: [\"*\"],\n tokenMaxTtl: 43200,\n tokenDefaultTtl: 21600,\n kubernetesRoleName: \"vault-k8s-secrets-role\",\n extraLabels: {\n id: \"abc123\",\n name: \"some_name\",\n },\n extraAnnotations: {\n env: \"development\",\n location: \"earth\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nconfig = vault.kubernetes.SecretBackend(\"config\",\n path=\"kubernetes\",\n description=\"kubernetes secrets engine description\",\n kubernetes_host=\"https://127.0.0.1:61233\",\n kubernetes_ca_cert=std.file(input=\"/path/to/cert\").result,\n service_account_jwt=std.file(input=\"/path/to/token\").result,\n disable_local_ca_jwt=False)\nname_example = vault.kubernetes.SecretBackendRole(\"name-example\",\n backend=config.path,\n name=\"service-account-name-role\",\n allowed_kubernetes_namespaces=[\"*\"],\n token_max_ttl=43200,\n token_default_ttl=21600,\n kubernetes_role_name=\"vault-k8s-secrets-role\",\n extra_labels={\n \"id\": \"abc123\",\n \"name\": \"some_name\",\n },\n extra_annotations={\n \"env\": \"development\",\n \"location\": \"earth\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Kubernetes.SecretBackend(\"config\", new()\n {\n Path = \"kubernetes\",\n Description = \"kubernetes secrets engine description\",\n KubernetesHost = \"https://127.0.0.1:61233\",\n KubernetesCaCert = Std.File.Invoke(new()\n {\n Input = \"/path/to/cert\",\n }).Apply(invoke =\u003e invoke.Result),\n ServiceAccountJwt = Std.File.Invoke(new()\n {\n Input = \"/path/to/token\",\n }).Apply(invoke =\u003e invoke.Result),\n DisableLocalCaJwt = false,\n });\n\n var name_example = new Vault.Kubernetes.SecretBackendRole(\"name-example\", new()\n {\n Backend = config.Path,\n Name = \"service-account-name-role\",\n AllowedKubernetesNamespaces = new[]\n {\n \"*\",\n },\n TokenMaxTtl = 43200,\n TokenDefaultTtl = 21600,\n KubernetesRoleName = \"vault-k8s-secrets-role\",\n ExtraLabels = \n {\n { \"id\", \"abc123\" },\n { \"name\", \"some_name\" },\n },\n ExtraAnnotations = \n {\n { \"env\", \"development\" },\n { \"location\", \"earth\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kubernetes\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/cert\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile1, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/token\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tconfig, err := kubernetes.NewSecretBackend(ctx, \"config\", \u0026kubernetes.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kubernetes\"),\n\t\t\tDescription: pulumi.String(\"kubernetes secrets engine description\"),\n\t\t\tKubernetesHost: pulumi.String(\"https://127.0.0.1:61233\"),\n\t\t\tKubernetesCaCert: pulumi.String(invokeFile.Result),\n\t\t\tServiceAccountJwt: pulumi.String(invokeFile1.Result),\n\t\t\tDisableLocalCaJwt: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kubernetes.NewSecretBackendRole(ctx, \"name-example\", \u0026kubernetes.SecretBackendRoleArgs{\n\t\t\tBackend: config.Path,\n\t\t\tName: pulumi.String(\"service-account-name-role\"),\n\t\t\tAllowedKubernetesNamespaces: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*\"),\n\t\t\t},\n\t\t\tTokenMaxTtl: pulumi.Int(43200),\n\t\t\tTokenDefaultTtl: pulumi.Int(21600),\n\t\t\tKubernetesRoleName: pulumi.String(\"vault-k8s-secrets-role\"),\n\t\t\tExtraLabels: pulumi.StringMap{\n\t\t\t\t\"id\": pulumi.String(\"abc123\"),\n\t\t\t\t\"name\": pulumi.String(\"some_name\"),\n\t\t\t},\n\t\t\tExtraAnnotations: pulumi.StringMap{\n\t\t\t\t\"env\": pulumi.String(\"development\"),\n\t\t\t\t\"location\": pulumi.String(\"earth\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kubernetes_secretbackend\" \"config\" {\n path = \"kubernetes\"\n description = \"kubernetes secrets engine description\"\n kubernetes_host = \"https://127.0.0.1:61233\"\n kubernetes_ca_cert = file(\"/path/to/cert\")\n service_account_jwt = file(\"/path/to/token\")\n disable_local_ca_jwt = false\n}\nresource \"vault_kubernetes_secretbackendrole\" \"name-example\" {\n backend = vault_kubernetes_secretbackend.config.path\n name = \"service-account-name-role\"\n allowed_kubernetes_namespaces = [\"*\"]\n token_max_ttl = 43200\n token_default_ttl = 21600\n kubernetes_role_name = \"vault-k8s-secrets-role\"\n extra_labels = {\n \"id\" = \"abc123\"\n \"name\" = \"some_name\"\n }\n extra_annotations = {\n \"env\" = \"development\"\n \"location\" = \"earth\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kubernetes.SecretBackend;\nimport com.pulumi.vault.kubernetes.SecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.vault.kubernetes.SecretBackendRole;\nimport com.pulumi.vault.kubernetes.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .path(\"kubernetes\")\n .description(\"kubernetes secrets engine description\")\n .kubernetesHost(\"https://127.0.0.1:61233\")\n .kubernetesCaCert(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/cert\")\n .build()).result())\n .serviceAccountJwt(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/token\")\n .build()).result())\n .disableLocalCaJwt(false)\n .build());\n\n var name_example = new SecretBackendRole(\"name-example\", SecretBackendRoleArgs.builder()\n .backend(config.path())\n .name(\"service-account-name-role\")\n .allowedKubernetesNamespaces(\"*\")\n .tokenMaxTtl(43200)\n .tokenDefaultTtl(21600)\n .kubernetesRoleName(\"vault-k8s-secrets-role\")\n .extraLabels(Map.ofEntries(\n Map.entry(\"id\", \"abc123\"),\n Map.entry(\"name\", \"some_name\")\n ))\n .extraAnnotations(Map.ofEntries(\n Map.entry(\"env\", \"development\"),\n Map.entry(\"location\", \"earth\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:kubernetes:SecretBackend\n properties:\n path: kubernetes\n description: kubernetes secrets engine description\n kubernetesHost: https://127.0.0.1:61233\n kubernetesCaCert:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/cert\n return: result\n serviceAccountJwt:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/token\n return: result\n disableLocalCaJwt: false\n name-example:\n type: vault:kubernetes:SecretBackendRole\n properties:\n backend: ${config.path}\n name: service-account-name-role\n allowedKubernetesNamespaces:\n - '*'\n tokenMaxTtl: 43200\n tokenDefaultTtl: 21600\n kubernetesRoleName: vault-k8s-secrets-role\n extraLabels:\n id: abc123\n name: some_name\n extraAnnotations:\n env: development\n location: earth\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nExample using \u003cspan pulumi-lang-nodejs=\"`generatedRoleRules`\" pulumi-lang-dotnet=\"`GeneratedRoleRules`\" pulumi-lang-go=\"`generatedRoleRules`\" pulumi-lang-python=\"`generated_role_rules`\" pulumi-lang-yaml=\"`generatedRoleRules`\" pulumi-lang-java=\"`generatedRoleRules`\" pulumi-lang-hcl=\"`generated_role_rules`\"\u003e`generatedRoleRules`\u003c/span\u003e mode:\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.kubernetes.SecretBackend(\"config\", {\n path: \"kubernetes\",\n description: \"kubernetes secrets engine description\",\n kubernetesHost: \"https://127.0.0.1:61233\",\n kubernetesCaCert: std.file({\n input: \"/path/to/cert\",\n }).then(invoke =\u003e invoke.result),\n serviceAccountJwt: std.file({\n input: \"/path/to/token\",\n }).then(invoke =\u003e invoke.result),\n disableLocalCaJwt: false,\n});\nconst rules_example = new vault.kubernetes.SecretBackendRole(\"rules-example\", {\n backend: config.path,\n name: \"service-account-name-role\",\n allowedKubernetesNamespaces: [\"*\"],\n tokenMaxTtl: 43200,\n tokenDefaultTtl: 21600,\n kubernetesRoleType: \"Role\",\n generatedRoleRules: `rules:\n- apiGroups: [\\\\\"\\\\\"]\n resources: [\\\\\"pods\\\\\"]\n verbs: [\\\\\"list\\\\\"]\n`,\n extraLabels: {\n id: \"abc123\",\n name: \"some_name\",\n },\n extraAnnotations: {\n env: \"development\",\n location: \"earth\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\nconfig = vault.kubernetes.SecretBackend(\"config\",\n path=\"kubernetes\",\n description=\"kubernetes secrets engine description\",\n kubernetes_host=\"https://127.0.0.1:61233\",\n kubernetes_ca_cert=std.file(input=\"/path/to/cert\").result,\n service_account_jwt=std.file(input=\"/path/to/token\").result,\n disable_local_ca_jwt=False)\nrules_example = vault.kubernetes.SecretBackendRole(\"rules-example\",\n backend=config.path,\n name=\"service-account-name-role\",\n allowed_kubernetes_namespaces=[\"*\"],\n token_max_ttl=43200,\n token_default_ttl=21600,\n kubernetes_role_type=\"Role\",\n generated_role_rules=\"\"\"rules:\n- apiGroups: [\\\"\\\"]\n resources: [\\\"pods\\\"]\n verbs: [\\\"list\\\"]\n\"\"\",\n extra_labels={\n \"id\": \"abc123\",\n \"name\": \"some_name\",\n },\n extra_annotations={\n \"env\": \"development\",\n \"location\": \"earth\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Kubernetes.SecretBackend(\"config\", new()\n {\n Path = \"kubernetes\",\n Description = \"kubernetes secrets engine description\",\n KubernetesHost = \"https://127.0.0.1:61233\",\n KubernetesCaCert = Std.File.Invoke(new()\n {\n Input = \"/path/to/cert\",\n }).Apply(invoke =\u003e invoke.Result),\n ServiceAccountJwt = Std.File.Invoke(new()\n {\n Input = \"/path/to/token\",\n }).Apply(invoke =\u003e invoke.Result),\n DisableLocalCaJwt = false,\n });\n\n var rules_example = new Vault.Kubernetes.SecretBackendRole(\"rules-example\", new()\n {\n Backend = config.Path,\n Name = \"service-account-name-role\",\n AllowedKubernetesNamespaces = new[]\n {\n \"*\",\n },\n TokenMaxTtl = 43200,\n TokenDefaultTtl = 21600,\n KubernetesRoleType = \"Role\",\n GeneratedRoleRules = @\"rules:\n- apiGroups: [\\\"\"\\\"\"]\n resources: [\\\"\"pods\\\"\"]\n verbs: [\\\"\"list\\\"\"]\n\",\n ExtraLabels = \n {\n { \"id\", \"abc123\" },\n { \"name\", \"some_name\" },\n },\n ExtraAnnotations = \n {\n { \"env\", \"development\" },\n { \"location\", \"earth\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kubernetes\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/cert\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFile1, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"/path/to/token\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tconfig, err := kubernetes.NewSecretBackend(ctx, \"config\", \u0026kubernetes.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"kubernetes\"),\n\t\t\tDescription: pulumi.String(\"kubernetes secrets engine description\"),\n\t\t\tKubernetesHost: pulumi.String(\"https://127.0.0.1:61233\"),\n\t\t\tKubernetesCaCert: pulumi.String(invokeFile.Result),\n\t\t\tServiceAccountJwt: pulumi.String(invokeFile1.Result),\n\t\t\tDisableLocalCaJwt: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kubernetes.NewSecretBackendRole(ctx, \"rules-example\", \u0026kubernetes.SecretBackendRoleArgs{\n\t\t\tBackend: config.Path,\n\t\t\tName: pulumi.String(\"service-account-name-role\"),\n\t\t\tAllowedKubernetesNamespaces: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*\"),\n\t\t\t},\n\t\t\tTokenMaxTtl: pulumi.Int(43200),\n\t\t\tTokenDefaultTtl: pulumi.Int(21600),\n\t\t\tKubernetesRoleType: pulumi.String(\"Role\"),\n\t\t\tGeneratedRoleRules: pulumi.String(\"rules:\\n- apiGroups: [\\\\\\\"\\\\\\\"]\\n resources: [\\\\\\\"pods\\\\\\\"]\\n verbs: [\\\\\\\"list\\\\\\\"]\\n\"),\n\t\t\tExtraLabels: pulumi.StringMap{\n\t\t\t\t\"id\": pulumi.String(\"abc123\"),\n\t\t\t\t\"name\": pulumi.String(\"some_name\"),\n\t\t\t},\n\t\t\tExtraAnnotations: pulumi.StringMap{\n\t\t\t\t\"env\": pulumi.String(\"development\"),\n\t\t\t\t\"location\": pulumi.String(\"earth\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_kubernetes_secretbackend\" \"config\" {\n path = \"kubernetes\"\n description = \"kubernetes secrets engine description\"\n kubernetes_host = \"https://127.0.0.1:61233\"\n kubernetes_ca_cert = file(\"/path/to/cert\")\n service_account_jwt = file(\"/path/to/token\")\n disable_local_ca_jwt = false\n}\nresource \"vault_kubernetes_secretbackendrole\" \"rules-example\" {\n backend = vault_kubernetes_secretbackend.config.path\n name = \"service-account-name-role\"\n allowed_kubernetes_namespaces = [\"*\"]\n token_max_ttl = 43200\n token_default_ttl = 21600\n kubernetes_role_type = \"Role\"\n generated_role_rules = \"rules:\\n- apiGroups: [\\\\\\\"\\\\\\\"]\\n resources: [\\\\\\\"pods\\\\\\\"]\\n verbs: [\\\\\\\"list\\\\\\\"]\\n\"\n extra_labels = {\n \"id\" = \"abc123\"\n \"name\" = \"some_name\"\n }\n extra_annotations = {\n \"env\" = \"development\"\n \"location\" = \"earth\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.kubernetes.SecretBackend;\nimport com.pulumi.vault.kubernetes.SecretBackendArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.vault.kubernetes.SecretBackendRole;\nimport com.pulumi.vault.kubernetes.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .path(\"kubernetes\")\n .description(\"kubernetes secrets engine description\")\n .kubernetesHost(\"https://127.0.0.1:61233\")\n .kubernetesCaCert(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/cert\")\n .build()).result())\n .serviceAccountJwt(StdFunctions.file(FileArgs.builder()\n .input(\"/path/to/token\")\n .build()).result())\n .disableLocalCaJwt(false)\n .build());\n\n var rules_example = new SecretBackendRole(\"rules-example\", SecretBackendRoleArgs.builder()\n .backend(config.path())\n .name(\"service-account-name-role\")\n .allowedKubernetesNamespaces(\"*\")\n .tokenMaxTtl(43200)\n .tokenDefaultTtl(21600)\n .kubernetesRoleType(\"Role\")\n .generatedRoleRules(\"\"\"\nrules:\n- apiGroups: [\\\"\\\"]\n resources: [\\\"pods\\\"]\n verbs: [\\\"list\\\"]\n \"\"\")\n .extraLabels(Map.ofEntries(\n Map.entry(\"id\", \"abc123\"),\n Map.entry(\"name\", \"some_name\")\n ))\n .extraAnnotations(Map.ofEntries(\n Map.entry(\"env\", \"development\"),\n Map.entry(\"location\", \"earth\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:kubernetes:SecretBackend\n properties:\n path: kubernetes\n description: kubernetes secrets engine description\n kubernetesHost: https://127.0.0.1:61233\n kubernetesCaCert:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/cert\n return: result\n serviceAccountJwt:\n fn::invoke:\n function: std:file\n arguments:\n input: /path/to/token\n return: result\n disableLocalCaJwt: false\n rules-example:\n type: vault:kubernetes:SecretBackendRole\n properties:\n backend: ${config.path}\n name: service-account-name-role\n allowedKubernetesNamespaces:\n - '*'\n tokenMaxTtl: 43200\n tokenDefaultTtl: 21600\n kubernetesRoleType: Role\n generatedRoleRules: |\n rules:\n - apiGroups: [\\\"\\\"]\n resources: [\\\"pods\\\"]\n verbs: [\\\"list\\\"]\n extraLabels:\n id: abc123\n name: some_name\n extraAnnotations:\n env: development\n location: earth\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe Kubernetes secret backend role can be imported using the full path to the role\nof the form: `\u003cbackend_path\u003e/roles/\u003crole_name\u003e` e.g.\n\n```sh\n$ terraform import vault_kubernetes_secret_backend_role.example kubernetes kubernetes/roles/example-role\n```\n\n", "properties": { "allowedKubernetesNamespaceSelector": { "type": "string", "description": "A label selector for Kubernetes namespaces \nin which credentials can be generated. Accepts either a JSON or YAML object. The value should be\nof type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).\nIf set with \u003cspan pulumi-lang-nodejs=\"`allowedKubernetesNamespace`\" pulumi-lang-dotnet=\"`AllowedKubernetesNamespace`\" pulumi-lang-go=\"`allowedKubernetesNamespace`\" pulumi-lang-python=\"`allowed_kubernetes_namespace`\" pulumi-lang-yaml=\"`allowedKubernetesNamespace`\" pulumi-lang-java=\"`allowedKubernetesNamespace`\" pulumi-lang-hcl=\"`allowed_kubernetes_namespace`\"\u003e`allowedKubernetesNamespace`\u003c/span\u003e, the conditions are `OR`ed.\n" }, "allowedKubernetesNamespaces": { "type": "array", "items": { "type": "string" }, "description": "The list of Kubernetes namespaces this role \ncan generate credentials for. If set to `*` all namespaces are allowed. If set with\n\u003cspan pulumi-lang-nodejs=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-dotnet=\"`AllowedKubernetesNamespaceSelector`\" pulumi-lang-go=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-python=\"`allowed_kubernetes_namespace_selector`\" pulumi-lang-yaml=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-java=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-hcl=\"`allowed_kubernetes_namespace_selector`\"\u003e`allowedKubernetesNamespaceSelector`\u003c/span\u003e, the conditions are `OR`ed.\n" }, "backend": { "type": "string", "description": "The path of the Kubernetes Secrets Engine backend mount to create\nthe role in.\n" }, "extraAnnotations": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Additional annotations to apply to all generated \nKubernetes objects.\n" }, "extraLabels": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Additional labels to apply to all generated Kubernetes \nobjects.\n\nThis resource also directly accepts all\u003cspan pulumi-lang-nodejs=\" vault.Mount \" pulumi-lang-dotnet=\" vault.Mount \" pulumi-lang-go=\" Mount \" pulumi-lang-python=\" Mount \" pulumi-lang-yaml=\" vault.Mount \" pulumi-lang-java=\" vault.Mount \" pulumi-lang-hcl=\" vault_mount \"\u003e vault.Mount \u003c/span\u003efields.\n" }, "generatedRoleRules": { "type": "string", "description": "The Role or ClusterRole rules to use when generating \na role. Accepts either JSON or YAML formatted rules. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`serviceAccountName`\" pulumi-lang-dotnet=\"`ServiceAccountName`\" pulumi-lang-go=\"`serviceAccountName`\" pulumi-lang-python=\"`service_account_name`\" pulumi-lang-yaml=\"`serviceAccountName`\" pulumi-lang-java=\"`serviceAccountName`\" pulumi-lang-hcl=\"`service_account_name`\"\u003e`serviceAccountName`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`kubernetesRoleName`\" pulumi-lang-dotnet=\"`KubernetesRoleName`\" pulumi-lang-go=\"`kubernetesRoleName`\" pulumi-lang-python=\"`kubernetes_role_name`\" pulumi-lang-yaml=\"`kubernetesRoleName`\" pulumi-lang-java=\"`kubernetesRoleName`\" pulumi-lang-hcl=\"`kubernetes_role_name`\"\u003e`kubernetesRoleName`\u003c/span\u003e. If set, the entire chain of Kubernetes objects will be generated\nwhen credentials are requested.\n" }, "kubernetesRoleName": { "type": "string", "description": "The pre-existing Role or ClusterRole to bind a \ngenerated service account to. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`serviceAccountName`\" pulumi-lang-dotnet=\"`ServiceAccountName`\" pulumi-lang-go=\"`serviceAccountName`\" pulumi-lang-python=\"`service_account_name`\" pulumi-lang-yaml=\"`serviceAccountName`\" pulumi-lang-java=\"`serviceAccountName`\" pulumi-lang-hcl=\"`service_account_name`\"\u003e`serviceAccountName`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`generatedRoleRules`\" pulumi-lang-dotnet=\"`GeneratedRoleRules`\" pulumi-lang-go=\"`generatedRoleRules`\" pulumi-lang-python=\"`generated_role_rules`\" pulumi-lang-yaml=\"`generatedRoleRules`\" pulumi-lang-java=\"`generatedRoleRules`\" pulumi-lang-hcl=\"`generated_role_rules`\"\u003e`generatedRoleRules`\u003c/span\u003e. If set, Kubernetes token, service account, and role\nbinding objects will be created when credentials are requested.\n" }, "kubernetesRoleType": { "type": "string", "description": "Specifies whether the Kubernetes role is a Role or \nClusterRole.\n" }, "name": { "type": "string", "description": "The name of the role.\n" }, "nameTemplate": { "type": "string", "description": "The name template to use when generating service accounts, \nroles and role bindings. If unset, a default template is used.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "serviceAccountName": { "type": "string", "description": "The pre-existing service account to generate tokens for.\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`kubernetesRoleName`\" pulumi-lang-dotnet=\"`KubernetesRoleName`\" pulumi-lang-go=\"`kubernetesRoleName`\" pulumi-lang-python=\"`kubernetes_role_name`\" pulumi-lang-yaml=\"`kubernetesRoleName`\" pulumi-lang-java=\"`kubernetesRoleName`\" pulumi-lang-hcl=\"`kubernetes_role_name`\"\u003e`kubernetesRoleName`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`generatedRoleRules`\" pulumi-lang-dotnet=\"`GeneratedRoleRules`\" pulumi-lang-go=\"`generatedRoleRules`\" pulumi-lang-python=\"`generated_role_rules`\" pulumi-lang-yaml=\"`generatedRoleRules`\" pulumi-lang-java=\"`generatedRoleRules`\" pulumi-lang-hcl=\"`generated_role_rules`\"\u003e`generatedRoleRules`\u003c/span\u003e. If set, only a\nKubernetes token will be created when credentials are requested.\n" }, "tokenDefaultAudiences": { "type": "array", "items": { "type": "string" }, "description": "The default audiences for generated Kubernetes tokens.\nIf not set, defaults to the Kubernetes cluster's default audiences. This field requires\nVault 1.15 or later.\n" }, "tokenDefaultTtl": { "type": "integer", "description": "The default TTL for generated Kubernetes tokens in seconds.\n" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum TTL for generated Kubernetes tokens in seconds.\n" } }, "required": [ "backend", "name" ], "inputProperties": { "allowedKubernetesNamespaceSelector": { "type": "string", "description": "A label selector for Kubernetes namespaces \nin which credentials can be generated. Accepts either a JSON or YAML object. The value should be\nof type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).\nIf set with \u003cspan pulumi-lang-nodejs=\"`allowedKubernetesNamespace`\" pulumi-lang-dotnet=\"`AllowedKubernetesNamespace`\" pulumi-lang-go=\"`allowedKubernetesNamespace`\" pulumi-lang-python=\"`allowed_kubernetes_namespace`\" pulumi-lang-yaml=\"`allowedKubernetesNamespace`\" pulumi-lang-java=\"`allowedKubernetesNamespace`\" pulumi-lang-hcl=\"`allowed_kubernetes_namespace`\"\u003e`allowedKubernetesNamespace`\u003c/span\u003e, the conditions are `OR`ed.\n" }, "allowedKubernetesNamespaces": { "type": "array", "items": { "type": "string" }, "description": "The list of Kubernetes namespaces this role \ncan generate credentials for. If set to `*` all namespaces are allowed. If set with\n\u003cspan pulumi-lang-nodejs=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-dotnet=\"`AllowedKubernetesNamespaceSelector`\" pulumi-lang-go=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-python=\"`allowed_kubernetes_namespace_selector`\" pulumi-lang-yaml=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-java=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-hcl=\"`allowed_kubernetes_namespace_selector`\"\u003e`allowedKubernetesNamespaceSelector`\u003c/span\u003e, the conditions are `OR`ed.\n" }, "backend": { "type": "string", "description": "The path of the Kubernetes Secrets Engine backend mount to create\nthe role in.\n", "willReplaceOnChanges": true }, "extraAnnotations": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Additional annotations to apply to all generated \nKubernetes objects.\n" }, "extraLabels": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Additional labels to apply to all generated Kubernetes \nobjects.\n\nThis resource also directly accepts all\u003cspan pulumi-lang-nodejs=\" vault.Mount \" pulumi-lang-dotnet=\" vault.Mount \" pulumi-lang-go=\" Mount \" pulumi-lang-python=\" Mount \" pulumi-lang-yaml=\" vault.Mount \" pulumi-lang-java=\" vault.Mount \" pulumi-lang-hcl=\" vault_mount \"\u003e vault.Mount \u003c/span\u003efields.\n" }, "generatedRoleRules": { "type": "string", "description": "The Role or ClusterRole rules to use when generating \na role. Accepts either JSON or YAML formatted rules. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`serviceAccountName`\" pulumi-lang-dotnet=\"`ServiceAccountName`\" pulumi-lang-go=\"`serviceAccountName`\" pulumi-lang-python=\"`service_account_name`\" pulumi-lang-yaml=\"`serviceAccountName`\" pulumi-lang-java=\"`serviceAccountName`\" pulumi-lang-hcl=\"`service_account_name`\"\u003e`serviceAccountName`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`kubernetesRoleName`\" pulumi-lang-dotnet=\"`KubernetesRoleName`\" pulumi-lang-go=\"`kubernetesRoleName`\" pulumi-lang-python=\"`kubernetes_role_name`\" pulumi-lang-yaml=\"`kubernetesRoleName`\" pulumi-lang-java=\"`kubernetesRoleName`\" pulumi-lang-hcl=\"`kubernetes_role_name`\"\u003e`kubernetesRoleName`\u003c/span\u003e. If set, the entire chain of Kubernetes objects will be generated\nwhen credentials are requested.\n" }, "kubernetesRoleName": { "type": "string", "description": "The pre-existing Role or ClusterRole to bind a \ngenerated service account to. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`serviceAccountName`\" pulumi-lang-dotnet=\"`ServiceAccountName`\" pulumi-lang-go=\"`serviceAccountName`\" pulumi-lang-python=\"`service_account_name`\" pulumi-lang-yaml=\"`serviceAccountName`\" pulumi-lang-java=\"`serviceAccountName`\" pulumi-lang-hcl=\"`service_account_name`\"\u003e`serviceAccountName`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`generatedRoleRules`\" pulumi-lang-dotnet=\"`GeneratedRoleRules`\" pulumi-lang-go=\"`generatedRoleRules`\" pulumi-lang-python=\"`generated_role_rules`\" pulumi-lang-yaml=\"`generatedRoleRules`\" pulumi-lang-java=\"`generatedRoleRules`\" pulumi-lang-hcl=\"`generated_role_rules`\"\u003e`generatedRoleRules`\u003c/span\u003e. If set, Kubernetes token, service account, and role\nbinding objects will be created when credentials are requested.\n" }, "kubernetesRoleType": { "type": "string", "description": "Specifies whether the Kubernetes role is a Role or \nClusterRole.\n" }, "name": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "nameTemplate": { "type": "string", "description": "The name template to use when generating service accounts, \nroles and role bindings. If unset, a default template is used.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "serviceAccountName": { "type": "string", "description": "The pre-existing service account to generate tokens for.\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`kubernetesRoleName`\" pulumi-lang-dotnet=\"`KubernetesRoleName`\" pulumi-lang-go=\"`kubernetesRoleName`\" pulumi-lang-python=\"`kubernetes_role_name`\" pulumi-lang-yaml=\"`kubernetesRoleName`\" pulumi-lang-java=\"`kubernetesRoleName`\" pulumi-lang-hcl=\"`kubernetes_role_name`\"\u003e`kubernetesRoleName`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`generatedRoleRules`\" pulumi-lang-dotnet=\"`GeneratedRoleRules`\" pulumi-lang-go=\"`generatedRoleRules`\" pulumi-lang-python=\"`generated_role_rules`\" pulumi-lang-yaml=\"`generatedRoleRules`\" pulumi-lang-java=\"`generatedRoleRules`\" pulumi-lang-hcl=\"`generated_role_rules`\"\u003e`generatedRoleRules`\u003c/span\u003e. If set, only a\nKubernetes token will be created when credentials are requested.\n" }, "tokenDefaultAudiences": { "type": "array", "items": { "type": "string" }, "description": "The default audiences for generated Kubernetes tokens.\nIf not set, defaults to the Kubernetes cluster's default audiences. This field requires\nVault 1.15 or later.\n" }, "tokenDefaultTtl": { "type": "integer", "description": "The default TTL for generated Kubernetes tokens in seconds.\n" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum TTL for generated Kubernetes tokens in seconds.\n" } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRole resources.\n", "properties": { "allowedKubernetesNamespaceSelector": { "type": "string", "description": "A label selector for Kubernetes namespaces \nin which credentials can be generated. Accepts either a JSON or YAML object. The value should be\nof type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).\nIf set with \u003cspan pulumi-lang-nodejs=\"`allowedKubernetesNamespace`\" pulumi-lang-dotnet=\"`AllowedKubernetesNamespace`\" pulumi-lang-go=\"`allowedKubernetesNamespace`\" pulumi-lang-python=\"`allowed_kubernetes_namespace`\" pulumi-lang-yaml=\"`allowedKubernetesNamespace`\" pulumi-lang-java=\"`allowedKubernetesNamespace`\" pulumi-lang-hcl=\"`allowed_kubernetes_namespace`\"\u003e`allowedKubernetesNamespace`\u003c/span\u003e, the conditions are `OR`ed.\n" }, "allowedKubernetesNamespaces": { "type": "array", "items": { "type": "string" }, "description": "The list of Kubernetes namespaces this role \ncan generate credentials for. If set to `*` all namespaces are allowed. If set with\n\u003cspan pulumi-lang-nodejs=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-dotnet=\"`AllowedKubernetesNamespaceSelector`\" pulumi-lang-go=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-python=\"`allowed_kubernetes_namespace_selector`\" pulumi-lang-yaml=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-java=\"`allowedKubernetesNamespaceSelector`\" pulumi-lang-hcl=\"`allowed_kubernetes_namespace_selector`\"\u003e`allowedKubernetesNamespaceSelector`\u003c/span\u003e, the conditions are `OR`ed.\n" }, "backend": { "type": "string", "description": "The path of the Kubernetes Secrets Engine backend mount to create\nthe role in.\n", "willReplaceOnChanges": true }, "extraAnnotations": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Additional annotations to apply to all generated \nKubernetes objects.\n" }, "extraLabels": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Additional labels to apply to all generated Kubernetes \nobjects.\n\nThis resource also directly accepts all\u003cspan pulumi-lang-nodejs=\" vault.Mount \" pulumi-lang-dotnet=\" vault.Mount \" pulumi-lang-go=\" Mount \" pulumi-lang-python=\" Mount \" pulumi-lang-yaml=\" vault.Mount \" pulumi-lang-java=\" vault.Mount \" pulumi-lang-hcl=\" vault_mount \"\u003e vault.Mount \u003c/span\u003efields.\n" }, "generatedRoleRules": { "type": "string", "description": "The Role or ClusterRole rules to use when generating \na role. Accepts either JSON or YAML formatted rules. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`serviceAccountName`\" pulumi-lang-dotnet=\"`ServiceAccountName`\" pulumi-lang-go=\"`serviceAccountName`\" pulumi-lang-python=\"`service_account_name`\" pulumi-lang-yaml=\"`serviceAccountName`\" pulumi-lang-java=\"`serviceAccountName`\" pulumi-lang-hcl=\"`service_account_name`\"\u003e`serviceAccountName`\u003c/span\u003e\nand \u003cspan pulumi-lang-nodejs=\"`kubernetesRoleName`\" pulumi-lang-dotnet=\"`KubernetesRoleName`\" pulumi-lang-go=\"`kubernetesRoleName`\" pulumi-lang-python=\"`kubernetes_role_name`\" pulumi-lang-yaml=\"`kubernetesRoleName`\" pulumi-lang-java=\"`kubernetesRoleName`\" pulumi-lang-hcl=\"`kubernetes_role_name`\"\u003e`kubernetesRoleName`\u003c/span\u003e. If set, the entire chain of Kubernetes objects will be generated\nwhen credentials are requested.\n" }, "kubernetesRoleName": { "type": "string", "description": "The pre-existing Role or ClusterRole to bind a \ngenerated service account to. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`serviceAccountName`\" pulumi-lang-dotnet=\"`ServiceAccountName`\" pulumi-lang-go=\"`serviceAccountName`\" pulumi-lang-python=\"`service_account_name`\" pulumi-lang-yaml=\"`serviceAccountName`\" pulumi-lang-java=\"`serviceAccountName`\" pulumi-lang-hcl=\"`service_account_name`\"\u003e`serviceAccountName`\u003c/span\u003e and\n\u003cspan pulumi-lang-nodejs=\"`generatedRoleRules`\" pulumi-lang-dotnet=\"`GeneratedRoleRules`\" pulumi-lang-go=\"`generatedRoleRules`\" pulumi-lang-python=\"`generated_role_rules`\" pulumi-lang-yaml=\"`generatedRoleRules`\" pulumi-lang-java=\"`generatedRoleRules`\" pulumi-lang-hcl=\"`generated_role_rules`\"\u003e`generatedRoleRules`\u003c/span\u003e. If set, Kubernetes token, service account, and role\nbinding objects will be created when credentials are requested.\n" }, "kubernetesRoleType": { "type": "string", "description": "Specifies whether the Kubernetes role is a Role or \nClusterRole.\n" }, "name": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "nameTemplate": { "type": "string", "description": "The name template to use when generating service accounts, \nroles and role bindings. If unset, a default template is used.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "serviceAccountName": { "type": "string", "description": "The pre-existing service account to generate tokens for.\nMutually exclusive with \u003cspan pulumi-lang-nodejs=\"`kubernetesRoleName`\" pulumi-lang-dotnet=\"`KubernetesRoleName`\" pulumi-lang-go=\"`kubernetesRoleName`\" pulumi-lang-python=\"`kubernetes_role_name`\" pulumi-lang-yaml=\"`kubernetesRoleName`\" pulumi-lang-java=\"`kubernetesRoleName`\" pulumi-lang-hcl=\"`kubernetes_role_name`\"\u003e`kubernetesRoleName`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`generatedRoleRules`\" pulumi-lang-dotnet=\"`GeneratedRoleRules`\" pulumi-lang-go=\"`generatedRoleRules`\" pulumi-lang-python=\"`generated_role_rules`\" pulumi-lang-yaml=\"`generatedRoleRules`\" pulumi-lang-java=\"`generatedRoleRules`\" pulumi-lang-hcl=\"`generated_role_rules`\"\u003e`generatedRoleRules`\u003c/span\u003e. If set, only a\nKubernetes token will be created when credentials are requested.\n" }, "tokenDefaultAudiences": { "type": "array", "items": { "type": "string" }, "description": "The default audiences for generated Kubernetes tokens.\nIf not set, defaults to the Kubernetes cluster's default audiences. This field requires\nVault 1.15 or later.\n" }, "tokenDefaultTtl": { "type": "integer", "description": "The default TTL for generated Kubernetes tokens in seconds.\n" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum TTL for generated Kubernetes tokens in seconds.\n" } }, "type": "object" } }, "vault:kv/secret:Secret": { "description": "Writes a KV-V1 secret to a given path in Vault.\n\nFor more information on Vault's KV-V1 secret backend\n[see here](https://www.vaultproject.io/docs/secrets/kv/kv-v1).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kvv1 = new vault.Mount(\"kvv1\", {\n path: \"kvv1\",\n type: \"kv\",\n options: {\n version: \"1\",\n },\n description: \"KV Version 1 secret engine mount\",\n});\nconst secret = new vault.kv.Secret(\"secret\", {\n path: pulumi.interpolate`${kvv1.path}/secret`,\n dataJson: JSON.stringify({\n zip: \"zap\",\n foo: \"bar\",\n }),\n});\n```\n```python\nimport pulumi\nimport json\nimport pulumi_vault as vault\n\nkvv1 = vault.Mount(\"kvv1\",\n path=\"kvv1\",\n type=\"kv\",\n options={\n \"version\": \"1\",\n },\n description=\"KV Version 1 secret engine mount\")\nsecret = vault.kv.Secret(\"secret\",\n path=kvv1.path.apply(lambda path: f\"{path}/secret\"),\n data_json=json.dumps({\n \"zip\": \"zap\",\n \"foo\": \"bar\",\n }))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text.Json;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kvv1 = new Vault.Mount(\"kvv1\", new()\n {\n Path = \"kvv1\",\n Type = \"kv\",\n Options = \n {\n { \"version\", \"1\" },\n },\n Description = \"KV Version 1 secret engine mount\",\n });\n\n var secret = new Vault.Kv.Secret(\"secret\", new()\n {\n Path = kvv1.Path.Apply(path =\u003e $\"{path}/secret\"),\n DataJson = JsonSerializer.Serialize(new Dictionary\u003cstring, object?\u003e\n {\n [\"zip\"] = \"zap\",\n [\"foo\"] = \"bar\",\n }),\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\t\"fmt\"\n\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kv\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkvv1, err := vault.NewMount(ctx, \"kvv1\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"kvv1\"),\n\t\t\tType: pulumi.String(\"kv\"),\n\t\t\tOptions: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"1\"),\n\t\t\t},\n\t\t\tDescription: pulumi.String(\"KV Version 1 secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttmpJSON0, err := json.Marshal(map[string]string{\n\t\t\t\"zip\": \"zap\",\n\t\t\t\"foo\": \"bar\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjson0 := string(tmpJSON0)\n\t\t_, err = kv.NewSecret(ctx, \"secret\", \u0026kv.SecretArgs{\n\t\t\tPath: kvv1.Path.ApplyT(func(path string) (string, error) {\n\t\t\t\treturn fmt.Sprintf(\"%v/secret\", path), nil\n\t\t\t}).(pulumi.StringOutput),\n\t\t\tDataJson: pulumi.String(json0),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"kvv1\" {\n path = \"kvv1\"\n type = \"kv\"\n options = {\n \"version\" = \"1\"\n }\n description = \"KV Version 1 secret engine mount\"\n}\nresource \"vault_kv_secret\" \"secret\" {\n path =\"${vault_mount.kvv1.path}/secret\"\n data_json = jsonencode({\n \"zip\" = \"zap\"\n \"foo\" = \"bar\"\n })\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.kv.Secret;\nimport com.pulumi.vault.kv.SecretArgs;\nimport static com.pulumi.codegen.internal.Serialization.*;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kvv1 = new Mount(\"kvv1\", MountArgs.builder()\n .path(\"kvv1\")\n .type(\"kv\")\n .options(Map.of(\"version\", \"1\"))\n .description(\"KV Version 1 secret engine mount\")\n .build());\n\n var secret = new Secret(\"secret\", SecretArgs.builder()\n .path(kvv1.path().applyValue(_path -\u003e String.format(\"%s/secret\", _path)))\n .dataJson(serializeJson(\n jsonObject(\n jsonProperty(\"zip\", \"zap\"),\n jsonProperty(\"foo\", \"bar\")\n )))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kvv1:\n type: vault:Mount\n properties:\n path: kvv1\n type: kv\n options:\n version: '1'\n description: KV Version 1 secret engine mount\n secret:\n type: vault:kv:Secret\n properties:\n path: ${kvv1.path}/secret\n dataJson:\n fn::toJSON:\n zip: zap\n foo: bar\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Required Vault Capabilities\n\nUse of this resource requires the \u003cspan pulumi-lang-nodejs=\"`create`\" pulumi-lang-dotnet=\"`Create`\" pulumi-lang-go=\"`create`\" pulumi-lang-python=\"`create`\" pulumi-lang-yaml=\"`create`\" pulumi-lang-java=\"`create`\" pulumi-lang-hcl=\"`create`\"\u003e`create`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`update`\" pulumi-lang-dotnet=\"`Update`\" pulumi-lang-go=\"`update`\" pulumi-lang-python=\"`update`\" pulumi-lang-yaml=\"`update`\" pulumi-lang-java=\"`update`\" pulumi-lang-hcl=\"`update`\"\u003e`update`\u003c/span\u003e capability\n(depending on whether the resource already exists) on the given path,\nthe \u003cspan pulumi-lang-nodejs=\"`delete`\" pulumi-lang-dotnet=\"`Delete`\" pulumi-lang-go=\"`delete`\" pulumi-lang-python=\"`delete`\" pulumi-lang-yaml=\"`delete`\" pulumi-lang-java=\"`delete`\" pulumi-lang-hcl=\"`delete`\"\u003e`delete`\u003c/span\u003e capability if the resource is removed from configuration,\nand the \u003cspan pulumi-lang-nodejs=\"`read`\" pulumi-lang-dotnet=\"`Read`\" pulumi-lang-go=\"`read`\" pulumi-lang-python=\"`read`\" pulumi-lang-yaml=\"`read`\" pulumi-lang-java=\"`read`\" pulumi-lang-hcl=\"`read`\"\u003e`read`\u003c/span\u003e capability for drift detection (by default).\n\n## Import\n\nKV-V1 secrets can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:kv/secret:Secret secret kvv1/secret\n```\n\n", "properties": { "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A mapping whose keys are the top-level data keys returned from\nVault and whose values are the corresponding values. This map can only\nrepresent string data, so any non-string values returned from Vault are\nserialized as JSON.\n", "secret": true }, "dataJson": { "type": "string", "description": "JSON-encoded string that will be\nwritten as the secret data at the given path.\n", "secret": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Full path of the KV-V1 secret.\n" } }, "required": [ "data", "dataJson", "path" ], "inputProperties": { "dataJson": { "type": "string", "description": "JSON-encoded string that will be\nwritten as the secret data at the given path.\n", "secret": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Full path of the KV-V1 secret.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "dataJson", "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering Secret resources.\n", "properties": { "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A mapping whose keys are the top-level data keys returned from\nVault and whose values are the corresponding values. This map can only\nrepresent string data, so any non-string values returned from Vault are\nserialized as JSON.\n", "secret": true }, "dataJson": { "type": "string", "description": "JSON-encoded string that will be\nwritten as the secret data at the given path.\n", "secret": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Full path of the KV-V1 secret.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:kv/secretBackendV2:SecretBackendV2": { "description": "Configures KV-V2 backend level settings that are applied to\nevery key in the key-value store.\n\nFor more information on Vault's KV-V2 secret backend\n[see here](https://www.vaultproject.io/docs/secrets/kv/kv-v2).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kvv2 = new vault.Mount(\"kvv2\", {\n path: \"kvv2\",\n type: \"kv\",\n options: {\n version: \"2\",\n },\n description: \"KV Version 2 secret engine mount\",\n});\nconst example = new vault.kv.SecretBackendV2(\"example\", {\n mount: kvv2.path,\n maxVersions: 5,\n deleteVersionAfter: 12600,\n casRequired: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkvv2 = vault.Mount(\"kvv2\",\n path=\"kvv2\",\n type=\"kv\",\n options={\n \"version\": \"2\",\n },\n description=\"KV Version 2 secret engine mount\")\nexample = vault.kv.SecretBackendV2(\"example\",\n mount=kvv2.path,\n max_versions=5,\n delete_version_after=12600,\n cas_required=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kvv2 = new Vault.Mount(\"kvv2\", new()\n {\n Path = \"kvv2\",\n Type = \"kv\",\n Options = \n {\n { \"version\", \"2\" },\n },\n Description = \"KV Version 2 secret engine mount\",\n });\n\n var example = new Vault.Kv.SecretBackendV2(\"example\", new()\n {\n Mount = kvv2.Path,\n MaxVersions = 5,\n DeleteVersionAfter = 12600,\n CasRequired = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kv\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkvv2, err := vault.NewMount(ctx, \"kvv2\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"kvv2\"),\n\t\t\tType: pulumi.String(\"kv\"),\n\t\t\tOptions: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t\tDescription: pulumi.String(\"KV Version 2 secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = kv.NewSecretBackendV2(ctx, \"example\", \u0026kv.SecretBackendV2Args{\n\t\t\tMount: kvv2.Path,\n\t\t\tMaxVersions: pulumi.Int(5),\n\t\t\tDeleteVersionAfter: pulumi.Int(12600),\n\t\t\tCasRequired: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"kvv2\" {\n path = \"kvv2\"\n type = \"kv\"\n options = {\n \"version\" = \"2\"\n }\n description = \"KV Version 2 secret engine mount\"\n}\nresource \"vault_kv_secretbackendv2\" \"example\" {\n mount = vault_mount.kvv2.path\n max_versions = 5\n delete_version_after = 12600\n cas_required = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.kv.SecretBackendV2;\nimport com.pulumi.vault.kv.SecretBackendV2Args;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kvv2 = new Mount(\"kvv2\", MountArgs.builder()\n .path(\"kvv2\")\n .type(\"kv\")\n .options(Map.of(\"version\", \"2\"))\n .description(\"KV Version 2 secret engine mount\")\n .build());\n\n var example = new SecretBackendV2(\"example\", SecretBackendV2Args.builder()\n .mount(kvv2.path())\n .maxVersions(5)\n .deleteVersionAfter(12600)\n .casRequired(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kvv2:\n type: vault:Mount\n properties:\n path: kvv2\n type: kv\n options:\n version: '2'\n description: KV Version 2 secret engine mount\n example:\n type: vault:kv:SecretBackendV2\n properties:\n mount: ${kvv2.path}\n maxVersions: 5\n deleteVersionAfter: 12600\n casRequired: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Required Vault Capabilities\n\nUse of this resource requires the \u003cspan pulumi-lang-nodejs=\"`create`\" pulumi-lang-dotnet=\"`Create`\" pulumi-lang-go=\"`create`\" pulumi-lang-python=\"`create`\" pulumi-lang-yaml=\"`create`\" pulumi-lang-java=\"`create`\" pulumi-lang-hcl=\"`create`\"\u003e`create`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`update`\" pulumi-lang-dotnet=\"`Update`\" pulumi-lang-go=\"`update`\" pulumi-lang-python=\"`update`\" pulumi-lang-yaml=\"`update`\" pulumi-lang-java=\"`update`\" pulumi-lang-hcl=\"`update`\"\u003e`update`\u003c/span\u003e capability\n(depending on whether the resource already exists) on the given path,\nthe \u003cspan pulumi-lang-nodejs=\"`delete`\" pulumi-lang-dotnet=\"`Delete`\" pulumi-lang-go=\"`delete`\" pulumi-lang-python=\"`delete`\" pulumi-lang-yaml=\"`delete`\" pulumi-lang-java=\"`delete`\" pulumi-lang-hcl=\"`delete`\"\u003e`delete`\u003c/span\u003e capability if the resource is removed from configuration,\nand the \u003cspan pulumi-lang-nodejs=\"`read`\" pulumi-lang-dotnet=\"`Read`\" pulumi-lang-go=\"`read`\" pulumi-lang-python=\"`read`\" pulumi-lang-yaml=\"`read`\" pulumi-lang-java=\"`read`\" pulumi-lang-hcl=\"`read`\"\u003e`read`\u003c/span\u003e capability for drift detection (by default).\n\n## Import\n\nThe KV-V2 secret backend can be imported using its unique ID,\nthe `${mount}/config`, e.g.\n\n```sh\n$ pulumi import vault:kv/secretBackendV2:SecretBackendV2 example kvv2/config\n```\n\n", "properties": { "casRequired": { "type": "boolean", "description": "If true, all keys will require the cas\nparameter to be set on all write requests.\n" }, "deleteVersionAfter": { "type": "integer", "description": "If set, specifies the length of time before\na version is deleted. Accepts duration in integer seconds.\n" }, "maxVersions": { "type": "integer", "description": "The number of versions to keep per key.\n" }, "mount": { "type": "string", "description": "Path where KV-V2 engine is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "casRequired", "maxVersions", "mount" ], "inputProperties": { "casRequired": { "type": "boolean", "description": "If true, all keys will require the cas\nparameter to be set on all write requests.\n" }, "deleteVersionAfter": { "type": "integer", "description": "If set, specifies the length of time before\na version is deleted. Accepts duration in integer seconds.\n" }, "maxVersions": { "type": "integer", "description": "The number of versions to keep per key.\n" }, "mount": { "type": "string", "description": "Path where KV-V2 engine is mounted.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendV2 resources.\n", "properties": { "casRequired": { "type": "boolean", "description": "If true, all keys will require the cas\nparameter to be set on all write requests.\n" }, "deleteVersionAfter": { "type": "integer", "description": "If set, specifies the length of time before\na version is deleted. Accepts duration in integer seconds.\n" }, "maxVersions": { "type": "integer", "description": "The number of versions to keep per key.\n" }, "mount": { "type": "string", "description": "Path where KV-V2 engine is mounted.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:kv/secretV2:SecretV2": { "description": "Writes a KV-V2 secret to a given path in Vault.\n\nFor more information on Vault's KV-V2 secret backend\n[see here](https://www.vaultproject.io/docs/secrets/kv/kv-v2).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kvv2 = new vault.Mount(\"kvv2\", {\n path: \"kvv2\",\n type: \"kv\",\n options: {\n version: \"2\",\n },\n description: \"KV Version 2 secret engine mount\",\n});\nconst example = new vault.kv.SecretV2(\"example\", {\n mount: kvv2.path,\n name: \"secret\",\n cas: 1,\n deleteAllVersions: true,\n dataJsonWo: JSON.stringify({\n zip: \"zap\",\n foo: \"bar\",\n }),\n dataJsonWoVersion: 1,\n customMetadata: {\n maxVersions: 5,\n data: {\n foo: \"vault@example.com\",\n bar: \"12345\",\n },\n },\n});\n```\n```python\nimport pulumi\nimport json\nimport pulumi_vault as vault\n\nkvv2 = vault.Mount(\"kvv2\",\n path=\"kvv2\",\n type=\"kv\",\n options={\n \"version\": \"2\",\n },\n description=\"KV Version 2 secret engine mount\")\nexample = vault.kv.SecretV2(\"example\",\n mount=kvv2.path,\n name=\"secret\",\n cas=1,\n delete_all_versions=True,\n data_json_wo=json.dumps({\n \"zip\": \"zap\",\n \"foo\": \"bar\",\n }),\n data_json_wo_version=1,\n custom_metadata={\n \"max_versions\": 5,\n \"data\": {\n \"foo\": \"vault@example.com\",\n \"bar\": \"12345\",\n },\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text.Json;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kvv2 = new Vault.Mount(\"kvv2\", new()\n {\n Path = \"kvv2\",\n Type = \"kv\",\n Options = \n {\n { \"version\", \"2\" },\n },\n Description = \"KV Version 2 secret engine mount\",\n });\n\n var example = new Vault.Kv.SecretV2(\"example\", new()\n {\n Mount = kvv2.Path,\n Name = \"secret\",\n Cas = 1,\n DeleteAllVersions = true,\n DataJsonWo = JsonSerializer.Serialize(new Dictionary\u003cstring, object?\u003e\n {\n [\"zip\"] = \"zap\",\n [\"foo\"] = \"bar\",\n }),\n DataJsonWoVersion = 1,\n CustomMetadata = new Vault.kv.Inputs.SecretV2CustomMetadataArgs\n {\n MaxVersions = 5,\n Data = \n {\n { \"foo\", \"vault@example.com\" },\n { \"bar\", \"12345\" },\n },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kv\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkvv2, err := vault.NewMount(ctx, \"kvv2\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"kvv2\"),\n\t\t\tType: pulumi.String(\"kv\"),\n\t\t\tOptions: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t\tDescription: pulumi.String(\"KV Version 2 secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttmpJSON0, err := json.Marshal(map[string]string{\n\t\t\t\"zip\": \"zap\",\n\t\t\t\"foo\": \"bar\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjson0 := string(tmpJSON0)\n\t\t_, err = kv.NewSecretV2(ctx, \"example\", \u0026kv.SecretV2Args{\n\t\t\tMount: kvv2.Path,\n\t\t\tName: pulumi.String(\"secret\"),\n\t\t\tCas: pulumi.Int(1),\n\t\t\tDeleteAllVersions: pulumi.Bool(true),\n\t\t\tDataJsonWo: pulumi.String(json0),\n\t\t\tDataJsonWoVersion: pulumi.Int(1),\n\t\t\tCustomMetadata: \u0026kv.SecretV2CustomMetadataArgs{\n\t\t\t\tMaxVersions: pulumi.Int(5),\n\t\t\t\tData: pulumi.StringMap{\n\t\t\t\t\t\"foo\": pulumi.String(\"vault@example.com\"),\n\t\t\t\t\t\"bar\": pulumi.String(\"12345\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"kvv2\" {\n path = \"kvv2\"\n type = \"kv\"\n options = {\n \"version\" = \"2\"\n }\n description = \"KV Version 2 secret engine mount\"\n}\nresource \"vault_kv_secretv2\" \"example\" {\n mount = vault_mount.kvv2.path\n name = \"secret\"\n cas = 1\n delete_all_versions = true\n data_json_wo = jsonencode({\n \"zip\" = \"zap\"\n \"foo\" = \"bar\"\n })\n data_json_wo_version = 1\n custom_metadata = {\n max_versions = 5\n data = {\n \"foo\" = \"vault@example.com\"\n \"bar\" = \"12345\"\n }\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.kv.SecretV2;\nimport com.pulumi.vault.kv.SecretV2Args;\nimport com.pulumi.vault.kv.inputs.SecretV2CustomMetadataArgs;\nimport static com.pulumi.codegen.internal.Serialization.*;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kvv2 = new Mount(\"kvv2\", MountArgs.builder()\n .path(\"kvv2\")\n .type(\"kv\")\n .options(Map.of(\"version\", \"2\"))\n .description(\"KV Version 2 secret engine mount\")\n .build());\n\n var example = new SecretV2(\"example\", SecretV2Args.builder()\n .mount(kvv2.path())\n .name(\"secret\")\n .cas(1)\n .deleteAllVersions(true)\n .dataJsonWo(serializeJson(\n jsonObject(\n jsonProperty(\"zip\", \"zap\"),\n jsonProperty(\"foo\", \"bar\")\n )))\n .dataJsonWoVersion(1)\n .customMetadata(SecretV2CustomMetadataArgs.builder()\n .maxVersions(5)\n .data(Map.ofEntries(\n Map.entry(\"foo\", \"vault@example.com\"),\n Map.entry(\"bar\", \"12345\")\n ))\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kvv2:\n type: vault:Mount\n properties:\n path: kvv2\n type: kv\n options:\n version: '2'\n description: KV Version 2 secret engine mount\n example:\n type: vault:kv:SecretV2\n properties:\n mount: ${kvv2.path}\n name: secret\n cas: 1\n deleteAllVersions: true\n dataJsonWo:\n fn::toJSON:\n zip: zap\n foo: bar\n dataJsonWoVersion: 1\n customMetadata:\n maxVersions: 5\n data:\n foo: vault@example.com\n bar: '12345'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Required Vault Capabilities\n\nUse of this resource requires the \u003cspan pulumi-lang-nodejs=\"`create`\" pulumi-lang-dotnet=\"`Create`\" pulumi-lang-go=\"`create`\" pulumi-lang-python=\"`create`\" pulumi-lang-yaml=\"`create`\" pulumi-lang-java=\"`create`\" pulumi-lang-hcl=\"`create`\"\u003e`create`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`update`\" pulumi-lang-dotnet=\"`Update`\" pulumi-lang-go=\"`update`\" pulumi-lang-python=\"`update`\" pulumi-lang-yaml=\"`update`\" pulumi-lang-java=\"`update`\" pulumi-lang-hcl=\"`update`\"\u003e`update`\u003c/span\u003e capability\n(depending on whether the resource already exists) on the given path,\nthe \u003cspan pulumi-lang-nodejs=\"`delete`\" pulumi-lang-dotnet=\"`Delete`\" pulumi-lang-go=\"`delete`\" pulumi-lang-python=\"`delete`\" pulumi-lang-yaml=\"`delete`\" pulumi-lang-java=\"`delete`\" pulumi-lang-hcl=\"`delete`\"\u003e`delete`\u003c/span\u003e capability if the resource is removed from configuration,\nand the \u003cspan pulumi-lang-nodejs=\"`read`\" pulumi-lang-dotnet=\"`Read`\" pulumi-lang-go=\"`read`\" pulumi-lang-python=\"`read`\" pulumi-lang-yaml=\"`read`\" pulumi-lang-java=\"`read`\" pulumi-lang-hcl=\"`read`\"\u003e`read`\u003c/span\u003e capability for drift detection (by default).\n\n### Custom Metadata Configuration Options\n\n* \u003cspan pulumi-lang-nodejs=\"`maxVersions`\" pulumi-lang-dotnet=\"`MaxVersions`\" pulumi-lang-go=\"`maxVersions`\" pulumi-lang-python=\"`max_versions`\" pulumi-lang-yaml=\"`maxVersions`\" pulumi-lang-java=\"`maxVersions`\" pulumi-lang-hcl=\"`max_versions`\"\u003e`maxVersions`\u003c/span\u003e - (Optional) The number of versions to keep per key.\n\n* \u003cspan pulumi-lang-nodejs=\"`casRequired`\" pulumi-lang-dotnet=\"`CasRequired`\" pulumi-lang-go=\"`casRequired`\" pulumi-lang-python=\"`cas_required`\" pulumi-lang-yaml=\"`casRequired`\" pulumi-lang-java=\"`casRequired`\" pulumi-lang-hcl=\"`cas_required`\"\u003e`casRequired`\u003c/span\u003e - (Optional) If true, all keys will require the cas\n parameter to be set on all write requests.\n\n* \u003cspan pulumi-lang-nodejs=\"`deleteVersionAfter`\" pulumi-lang-dotnet=\"`DeleteVersionAfter`\" pulumi-lang-go=\"`deleteVersionAfter`\" pulumi-lang-python=\"`delete_version_after`\" pulumi-lang-yaml=\"`deleteVersionAfter`\" pulumi-lang-java=\"`deleteVersionAfter`\" pulumi-lang-hcl=\"`delete_version_after`\"\u003e`deleteVersionAfter`\u003c/span\u003e - (Optional) If set, specifies the length of time before\n a version is deleted. Accepts duration in integer seconds.\n\n* \u003cspan pulumi-lang-nodejs=\"`data`\" pulumi-lang-dotnet=\"`Data`\" pulumi-lang-go=\"`data`\" pulumi-lang-python=\"`data`\" pulumi-lang-yaml=\"`data`\" pulumi-lang-java=\"`data`\" pulumi-lang-hcl=\"`data`\"\u003e`data`\u003c/span\u003e - (Optional) A string to string map describing the secret.\n\n## Import\n\nKV-V2 secrets can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:kv/secretV2:SecretV2 example kvv2/data/secret\n```\n\n", "properties": { "cas": { "type": "integer", "description": "This flag is required if \u003cspan pulumi-lang-nodejs=\"`casRequired`\" pulumi-lang-dotnet=\"`CasRequired`\" pulumi-lang-go=\"`casRequired`\" pulumi-lang-python=\"`cas_required`\" pulumi-lang-yaml=\"`casRequired`\" pulumi-lang-java=\"`casRequired`\" pulumi-lang-hcl=\"`cas_required`\"\u003e`casRequired`\u003c/span\u003e is set to true\non either the secret or the engine's config. In order for a\nwrite operation to be successful, cas must be set to the current version\nof the secret.\n" }, "customMetadata": { "$ref": "#/types/vault:kv/SecretV2CustomMetadata:SecretV2CustomMetadata", "description": "A nested block that allows configuring metadata for the\nKV secret. Refer to the\nConfiguration Options for more info.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**Deprecated. Please use new ephemeral resource \u003cspan pulumi-lang-nodejs=\"`vault.kv.SecretV2`\" pulumi-lang-dotnet=\"`vault.kv.SecretV2`\" pulumi-lang-go=\"`kv.SecretV2`\" pulumi-lang-python=\"`kv.SecretV2`\" pulumi-lang-yaml=\"`vault.kv.SecretV2`\" pulumi-lang-java=\"`vault.kv.SecretV2`\" pulumi-lang-hcl=\"`vault_kv_secret_v2`\"\u003e`vault.kv.SecretV2`\u003c/span\u003e to read back\nsecret data from Vault**. A mapping whose keys are the top-level data keys returned from\nVault and whose values are the corresponding values. This map can only represent string data,\nso any non-string values returned from Vault are serialized as JSON.\n", "deprecationMessage": "Deprecated. Will no longer be set on a read.", "secret": true }, "dataJson": { "type": "string", "description": "JSON-encoded string that will be\nwritten as the secret data at the given path. This is required if \u003cspan pulumi-lang-nodejs=\"`dataJsonWo`\" pulumi-lang-dotnet=\"`DataJsonWo`\" pulumi-lang-go=\"`dataJsonWo`\" pulumi-lang-python=\"`data_json_wo`\" pulumi-lang-yaml=\"`dataJsonWo`\" pulumi-lang-java=\"`dataJsonWo`\" pulumi-lang-hcl=\"`data_json_wo`\"\u003e`dataJsonWo`\u003c/span\u003e is not set.\n", "secret": true }, "dataJsonWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nJSON-encoded string that will be\nwritten as the secret data at the given path. This is required if \u003cspan pulumi-lang-nodejs=\"`dataJson`\" pulumi-lang-dotnet=\"`DataJson`\" pulumi-lang-go=\"`dataJson`\" pulumi-lang-python=\"`data_json`\" pulumi-lang-yaml=\"`dataJson`\" pulumi-lang-java=\"`dataJson`\" pulumi-lang-hcl=\"`data_json`\"\u003e`dataJson`\u003c/span\u003e is not set. **Note**: This property is write-only and will not be read from the API.\n", "secret": true }, "dataJsonWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`dataJsonWo`\" pulumi-lang-dotnet=\"`DataJsonWo`\" pulumi-lang-go=\"`dataJsonWo`\" pulumi-lang-python=\"`data_json_wo`\" pulumi-lang-yaml=\"`dataJsonWo`\" pulumi-lang-java=\"`dataJsonWo`\" pulumi-lang-hcl=\"`data_json_wo`\"\u003e`dataJsonWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" }, "deleteAllVersions": { "type": "boolean", "description": "If set to true, permanently deletes all\nversions for the specified key.\n" }, "disableRead": { "type": "boolean", "description": "If set to true, disables reading secret from Vault;\nnote: drift won't be detected.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Metadata associated with this secret read from Vault.\n" }, "mount": { "type": "string", "description": "Path where KV-V2 engine is mounted.\n" }, "name": { "type": "string", "description": "Full name of the secret. For a nested secret\nthe name is the nested path excluding the mount and data\nprefix. For example, for a secret at `kvv2/data/foo/bar/baz`\nthe name is `foo/bar/baz`.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "An object that holds option settings.\n" }, "path": { "type": "string", "description": "Full path where the KV-V2 secret will be written.\n" } }, "required": [ "customMetadata", "data", "metadata", "mount", "name", "path" ], "inputProperties": { "cas": { "type": "integer", "description": "This flag is required if \u003cspan pulumi-lang-nodejs=\"`casRequired`\" pulumi-lang-dotnet=\"`CasRequired`\" pulumi-lang-go=\"`casRequired`\" pulumi-lang-python=\"`cas_required`\" pulumi-lang-yaml=\"`casRequired`\" pulumi-lang-java=\"`casRequired`\" pulumi-lang-hcl=\"`cas_required`\"\u003e`casRequired`\u003c/span\u003e is set to true\non either the secret or the engine's config. In order for a\nwrite operation to be successful, cas must be set to the current version\nof the secret.\n" }, "customMetadata": { "$ref": "#/types/vault:kv/SecretV2CustomMetadata:SecretV2CustomMetadata", "description": "A nested block that allows configuring metadata for the\nKV secret. Refer to the\nConfiguration Options for more info.\n" }, "dataJson": { "type": "string", "description": "JSON-encoded string that will be\nwritten as the secret data at the given path. This is required if \u003cspan pulumi-lang-nodejs=\"`dataJsonWo`\" pulumi-lang-dotnet=\"`DataJsonWo`\" pulumi-lang-go=\"`dataJsonWo`\" pulumi-lang-python=\"`data_json_wo`\" pulumi-lang-yaml=\"`dataJsonWo`\" pulumi-lang-java=\"`dataJsonWo`\" pulumi-lang-hcl=\"`data_json_wo`\"\u003e`dataJsonWo`\u003c/span\u003e is not set.\n", "secret": true }, "dataJsonWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nJSON-encoded string that will be\nwritten as the secret data at the given path. This is required if \u003cspan pulumi-lang-nodejs=\"`dataJson`\" pulumi-lang-dotnet=\"`DataJson`\" pulumi-lang-go=\"`dataJson`\" pulumi-lang-python=\"`data_json`\" pulumi-lang-yaml=\"`dataJson`\" pulumi-lang-java=\"`dataJson`\" pulumi-lang-hcl=\"`data_json`\"\u003e`dataJson`\u003c/span\u003e is not set. **Note**: This property is write-only and will not be read from the API.\n", "secret": true }, "dataJsonWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`dataJsonWo`\" pulumi-lang-dotnet=\"`DataJsonWo`\" pulumi-lang-go=\"`dataJsonWo`\" pulumi-lang-python=\"`data_json_wo`\" pulumi-lang-yaml=\"`dataJsonWo`\" pulumi-lang-java=\"`dataJsonWo`\" pulumi-lang-hcl=\"`data_json_wo`\"\u003e`dataJsonWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" }, "deleteAllVersions": { "type": "boolean", "description": "If set to true, permanently deletes all\nversions for the specified key.\n" }, "disableRead": { "type": "boolean", "description": "If set to true, disables reading secret from Vault;\nnote: drift won't be detected.\n" }, "mount": { "type": "string", "description": "Path where KV-V2 engine is mounted.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "Full name of the secret. For a nested secret\nthe name is the nested path excluding the mount and data\nprefix. For example, for a secret at `kvv2/data/foo/bar/baz`\nthe name is `foo/bar/baz`.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "An object that holds option settings.\n" } }, "requiredInputs": [ "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretV2 resources.\n", "properties": { "cas": { "type": "integer", "description": "This flag is required if \u003cspan pulumi-lang-nodejs=\"`casRequired`\" pulumi-lang-dotnet=\"`CasRequired`\" pulumi-lang-go=\"`casRequired`\" pulumi-lang-python=\"`cas_required`\" pulumi-lang-yaml=\"`casRequired`\" pulumi-lang-java=\"`casRequired`\" pulumi-lang-hcl=\"`cas_required`\"\u003e`casRequired`\u003c/span\u003e is set to true\non either the secret or the engine's config. In order for a\nwrite operation to be successful, cas must be set to the current version\nof the secret.\n" }, "customMetadata": { "$ref": "#/types/vault:kv/SecretV2CustomMetadata:SecretV2CustomMetadata", "description": "A nested block that allows configuring metadata for the\nKV secret. Refer to the\nConfiguration Options for more info.\n" }, "data": { "type": "object", "additionalProperties": { "type": "string" }, "description": "**Deprecated. Please use new ephemeral resource \u003cspan pulumi-lang-nodejs=\"`vault.kv.SecretV2`\" pulumi-lang-dotnet=\"`vault.kv.SecretV2`\" pulumi-lang-go=\"`kv.SecretV2`\" pulumi-lang-python=\"`kv.SecretV2`\" pulumi-lang-yaml=\"`vault.kv.SecretV2`\" pulumi-lang-java=\"`vault.kv.SecretV2`\" pulumi-lang-hcl=\"`vault_kv_secret_v2`\"\u003e`vault.kv.SecretV2`\u003c/span\u003e to read back\nsecret data from Vault**. A mapping whose keys are the top-level data keys returned from\nVault and whose values are the corresponding values. This map can only represent string data,\nso any non-string values returned from Vault are serialized as JSON.\n", "deprecationMessage": "Deprecated. Will no longer be set on a read.", "secret": true }, "dataJson": { "type": "string", "description": "JSON-encoded string that will be\nwritten as the secret data at the given path. This is required if \u003cspan pulumi-lang-nodejs=\"`dataJsonWo`\" pulumi-lang-dotnet=\"`DataJsonWo`\" pulumi-lang-go=\"`dataJsonWo`\" pulumi-lang-python=\"`data_json_wo`\" pulumi-lang-yaml=\"`dataJsonWo`\" pulumi-lang-java=\"`dataJsonWo`\" pulumi-lang-hcl=\"`data_json_wo`\"\u003e`dataJsonWo`\u003c/span\u003e is not set.\n", "secret": true }, "dataJsonWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nJSON-encoded string that will be\nwritten as the secret data at the given path. This is required if \u003cspan pulumi-lang-nodejs=\"`dataJson`\" pulumi-lang-dotnet=\"`DataJson`\" pulumi-lang-go=\"`dataJson`\" pulumi-lang-python=\"`data_json`\" pulumi-lang-yaml=\"`dataJson`\" pulumi-lang-java=\"`dataJson`\" pulumi-lang-hcl=\"`data_json`\"\u003e`dataJson`\u003c/span\u003e is not set. **Note**: This property is write-only and will not be read from the API.\n", "secret": true }, "dataJsonWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`dataJsonWo`\" pulumi-lang-dotnet=\"`DataJsonWo`\" pulumi-lang-go=\"`dataJsonWo`\" pulumi-lang-python=\"`data_json_wo`\" pulumi-lang-yaml=\"`dataJsonWo`\" pulumi-lang-java=\"`dataJsonWo`\" pulumi-lang-hcl=\"`data_json_wo`\"\u003e`dataJsonWo`\u003c/span\u003e. For more info see updating write-only attributes.\n" }, "deleteAllVersions": { "type": "boolean", "description": "If set to true, permanently deletes all\nversions for the specified key.\n" }, "disableRead": { "type": "boolean", "description": "If set to true, disables reading secret from Vault;\nnote: drift won't be detected.\n" }, "metadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Metadata associated with this secret read from Vault.\n" }, "mount": { "type": "string", "description": "Path where KV-V2 engine is mounted.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "Full name of the secret. For a nested secret\nthe name is the nested path excluding the mount and data\nprefix. For example, for a secret at `kvv2/data/foo/bar/baz`\nthe name is `foo/bar/baz`.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "An object that holds option settings.\n" }, "path": { "type": "string", "description": "Full path where the KV-V2 secret will be written.\n" } }, "type": "object" } }, "vault:ldap/authBackend:AuthBackend": { "description": "Provides a resource for managing an [LDAP auth backend within Vault](https://www.vaultproject.io/docs/auth/ldap.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst ldap = new vault.ldap.AuthBackend(\"ldap\", {\n path: \"ldap\",\n url: \"ldaps://dc-01.example.org\",\n userdn: \"OU=Users,OU=Accounts,DC=example,DC=org\",\n userattr: \"sAMAccountName\",\n upndomain: \"EXAMPLE.ORG\",\n discoverdn: false,\n groupdn: \"OU=Groups,DC=example,DC=org\",\n groupfilter: \"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n requestTimeout: 30,\n dereferenceAliases: \"always\",\n enableSamaccountnameLogin: false,\n anonymousGroupSearch: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nldap = vault.ldap.AuthBackend(\"ldap\",\n path=\"ldap\",\n url=\"ldaps://dc-01.example.org\",\n userdn=\"OU=Users,OU=Accounts,DC=example,DC=org\",\n userattr=\"sAMAccountName\",\n upndomain=\"EXAMPLE.ORG\",\n discoverdn=False,\n groupdn=\"OU=Groups,DC=example,DC=org\",\n groupfilter=\"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600,\n request_timeout=30,\n dereference_aliases=\"always\",\n enable_samaccountname_login=False,\n anonymous_group_search=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var ldap = new Vault.Ldap.AuthBackend(\"ldap\", new()\n {\n Path = \"ldap\",\n Url = \"ldaps://dc-01.example.org\",\n Userdn = \"OU=Users,OU=Accounts,DC=example,DC=org\",\n Userattr = \"sAMAccountName\",\n Upndomain = \"EXAMPLE.ORG\",\n Discoverdn = false,\n Groupdn = \"OU=Groups,DC=example,DC=org\",\n Groupfilter = \"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n RequestTimeout = 30,\n DereferenceAliases = \"always\",\n EnableSamaccountnameLogin = false,\n AnonymousGroupSearch = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ldap\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := ldap.NewAuthBackend(ctx, \"ldap\", \u0026ldap.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"ldap\"),\n\t\t\tUrl: pulumi.String(\"ldaps://dc-01.example.org\"),\n\t\t\tUserdn: pulumi.String(\"OU=Users,OU=Accounts,DC=example,DC=org\"),\n\t\t\tUserattr: pulumi.String(\"sAMAccountName\"),\n\t\t\tUpndomain: pulumi.String(\"EXAMPLE.ORG\"),\n\t\t\tDiscoverdn: pulumi.Bool(false),\n\t\t\tGroupdn: pulumi.String(\"OU=Groups,DC=example,DC=org\"),\n\t\t\tGroupfilter: pulumi.String(\"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t\tRequestTimeout: pulumi.Int(30),\n\t\t\tDereferenceAliases: pulumi.String(\"always\"),\n\t\t\tEnableSamaccountnameLogin: pulumi.Bool(false),\n\t\t\tAnonymousGroupSearch: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ldap_authbackend\" \"ldap\" {\n path = \"ldap\"\n url = \"ldaps://dc-01.example.org\"\n userdn = \"OU=Users,OU=Accounts,DC=example,DC=org\"\n userattr = \"sAMAccountName\"\n upndomain = \"EXAMPLE.ORG\"\n discoverdn = false\n groupdn = \"OU=Groups,DC=example,DC=org\"\n groupfilter = \"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n request_timeout = 30\n dereference_aliases = \"always\"\n enable_samaccountname_login = false\n anonymous_group_search = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ldap.AuthBackend;\nimport com.pulumi.vault.ldap.AuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var ldap = new AuthBackend(\"ldap\", AuthBackendArgs.builder()\n .path(\"ldap\")\n .url(\"ldaps://dc-01.example.org\")\n .userdn(\"OU=Users,OU=Accounts,DC=example,DC=org\")\n .userattr(\"sAMAccountName\")\n .upndomain(\"EXAMPLE.ORG\")\n .discoverdn(false)\n .groupdn(\"OU=Groups,DC=example,DC=org\")\n .groupfilter(\"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .requestTimeout(30)\n .dereferenceAliases(\"always\")\n .enableSamaccountnameLogin(false)\n .anonymousGroupSearch(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n ldap:\n type: vault:ldap:AuthBackend\n properties:\n path: ldap\n url: ldaps://dc-01.example.org\n userdn: OU=Users,OU=Accounts,DC=example,DC=org\n userattr: sAMAccountName\n upndomain: EXAMPLE.ORG\n discoverdn: false\n groupdn: OU=Groups,DC=example,DC=org\n groupfilter: (\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n requestTimeout: 30\n dereferenceAliases: always\n enableSamaccountnameLogin: false\n anonymousGroupSearch: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e - (Optional) Write-only bind password to use for LDAP authentication. Can be updated. Conflicts with \u003cspan pulumi-lang-nodejs=\"`bindpass`\" pulumi-lang-dotnet=\"`Bindpass`\" pulumi-lang-go=\"`bindpass`\" pulumi-lang-python=\"`bindpass`\" pulumi-lang-yaml=\"`bindpass`\" pulumi-lang-java=\"`bindpass`\" pulumi-lang-hcl=\"`bindpass`\"\u003e`bindpass`\u003c/span\u003e.\n **Note**: This property is write-only and will not be read from the API.\n\n## Import\n\nLDAP authentication backends can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:ldap/authBackend:AuthBackend ldap ldap\n```\n\n", "properties": { "accessor": { "type": "string", "description": "The accessor for this auth mount.\n" }, "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "anonymousGroupSearch": { "type": "boolean", "description": "Allows anonymous group searches." }, "binddn": { "type": "string", "description": "DN of object to bind when performing user search\n" }, "bindpass": { "type": "string", "description": "Password to use with \u003cspan pulumi-lang-nodejs=\"`binddn`\" pulumi-lang-dotnet=\"`Binddn`\" pulumi-lang-go=\"`binddn`\" pulumi-lang-python=\"`binddn`\" pulumi-lang-yaml=\"`binddn`\" pulumi-lang-java=\"`binddn`\" pulumi-lang-hcl=\"`binddn`\"\u003e`binddn`\u003c/span\u003e when performing user search. Conflicts with \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e.\n", "secret": true }, "bindpassWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only bind password to use for LDAP authentication.", "secret": true }, "bindpassWoVersion": { "type": "integer", "description": "Version counter for write-only bind password.\nRequired when using \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e. For more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" }, "caseSensitiveNames": { "type": "boolean", "description": "Control case senstivity of objects fetched from LDAP, this is used for object matching in vault\n" }, "certificate": { "type": "string", "description": "Trusted CA to validate TLS certificate\n" }, "clientTlsCert": { "type": "string" }, "clientTlsKey": { "type": "string", "secret": true }, "connectionTimeout": { "type": "integer", "description": "Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in \u003cspan pulumi-lang-nodejs=\"`url`\" pulumi-lang-dotnet=\"`Url`\" pulumi-lang-go=\"`url`\" pulumi-lang-python=\"`url`\" pulumi-lang-yaml=\"`url`\" pulumi-lang-java=\"`url`\" pulumi-lang-hcl=\"`url`\"\u003e`url`\u003c/span\u003e (integer: 30)\n" }, "denyNullBind": { "type": "boolean", "description": "Prevents users from bypassing authentication when providing an empty password.\n" }, "dereferenceAliases": { "type": "string", "description": "Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'." }, "description": { "type": "string", "description": "Description for the LDAP auth backend mount\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover the bind DN of a user.\n" }, "enableSamaccountnameLogin": { "type": "boolean", "description": "Enables login using the sAMAccountName attribute." }, "groupattr": { "type": "string", "description": "LDAP attribute to follow on objects returned by groupfilter\n" }, "groupdn": { "type": "string", "description": "Base DN under which to perform group search\n" }, "groupfilter": { "type": "string", "description": "Go template used to construct group membership query\n" }, "insecureTls": { "type": "boolean", "description": "Control whether or TLS certificates must be validated\n" }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n" }, "maxPageSize": { "type": "integer", "description": "Sets the max page size for LDAP lookups, by default it's set to -1.\n*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Path to mount the LDAP auth backend under\n" }, "requestTimeout": { "type": "integer", "description": "The timeout(in sec) for requests to the LDAP server." }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "starttls": { "type": "boolean", "description": "Control use of TLS when conecting to LDAP\n" }, "tlsMaxVersion": { "type": "string", "description": "Maximum acceptable version of TLS\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum acceptable version of TLS\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" }, "tune": { "$ref": "#/types/vault:ldap/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "upndomain": { "type": "string", "description": "The `userPrincipalDomain` used to construct the UPN string for the authenticating user.\n" }, "url": { "type": "string", "description": "The URL of the LDAP server\n" }, "useTokenGroups": { "type": "boolean", "description": "Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships\n" }, "userattr": { "type": "string", "description": "Attribute on user object matching username passed in\n" }, "userdn": { "type": "string", "description": "Base DN under which to perform user search\n" }, "userfilter": { "type": "string", "description": "LDAP user search filter\n" }, "usernameAsAlias": { "type": "boolean", "description": "Force the auth method to use the username passed by the user as the alias name.\n" } }, "required": [ "accessor", "anonymousGroupSearch", "binddn", "caseSensitiveNames", "certificate", "clientTlsCert", "clientTlsKey", "connectionTimeout", "denyNullBind", "dereferenceAliases", "description", "discoverdn", "enableSamaccountnameLogin", "groupattr", "groupdn", "groupfilter", "insecureTls", "requestTimeout", "starttls", "tlsMaxVersion", "tlsMinVersion", "tune", "upndomain", "url", "useTokenGroups", "userattr", "userdn", "userfilter", "usernameAsAlias" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "anonymousGroupSearch": { "type": "boolean", "description": "Allows anonymous group searches." }, "binddn": { "type": "string", "description": "DN of object to bind when performing user search\n" }, "bindpass": { "type": "string", "description": "Password to use with \u003cspan pulumi-lang-nodejs=\"`binddn`\" pulumi-lang-dotnet=\"`Binddn`\" pulumi-lang-go=\"`binddn`\" pulumi-lang-python=\"`binddn`\" pulumi-lang-yaml=\"`binddn`\" pulumi-lang-java=\"`binddn`\" pulumi-lang-hcl=\"`binddn`\"\u003e`binddn`\u003c/span\u003e when performing user search. Conflicts with \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e.\n", "secret": true }, "bindpassWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only bind password to use for LDAP authentication.", "secret": true }, "bindpassWoVersion": { "type": "integer", "description": "Version counter for write-only bind password.\nRequired when using \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e. For more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" }, "caseSensitiveNames": { "type": "boolean", "description": "Control case senstivity of objects fetched from LDAP, this is used for object matching in vault\n" }, "certificate": { "type": "string", "description": "Trusted CA to validate TLS certificate\n" }, "clientTlsCert": { "type": "string" }, "clientTlsKey": { "type": "string", "secret": true }, "connectionTimeout": { "type": "integer", "description": "Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in \u003cspan pulumi-lang-nodejs=\"`url`\" pulumi-lang-dotnet=\"`Url`\" pulumi-lang-go=\"`url`\" pulumi-lang-python=\"`url`\" pulumi-lang-yaml=\"`url`\" pulumi-lang-java=\"`url`\" pulumi-lang-hcl=\"`url`\"\u003e`url`\u003c/span\u003e (integer: 30)\n" }, "denyNullBind": { "type": "boolean", "description": "Prevents users from bypassing authentication when providing an empty password.\n" }, "dereferenceAliases": { "type": "string", "description": "Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'." }, "description": { "type": "string", "description": "Description for the LDAP auth backend mount\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover the bind DN of a user.\n" }, "enableSamaccountnameLogin": { "type": "boolean", "description": "Enables login using the sAMAccountName attribute." }, "groupattr": { "type": "string", "description": "LDAP attribute to follow on objects returned by groupfilter\n" }, "groupdn": { "type": "string", "description": "Base DN under which to perform group search\n" }, "groupfilter": { "type": "string", "description": "Go template used to construct group membership query\n" }, "insecureTls": { "type": "boolean", "description": "Control whether or TLS certificates must be validated\n" }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n", "willReplaceOnChanges": true }, "maxPageSize": { "type": "integer", "description": "Sets the max page size for LDAP lookups, by default it's set to -1.\n*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path to mount the LDAP auth backend under\n" }, "requestTimeout": { "type": "integer", "description": "The timeout(in sec) for requests to the LDAP server." }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "starttls": { "type": "boolean", "description": "Control use of TLS when conecting to LDAP\n" }, "tlsMaxVersion": { "type": "string", "description": "Maximum acceptable version of TLS\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum acceptable version of TLS\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" }, "tune": { "$ref": "#/types/vault:ldap/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "upndomain": { "type": "string", "description": "The `userPrincipalDomain` used to construct the UPN string for the authenticating user.\n" }, "url": { "type": "string", "description": "The URL of the LDAP server\n" }, "useTokenGroups": { "type": "boolean", "description": "Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships\n" }, "userattr": { "type": "string", "description": "Attribute on user object matching username passed in\n" }, "userdn": { "type": "string", "description": "Base DN under which to perform user search\n" }, "userfilter": { "type": "string", "description": "LDAP user search filter\n" }, "usernameAsAlias": { "type": "boolean", "description": "Force the auth method to use the username passed by the user as the alias name.\n" } }, "requiredInputs": [ "url" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "The accessor for this auth mount.\n" }, "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "anonymousGroupSearch": { "type": "boolean", "description": "Allows anonymous group searches." }, "binddn": { "type": "string", "description": "DN of object to bind when performing user search\n" }, "bindpass": { "type": "string", "description": "Password to use with \u003cspan pulumi-lang-nodejs=\"`binddn`\" pulumi-lang-dotnet=\"`Binddn`\" pulumi-lang-go=\"`binddn`\" pulumi-lang-python=\"`binddn`\" pulumi-lang-yaml=\"`binddn`\" pulumi-lang-java=\"`binddn`\" pulumi-lang-hcl=\"`binddn`\"\u003e`binddn`\u003c/span\u003e when performing user search. Conflicts with \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e.\n", "secret": true }, "bindpassWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only bind password to use for LDAP authentication.", "secret": true }, "bindpassWoVersion": { "type": "integer", "description": "Version counter for write-only bind password.\nRequired when using \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e. For more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" }, "caseSensitiveNames": { "type": "boolean", "description": "Control case senstivity of objects fetched from LDAP, this is used for object matching in vault\n" }, "certificate": { "type": "string", "description": "Trusted CA to validate TLS certificate\n" }, "clientTlsCert": { "type": "string" }, "clientTlsKey": { "type": "string", "secret": true }, "connectionTimeout": { "type": "integer", "description": "Timeout in seconds when connecting to LDAP before attempting to connect to the next server in the URL provided in \u003cspan pulumi-lang-nodejs=\"`url`\" pulumi-lang-dotnet=\"`Url`\" pulumi-lang-go=\"`url`\" pulumi-lang-python=\"`url`\" pulumi-lang-yaml=\"`url`\" pulumi-lang-java=\"`url`\" pulumi-lang-hcl=\"`url`\"\u003e`url`\u003c/span\u003e (integer: 30)\n" }, "denyNullBind": { "type": "boolean", "description": "Prevents users from bypassing authentication when providing an empty password.\n" }, "dereferenceAliases": { "type": "string", "description": "Specifies how aliases are dereferenced during LDAP searches. Valid values are 'never','searching','finding', and 'always'." }, "description": { "type": "string", "description": "Description for the LDAP auth backend mount\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "discoverdn": { "type": "boolean", "description": "Use anonymous bind to discover the bind DN of a user.\n" }, "enableSamaccountnameLogin": { "type": "boolean", "description": "Enables login using the sAMAccountName attribute." }, "groupattr": { "type": "string", "description": "LDAP attribute to follow on objects returned by groupfilter\n" }, "groupdn": { "type": "string", "description": "Base DN under which to perform group search\n" }, "groupfilter": { "type": "string", "description": "Go template used to construct group membership query\n" }, "insecureTls": { "type": "boolean", "description": "Control whether or TLS certificates must be validated\n" }, "local": { "type": "boolean", "description": "Specifies if the auth method is local only.\n", "willReplaceOnChanges": true }, "maxPageSize": { "type": "integer", "description": "Sets the max page size for LDAP lookups, by default it's set to -1.\n*Available only for Vault 1.11.11+, 1.12.7+, and 1.13.3+*.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path to mount the LDAP auth backend under\n" }, "requestTimeout": { "type": "integer", "description": "The timeout(in sec) for requests to the LDAP server." }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "starttls": { "type": "boolean", "description": "Control use of TLS when conecting to LDAP\n" }, "tlsMaxVersion": { "type": "string", "description": "Maximum acceptable version of TLS\n" }, "tlsMinVersion": { "type": "string", "description": "Minimum acceptable version of TLS\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "Specifies the type of tokens that should be returned by\nthe mount. Valid values are \"default-service\", \"default-batch\", \"service\", \"batch\".\n" }, "tune": { "$ref": "#/types/vault:ldap/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "upndomain": { "type": "string", "description": "The `userPrincipalDomain` used to construct the UPN string for the authenticating user.\n" }, "url": { "type": "string", "description": "The URL of the LDAP server\n" }, "useTokenGroups": { "type": "boolean", "description": "Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships\n" }, "userattr": { "type": "string", "description": "Attribute on user object matching username passed in\n" }, "userdn": { "type": "string", "description": "Base DN under which to perform user search\n" }, "userfilter": { "type": "string", "description": "LDAP user search filter\n" }, "usernameAsAlias": { "type": "boolean", "description": "Force the auth method to use the username passed by the user as the alias name.\n" } }, "type": "object" } }, "vault:ldap/authBackendGroup:AuthBackendGroup": { "description": "Provides a resource to create a group in an [LDAP auth backend within Vault](https://www.vaultproject.io/docs/auth/ldap.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst ldap = new vault.ldap.AuthBackend(\"ldap\", {\n path: \"ldap\",\n url: \"ldaps://dc-01.example.org\",\n userdn: \"OU=Users,OU=Accounts,DC=example,DC=org\",\n userattr: \"sAMAccountName\",\n upndomain: \"EXAMPLE.ORG\",\n discoverdn: false,\n groupdn: \"OU=Groups,DC=example,DC=org\",\n groupfilter: \"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\",\n});\nconst group = new vault.ldap.AuthBackendGroup(\"group\", {\n groupname: \"dba\",\n policies: [\"dba\"],\n backend: ldap.path,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nldap = vault.ldap.AuthBackend(\"ldap\",\n path=\"ldap\",\n url=\"ldaps://dc-01.example.org\",\n userdn=\"OU=Users,OU=Accounts,DC=example,DC=org\",\n userattr=\"sAMAccountName\",\n upndomain=\"EXAMPLE.ORG\",\n discoverdn=False,\n groupdn=\"OU=Groups,DC=example,DC=org\",\n groupfilter=\"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\")\ngroup = vault.ldap.AuthBackendGroup(\"group\",\n groupname=\"dba\",\n policies=[\"dba\"],\n backend=ldap.path)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var ldap = new Vault.Ldap.AuthBackend(\"ldap\", new()\n {\n Path = \"ldap\",\n Url = \"ldaps://dc-01.example.org\",\n Userdn = \"OU=Users,OU=Accounts,DC=example,DC=org\",\n Userattr = \"sAMAccountName\",\n Upndomain = \"EXAMPLE.ORG\",\n Discoverdn = false,\n Groupdn = \"OU=Groups,DC=example,DC=org\",\n Groupfilter = \"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\",\n });\n\n var @group = new Vault.Ldap.AuthBackendGroup(\"group\", new()\n {\n Groupname = \"dba\",\n Policies = new[]\n {\n \"dba\",\n },\n Backend = ldap.Path,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ldap\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tldap2, err := ldap.NewAuthBackend(ctx, \"ldap\", \u0026ldap.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"ldap\"),\n\t\t\tUrl: pulumi.String(\"ldaps://dc-01.example.org\"),\n\t\t\tUserdn: pulumi.String(\"OU=Users,OU=Accounts,DC=example,DC=org\"),\n\t\t\tUserattr: pulumi.String(\"sAMAccountName\"),\n\t\t\tUpndomain: pulumi.String(\"EXAMPLE.ORG\"),\n\t\t\tDiscoverdn: pulumi.Bool(false),\n\t\t\tGroupdn: pulumi.String(\"OU=Groups,DC=example,DC=org\"),\n\t\t\tGroupfilter: pulumi.String(\"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = ldap.NewAuthBackendGroup(ctx, \"group\", \u0026ldap.AuthBackendGroupArgs{\n\t\t\tGroupname: pulumi.String(\"dba\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dba\"),\n\t\t\t},\n\t\t\tBackend: ldap2.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ldap_authbackend\" \"ldap\" {\n path = \"ldap\"\n url = \"ldaps://dc-01.example.org\"\n userdn = \"OU=Users,OU=Accounts,DC=example,DC=org\"\n userattr = \"sAMAccountName\"\n upndomain = \"EXAMPLE.ORG\"\n discoverdn = false\n groupdn = \"OU=Groups,DC=example,DC=org\"\n groupfilter = \"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\"\n}\nresource \"vault_ldap_authbackendgroup\" \"group\" {\n groupname = \"dba\"\n policies = [\"dba\"]\n backend = vault_ldap_authbackend.ldap.path\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ldap.AuthBackend;\nimport com.pulumi.vault.ldap.AuthBackendArgs;\nimport com.pulumi.vault.ldap.AuthBackendGroup;\nimport com.pulumi.vault.ldap.AuthBackendGroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var ldap = new AuthBackend(\"ldap\", AuthBackendArgs.builder()\n .path(\"ldap\")\n .url(\"ldaps://dc-01.example.org\")\n .userdn(\"OU=Users,OU=Accounts,DC=example,DC=org\")\n .userattr(\"sAMAccountName\")\n .upndomain(\"EXAMPLE.ORG\")\n .discoverdn(false)\n .groupdn(\"OU=Groups,DC=example,DC=org\")\n .groupfilter(\"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\")\n .build());\n\n var group = new AuthBackendGroup(\"group\", AuthBackendGroupArgs.builder()\n .groupname(\"dba\")\n .policies(\"dba\")\n .backend(ldap.path())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n ldap:\n type: vault:ldap:AuthBackend\n properties:\n path: ldap\n url: ldaps://dc-01.example.org\n userdn: OU=Users,OU=Accounts,DC=example,DC=org\n userattr: sAMAccountName\n upndomain: EXAMPLE.ORG\n discoverdn: false\n groupdn: OU=Groups,DC=example,DC=org\n groupfilter: (\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\n group:\n type: vault:ldap:AuthBackendGroup\n properties:\n groupname: dba\n policies:\n - dba\n backend: ${ldap.path}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nLDAP authentication backend groups can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:ldap/authBackendGroup:AuthBackendGroup foo auth/ldap/groups/foo\n```\n\n", "properties": { "backend": { "type": "string", "description": "Path to the authentication backend\n\nFor more details on the usage of each argument consult the [Vault LDAP API documentation](https://www.vaultproject.io/api-docs/auth/ldap).\n" }, "groupname": { "type": "string", "description": "The LDAP groupname\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Policies which should be granted to members of the group\n" } }, "required": [ "groupname", "policies" ], "inputProperties": { "backend": { "type": "string", "description": "Path to the authentication backend\n\nFor more details on the usage of each argument consult the [Vault LDAP API documentation](https://www.vaultproject.io/api-docs/auth/ldap).\n", "willReplaceOnChanges": true }, "groupname": { "type": "string", "description": "The LDAP groupname\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Policies which should be granted to members of the group\n" } }, "requiredInputs": [ "groupname" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendGroup resources.\n", "properties": { "backend": { "type": "string", "description": "Path to the authentication backend\n\nFor more details on the usage of each argument consult the [Vault LDAP API documentation](https://www.vaultproject.io/api-docs/auth/ldap).\n", "willReplaceOnChanges": true }, "groupname": { "type": "string", "description": "The LDAP groupname\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Policies which should be granted to members of the group\n" } }, "type": "object" } }, "vault:ldap/authBackendUser:AuthBackendUser": { "description": "Provides a resource to create a user in an [LDAP auth backend within Vault](https://www.vaultproject.io/docs/auth/ldap.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst ldap = new vault.ldap.AuthBackend(\"ldap\", {\n path: \"ldap\",\n url: \"ldaps://dc-01.example.org\",\n userdn: \"OU=Users,OU=Accounts,DC=example,DC=org\",\n userattr: \"sAMAccountName\",\n upndomain: \"EXAMPLE.ORG\",\n discoverdn: false,\n groupdn: \"OU=Groups,DC=example,DC=org\",\n groupfilter: \"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\",\n});\nconst user = new vault.ldap.AuthBackendUser(\"user\", {\n username: \"test-user\",\n policies: [\n \"dba\",\n \"sysops\",\n ],\n backend: ldap.path,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nldap = vault.ldap.AuthBackend(\"ldap\",\n path=\"ldap\",\n url=\"ldaps://dc-01.example.org\",\n userdn=\"OU=Users,OU=Accounts,DC=example,DC=org\",\n userattr=\"sAMAccountName\",\n upndomain=\"EXAMPLE.ORG\",\n discoverdn=False,\n groupdn=\"OU=Groups,DC=example,DC=org\",\n groupfilter=\"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\")\nuser = vault.ldap.AuthBackendUser(\"user\",\n username=\"test-user\",\n policies=[\n \"dba\",\n \"sysops\",\n ],\n backend=ldap.path)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var ldap = new Vault.Ldap.AuthBackend(\"ldap\", new()\n {\n Path = \"ldap\",\n Url = \"ldaps://dc-01.example.org\",\n Userdn = \"OU=Users,OU=Accounts,DC=example,DC=org\",\n Userattr = \"sAMAccountName\",\n Upndomain = \"EXAMPLE.ORG\",\n Discoverdn = false,\n Groupdn = \"OU=Groups,DC=example,DC=org\",\n Groupfilter = \"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\",\n });\n\n var user = new Vault.Ldap.AuthBackendUser(\"user\", new()\n {\n Username = \"test-user\",\n Policies = new[]\n {\n \"dba\",\n \"sysops\",\n },\n Backend = ldap.Path,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ldap\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tldap2, err := ldap.NewAuthBackend(ctx, \"ldap\", \u0026ldap.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"ldap\"),\n\t\t\tUrl: pulumi.String(\"ldaps://dc-01.example.org\"),\n\t\t\tUserdn: pulumi.String(\"OU=Users,OU=Accounts,DC=example,DC=org\"),\n\t\t\tUserattr: pulumi.String(\"sAMAccountName\"),\n\t\t\tUpndomain: pulumi.String(\"EXAMPLE.ORG\"),\n\t\t\tDiscoverdn: pulumi.Bool(false),\n\t\t\tGroupdn: pulumi.String(\"OU=Groups,DC=example,DC=org\"),\n\t\t\tGroupfilter: pulumi.String(\"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = ldap.NewAuthBackendUser(ctx, \"user\", \u0026ldap.AuthBackendUserArgs{\n\t\t\tUsername: pulumi.String(\"test-user\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"dba\"),\n\t\t\t\tpulumi.String(\"sysops\"),\n\t\t\t},\n\t\t\tBackend: ldap2.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ldap_authbackend\" \"ldap\" {\n path = \"ldap\"\n url = \"ldaps://dc-01.example.org\"\n userdn = \"OU=Users,OU=Accounts,DC=example,DC=org\"\n userattr = \"sAMAccountName\"\n upndomain = \"EXAMPLE.ORG\"\n discoverdn = false\n groupdn = \"OU=Groups,DC=example,DC=org\"\n groupfilter = \"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\"\n}\nresource \"vault_ldap_authbackenduser\" \"user\" {\n username = \"test-user\"\n policies = [\"dba\", \"sysops\"]\n backend = vault_ldap_authbackend.ldap.path\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ldap.AuthBackend;\nimport com.pulumi.vault.ldap.AuthBackendArgs;\nimport com.pulumi.vault.ldap.AuthBackendUser;\nimport com.pulumi.vault.ldap.AuthBackendUserArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var ldap = new AuthBackend(\"ldap\", AuthBackendArgs.builder()\n .path(\"ldap\")\n .url(\"ldaps://dc-01.example.org\")\n .userdn(\"OU=Users,OU=Accounts,DC=example,DC=org\")\n .userattr(\"sAMAccountName\")\n .upndomain(\"EXAMPLE.ORG\")\n .discoverdn(false)\n .groupdn(\"OU=Groups,DC=example,DC=org\")\n .groupfilter(\"(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\")\n .build());\n\n var user = new AuthBackendUser(\"user\", AuthBackendUserArgs.builder()\n .username(\"test-user\")\n .policies( \n \"dba\",\n \"sysops\")\n .backend(ldap.path())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n ldap:\n type: vault:ldap:AuthBackend\n properties:\n path: ldap\n url: ldaps://dc-01.example.org\n userdn: OU=Users,OU=Accounts,DC=example,DC=org\n userattr: sAMAccountName\n upndomain: EXAMPLE.ORG\n discoverdn: false\n groupdn: OU=Groups,DC=example,DC=org\n groupfilter: (\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))\n user:\n type: vault:ldap:AuthBackendUser\n properties:\n username: test-user\n policies:\n - dba\n - sysops\n backend: ${ldap.path}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nLDAP authentication backend users can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:ldap/authBackendUser:AuthBackendUser foo auth/ldap/users/foo\n```\n\n", "properties": { "backend": { "type": "string", "description": "Path to the authentication backend\n\nFor more details on the usage of each argument consult the [Vault LDAP API documentation](https://www.vaultproject.io/api-docs/auth/ldap).\n" }, "groups": { "type": "array", "items": { "type": "string" }, "description": "Override LDAP groups which should be granted to user\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Policies which should be granted to user\n" }, "username": { "type": "string", "description": "The LDAP username\n" } }, "required": [ "groups", "policies", "username" ], "inputProperties": { "backend": { "type": "string", "description": "Path to the authentication backend\n\nFor more details on the usage of each argument consult the [Vault LDAP API documentation](https://www.vaultproject.io/api-docs/auth/ldap).\n", "willReplaceOnChanges": true }, "groups": { "type": "array", "items": { "type": "string" }, "description": "Override LDAP groups which should be granted to user\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Policies which should be granted to user\n" }, "username": { "type": "string", "description": "The LDAP username\n" } }, "requiredInputs": [ "username" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendUser resources.\n", "properties": { "backend": { "type": "string", "description": "Path to the authentication backend\n\nFor more details on the usage of each argument consult the [Vault LDAP API documentation](https://www.vaultproject.io/api-docs/auth/ldap).\n", "willReplaceOnChanges": true }, "groups": { "type": "array", "items": { "type": "string" }, "description": "Override LDAP groups which should be granted to user\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Policies which should be granted to user\n" }, "username": { "type": "string", "description": "The LDAP username\n" } }, "type": "object" } }, "vault:ldap/secretBackend:SecretBackend": { "description": "Creates a LDAP Secret Backend for Vault.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.ldap.SecretBackend(\"config\", {\n path: \"my-custom-ldap\",\n binddn: \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass: \"SuperSecretPassw0rd\",\n url: \"ldaps://localhost\",\n insecureTls: true,\n userdn: \"CN=Users,DC=corp,DC=example,DC=net\",\n rotationSchedule: \"0 * * * SAT\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.ldap.SecretBackend(\"config\",\n path=\"my-custom-ldap\",\n binddn=\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass=\"SuperSecretPassw0rd\",\n url=\"ldaps://localhost\",\n insecure_tls=True,\n userdn=\"CN=Users,DC=corp,DC=example,DC=net\",\n rotation_schedule=\"0 * * * SAT\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Ldap.SecretBackend(\"config\", new()\n {\n Path = \"my-custom-ldap\",\n Binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n Bindpass = \"SuperSecretPassw0rd\",\n Url = \"ldaps://localhost\",\n InsecureTls = true,\n Userdn = \"CN=Users,DC=corp,DC=example,DC=net\",\n RotationSchedule = \"0 * * * SAT\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ldap\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := ldap.NewSecretBackend(ctx, \"config\", \u0026ldap.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"my-custom-ldap\"),\n\t\t\tBinddn: pulumi.String(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t\tBindpass: pulumi.String(\"SuperSecretPassw0rd\"),\n\t\t\tUrl: pulumi.String(\"ldaps://localhost\"),\n\t\t\tInsecureTls: pulumi.Bool(true),\n\t\t\tUserdn: pulumi.String(\"CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t\tRotationSchedule: pulumi.String(\"0 * * * SAT\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ldap_secretbackend\" \"config\" {\n path = \"my-custom-ldap\"\n binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"\n bindpass = \"SuperSecretPassw0rd\"\n url = \"ldaps://localhost\"\n insecure_tls = \"true\"\n userdn = \"CN=Users,DC=corp,DC=example,DC=net\"\n rotation_schedule = \"0 * * * SAT\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ldap.SecretBackend;\nimport com.pulumi.vault.ldap.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .path(\"my-custom-ldap\")\n .binddn(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\")\n .bindpass(\"SuperSecretPassw0rd\")\n .url(\"ldaps://localhost\")\n .insecureTls(true)\n .userdn(\"CN=Users,DC=corp,DC=example,DC=net\")\n .rotationSchedule(\"0 * * * SAT\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:ldap:SecretBackend\n properties:\n path: my-custom-ldap\n binddn: CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\n bindpass: SuperSecretPassw0rd\n url: ldaps://localhost\n insecureTls: 'true'\n userdn: CN=Users,DC=corp,DC=example,DC=net\n rotationSchedule: 0 * * * SAT\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e - (Optional) Write-only password to use along with binddn when performing user search. Can be updated. Conflicts with \u003cspan pulumi-lang-nodejs=\"`bindpass`\" pulumi-lang-dotnet=\"`Bindpass`\" pulumi-lang-go=\"`bindpass`\" pulumi-lang-python=\"`bindpass`\" pulumi-lang-yaml=\"`bindpass`\" pulumi-lang-java=\"`bindpass`\" pulumi-lang-hcl=\"`bindpass`\"\u003e`bindpass`\u003c/span\u003e.\n Exactly one of \u003cspan pulumi-lang-nodejs=\"`bindpass`\" pulumi-lang-dotnet=\"`Bindpass`\" pulumi-lang-go=\"`bindpass`\" pulumi-lang-python=\"`bindpass`\" pulumi-lang-yaml=\"`bindpass`\" pulumi-lang-java=\"`bindpass`\" pulumi-lang-hcl=\"`bindpass`\"\u003e`bindpass`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e must be provided.\n **Note**: This property is write-only and will not be read from the API.\n\n## Import\n\nLDAP secret backend can be imported using the `${mount}/config`, e.g.\n\n```sh\n$ pulumi import vault:ldap/secretBackend:SecretBackend config ldap/config\n```\n\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "autoUnlock": { "type": "boolean", "description": "If true, Vault automatically attempts to unlock the admin managed LDAP account\nafter every successful static-role password rotation. Applies to all static roles on this mount\nunless overridden at the role level. Defaults to false. Active Directory schema only.\nRequires Vault 2.2.0+.\n" }, "binddn": { "type": "string", "description": "Distinguished name of object to bind when performing user and group search.\n" }, "bindpass": { "type": "string", "description": "Password to use along with binddn when performing user search. Conflicts with \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e.\nExactly one of \u003cspan pulumi-lang-nodejs=\"`bindpass`\" pulumi-lang-dotnet=\"`Bindpass`\" pulumi-lang-go=\"`bindpass`\" pulumi-lang-python=\"`bindpass`\" pulumi-lang-yaml=\"`bindpass`\" pulumi-lang-java=\"`bindpass`\" pulumi-lang-hcl=\"`bindpass`\"\u003e`bindpass`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e must be provided.\n", "secret": true }, "bindpassWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only LDAP password for searching for the user DN.", "secret": true }, "bindpassWoVersion": { "type": "integer", "description": "Version counter for write-only bind password.\nRequired when using \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e. For more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be\nx509 PEM encoded.\n" }, "clientTlsCert": { "type": "string", "description": "Client certificate to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "clientTlsKey": { "type": "string", "description": "Client certificate key to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "connectionTimeout": { "type": "integer", "description": "Timeout, in seconds, when attempting to connect to the LDAP server before trying\nthe next URL in the configuration.\n" }, "credentialType": { "type": "string", "description": "The type of credential to generate. Valid values include \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`phrase`\" pulumi-lang-dotnet=\"`Phrase`\" pulumi-lang-go=\"`phrase`\" pulumi-lang-python=\"`phrase`\" pulumi-lang-yaml=\"`phrase`\" pulumi-lang-java=\"`phrase`\" pulumi-lang-hcl=\"`phrase`\"\u003e`phrase`\u003c/span\u003e. Default is \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates." }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "insecureTls": { "type": "boolean", "description": "Skip LDAP server SSL Certificate verification. This is not recommended for production.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords.\n" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "requestTimeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server\nbefore returning back an error.\n" }, "rotateOnRead": { "type": "boolean", "description": "If true, static role credentials are rotated on each read. Acts as\nthe default for all static roles that do not provide their own override. Requires Vault Enterprise 2.2.0+.\n" }, "rotateOnReadCooldown": { "type": "integer", "description": "Minimum number of seconds between rotate-on-read rotations.\nActs as the default cooldown for all static roles that do not provide their own override.\nRequires Vault Enterprise 2.2.0+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "schema": { "type": "string", "description": "The LDAP schema to use when storing entry passwords. Valid schemas include \u003cspan pulumi-lang-nodejs=\"`openldap`\" pulumi-lang-dotnet=\"`Openldap`\" pulumi-lang-go=\"`openldap`\" pulumi-lang-python=\"`openldap`\" pulumi-lang-yaml=\"`openldap`\" pulumi-lang-java=\"`openldap`\" pulumi-lang-hcl=\"`openldap`\"\u003e`openldap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ad`\" pulumi-lang-dotnet=\"`Ad`\" pulumi-lang-go=\"`ad`\" pulumi-lang-python=\"`ad`\" pulumi-lang-yaml=\"`ad`\" pulumi-lang-java=\"`ad`\" pulumi-lang-hcl=\"`ad`\"\u003e`ad`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`racf`\" pulumi-lang-dotnet=\"`Racf`\" pulumi-lang-go=\"`racf`\" pulumi-lang-python=\"`racf`\" pulumi-lang-yaml=\"`racf`\" pulumi-lang-java=\"`racf`\" pulumi-lang-hcl=\"`racf`\"\u003e`racf`\u003c/span\u003e. Default is \u003cspan pulumi-lang-nodejs=\"`openldap`\" pulumi-lang-dotnet=\"`Openldap`\" pulumi-lang-go=\"`openldap`\" pulumi-lang-python=\"`openldap`\" pulumi-lang-yaml=\"`openldap`\" pulumi-lang-java=\"`openldap`\" pulumi-lang-hcl=\"`openldap`\"\u003e`openldap`\u003c/span\u003e.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "selfManaged": { "type": "boolean", "description": "If true, Vault performs rotations by authenticating as this account\nusing its current password (no privileged bind DN). Immutable after creation. Enforces \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e\nrequirement when creating static roles. Requires Vault Enterprise 2.0+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "If set to true, static roles will not be rotated during import.\nDefaults to false. Requires Vault 1.16 or above.\n" }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing unencrypted connection.\n" }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain.\n" }, "url": { "type": "string", "description": "LDAP URL to connect to. Multiple URLs can be specified by concatenating\nthem with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.\n" }, "userattr": { "type": "string", "description": "Attribute used when searching users. Defaults to \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e.\n" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.\n" } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "autoUnlock", "binddn", "credentialType", "defaultLeaseTtlSeconds", "forceNoCache", "maxLeaseTtlSeconds", "requestTimeout", "rotateOnRead", "rotateOnReadCooldown", "schema", "sealWrap", "selfManaged", "starttls", "upndomain", "url", "userattr" ], "inputProperties": { "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "autoUnlock": { "type": "boolean", "description": "If true, Vault automatically attempts to unlock the admin managed LDAP account\nafter every successful static-role password rotation. Applies to all static roles on this mount\nunless overridden at the role level. Defaults to false. Active Directory schema only.\nRequires Vault 2.2.0+.\n" }, "binddn": { "type": "string", "description": "Distinguished name of object to bind when performing user and group search.\n" }, "bindpass": { "type": "string", "description": "Password to use along with binddn when performing user search. Conflicts with \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e.\nExactly one of \u003cspan pulumi-lang-nodejs=\"`bindpass`\" pulumi-lang-dotnet=\"`Bindpass`\" pulumi-lang-go=\"`bindpass`\" pulumi-lang-python=\"`bindpass`\" pulumi-lang-yaml=\"`bindpass`\" pulumi-lang-java=\"`bindpass`\" pulumi-lang-hcl=\"`bindpass`\"\u003e`bindpass`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e must be provided.\n", "secret": true }, "bindpassWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only LDAP password for searching for the user DN.", "secret": true }, "bindpassWoVersion": { "type": "integer", "description": "Version counter for write-only bind password.\nRequired when using \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e. For more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be\nx509 PEM encoded.\n" }, "clientTlsCert": { "type": "string", "description": "Client certificate to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "clientTlsKey": { "type": "string", "description": "Client certificate key to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "connectionTimeout": { "type": "integer", "description": "Timeout, in seconds, when attempting to connect to the LDAP server before trying\nthe next URL in the configuration.\n" }, "credentialType": { "type": "string", "description": "The type of credential to generate. Valid values include \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`phrase`\" pulumi-lang-dotnet=\"`Phrase`\" pulumi-lang-go=\"`phrase`\" pulumi-lang-python=\"`phrase`\" pulumi-lang-yaml=\"`phrase`\" pulumi-lang-java=\"`phrase`\" pulumi-lang-hcl=\"`phrase`\"\u003e`phrase`\u003c/span\u003e. Default is \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates." }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "insecureTls": { "type": "boolean", "description": "Skip LDAP server SSL Certificate verification. This is not recommended for production.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords.\n" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "requestTimeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server\nbefore returning back an error.\n" }, "rotateOnRead": { "type": "boolean", "description": "If true, static role credentials are rotated on each read. Acts as\nthe default for all static roles that do not provide their own override. Requires Vault Enterprise 2.2.0+.\n" }, "rotateOnReadCooldown": { "type": "integer", "description": "Minimum number of seconds between rotate-on-read rotations.\nActs as the default cooldown for all static roles that do not provide their own override.\nRequires Vault Enterprise 2.2.0+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "schema": { "type": "string", "description": "The LDAP schema to use when storing entry passwords. Valid schemas include \u003cspan pulumi-lang-nodejs=\"`openldap`\" pulumi-lang-dotnet=\"`Openldap`\" pulumi-lang-go=\"`openldap`\" pulumi-lang-python=\"`openldap`\" pulumi-lang-yaml=\"`openldap`\" pulumi-lang-java=\"`openldap`\" pulumi-lang-hcl=\"`openldap`\"\u003e`openldap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ad`\" pulumi-lang-dotnet=\"`Ad`\" pulumi-lang-go=\"`ad`\" pulumi-lang-python=\"`ad`\" pulumi-lang-yaml=\"`ad`\" pulumi-lang-java=\"`ad`\" pulumi-lang-hcl=\"`ad`\"\u003e`ad`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`racf`\" pulumi-lang-dotnet=\"`Racf`\" pulumi-lang-go=\"`racf`\" pulumi-lang-python=\"`racf`\" pulumi-lang-yaml=\"`racf`\" pulumi-lang-java=\"`racf`\" pulumi-lang-hcl=\"`racf`\"\u003e`racf`\u003c/span\u003e. Default is \u003cspan pulumi-lang-nodejs=\"`openldap`\" pulumi-lang-dotnet=\"`Openldap`\" pulumi-lang-go=\"`openldap`\" pulumi-lang-python=\"`openldap`\" pulumi-lang-yaml=\"`openldap`\" pulumi-lang-java=\"`openldap`\" pulumi-lang-hcl=\"`openldap`\"\u003e`openldap`\u003c/span\u003e.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "selfManaged": { "type": "boolean", "description": "If true, Vault performs rotations by authenticating as this account\nusing its current password (no privileged bind DN). Immutable after creation. Enforces \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e\nrequirement when creating static roles. Requires Vault Enterprise 2.0+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "If set to true, static roles will not be rotated during import.\nDefaults to false. Requires Vault 1.16 or above.\n" }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing unencrypted connection.\n" }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain.\n" }, "url": { "type": "string", "description": "LDAP URL to connect to. Multiple URLs can be specified by concatenating\nthem with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.\n" }, "userattr": { "type": "string", "description": "Attribute used when searching users. Defaults to \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e.\n" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.\n" } }, "requiredInputs": [ "binddn" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "autoUnlock": { "type": "boolean", "description": "If true, Vault automatically attempts to unlock the admin managed LDAP account\nafter every successful static-role password rotation. Applies to all static roles on this mount\nunless overridden at the role level. Defaults to false. Active Directory schema only.\nRequires Vault 2.2.0+.\n" }, "binddn": { "type": "string", "description": "Distinguished name of object to bind when performing user and group search.\n" }, "bindpass": { "type": "string", "description": "Password to use along with binddn when performing user search. Conflicts with \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e.\nExactly one of \u003cspan pulumi-lang-nodejs=\"`bindpass`\" pulumi-lang-dotnet=\"`Bindpass`\" pulumi-lang-go=\"`bindpass`\" pulumi-lang-python=\"`bindpass`\" pulumi-lang-yaml=\"`bindpass`\" pulumi-lang-java=\"`bindpass`\" pulumi-lang-hcl=\"`bindpass`\"\u003e`bindpass`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e must be provided.\n", "secret": true }, "bindpassWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only LDAP password for searching for the user DN.", "secret": true }, "bindpassWoVersion": { "type": "integer", "description": "Version counter for write-only bind password.\nRequired when using \u003cspan pulumi-lang-nodejs=\"`bindpassWo`\" pulumi-lang-dotnet=\"`BindpassWo`\" pulumi-lang-go=\"`bindpassWo`\" pulumi-lang-python=\"`bindpass_wo`\" pulumi-lang-yaml=\"`bindpassWo`\" pulumi-lang-java=\"`bindpassWo`\" pulumi-lang-hcl=\"`bindpass_wo`\"\u003e`bindpassWo`\u003c/span\u003e. For more information about write-only attributes, see\n[using write-only attributes](https://www.terraform.io/docs/providers/vault/guides/using_write_only_attributes).\n" }, "certificate": { "type": "string", "description": "CA certificate to use when verifying LDAP server certificate, must be\nx509 PEM encoded.\n" }, "clientTlsCert": { "type": "string", "description": "Client certificate to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "clientTlsKey": { "type": "string", "description": "Client certificate key to provide to the LDAP server, must be x509 PEM encoded.\n", "secret": true }, "connectionTimeout": { "type": "integer", "description": "Timeout, in seconds, when attempting to connect to the LDAP server before trying\nthe next URL in the configuration.\n" }, "credentialType": { "type": "string", "description": "The type of credential to generate. Valid values include \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`phrase`\" pulumi-lang-dotnet=\"`Phrase`\" pulumi-lang-go=\"`phrase`\" pulumi-lang-python=\"`phrase`\" pulumi-lang-yaml=\"`phrase`\" pulumi-lang-java=\"`phrase`\" pulumi-lang-hcl=\"`phrase`\"\u003e`phrase`\u003c/span\u003e. Default is \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for tokens and secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates." }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "insecureTls": { "type": "boolean", "description": "Skip LDAP server SSL Certificate verification. This is not recommended for production.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for tokens and secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords.\n" }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "requestTimeout": { "type": "integer", "description": "Timeout, in seconds, for the connection when making requests against the server\nbefore returning back an error.\n" }, "rotateOnRead": { "type": "boolean", "description": "If true, static role credentials are rotated on each read. Acts as\nthe default for all static roles that do not provide their own override. Requires Vault Enterprise 2.2.0+.\n" }, "rotateOnReadCooldown": { "type": "integer", "description": "Minimum number of seconds between rotate-on-read rotations.\nActs as the default cooldown for all static roles that do not provide their own override.\nRequires Vault Enterprise 2.2.0+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the root credential.\nA zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled token rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 1.19+.\n" }, "schema": { "type": "string", "description": "The LDAP schema to use when storing entry passwords. Valid schemas include \u003cspan pulumi-lang-nodejs=\"`openldap`\" pulumi-lang-dotnet=\"`Openldap`\" pulumi-lang-go=\"`openldap`\" pulumi-lang-python=\"`openldap`\" pulumi-lang-yaml=\"`openldap`\" pulumi-lang-java=\"`openldap`\" pulumi-lang-hcl=\"`openldap`\"\u003e`openldap`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ad`\" pulumi-lang-dotnet=\"`Ad`\" pulumi-lang-go=\"`ad`\" pulumi-lang-python=\"`ad`\" pulumi-lang-yaml=\"`ad`\" pulumi-lang-java=\"`ad`\" pulumi-lang-hcl=\"`ad`\"\u003e`ad`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`racf`\" pulumi-lang-dotnet=\"`Racf`\" pulumi-lang-go=\"`racf`\" pulumi-lang-python=\"`racf`\" pulumi-lang-yaml=\"`racf`\" pulumi-lang-java=\"`racf`\" pulumi-lang-hcl=\"`racf`\"\u003e`racf`\u003c/span\u003e. Default is \u003cspan pulumi-lang-nodejs=\"`openldap`\" pulumi-lang-dotnet=\"`Openldap`\" pulumi-lang-go=\"`openldap`\" pulumi-lang-python=\"`openldap`\" pulumi-lang-yaml=\"`openldap`\" pulumi-lang-java=\"`openldap`\" pulumi-lang-hcl=\"`openldap`\"\u003e`openldap`\u003c/span\u003e.\n" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "selfManaged": { "type": "boolean", "description": "If true, Vault performs rotations by authenticating as this account\nusing its current password (no privileged bind DN). Immutable after creation. Enforces \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e\nrequirement when creating static roles. Requires Vault Enterprise 2.0+.\n" }, "skipStaticRoleImportRotation": { "type": "boolean", "description": "If set to true, static roles will not be rotated during import.\nDefaults to false. Requires Vault 1.16 or above.\n" }, "starttls": { "type": "boolean", "description": "Issue a StartTLS command after establishing unencrypted connection.\n" }, "upndomain": { "type": "string", "description": "Enables userPrincipalDomain login with [username]@UPNDomain.\n" }, "url": { "type": "string", "description": "LDAP URL to connect to. Multiple URLs can be specified by concatenating\nthem with commas; they will be tried in-order. Defaults to `ldap://127.0.0.1`.\n" }, "userattr": { "type": "string", "description": "Attribute used when searching users. Defaults to \u003cspan pulumi-lang-nodejs=\"`cn`\" pulumi-lang-dotnet=\"`Cn`\" pulumi-lang-go=\"`cn`\" pulumi-lang-python=\"`cn`\" pulumi-lang-yaml=\"`cn`\" pulumi-lang-java=\"`cn`\" pulumi-lang-hcl=\"`cn`\"\u003e`cn`\u003c/span\u003e.\n" }, "userdn": { "type": "string", "description": "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)`.\n" } }, "type": "object" } }, "vault:ldap/secretBackendDynamicRole:SecretBackendDynamicRole": { "description": "Creates a dynamic role for LDAP Secret Backend for Vault.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.ldap.SecretBackend(\"config\", {\n path: \"my-custom-ldap\",\n binddn: \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass: \"SuperSecretPassw0rd\",\n url: \"ldaps://localhost\",\n userdn: \"CN=Users,DC=corp,DC=example,DC=net\",\n});\nconst role = new vault.ldap.SecretBackendDynamicRole(\"role\", {\n mount: config.path,\n roleName: \"alice\",\n creationLdif: `dn: cn={{.Username}},ou=users,dc=learn,dc=example\nobjectClass: person\nobjectClass: top\ncn: learn\nsn: {{ random 20 }}\nmemberOf: cn=dev,ou=groups,dc=learn,dc=example\nuserPassword: {{.Password}}\n`,\n deletionLdif: `dn: cn={{.Username}},ou=users,dc=learn,dc=example\nchangetype: delete\n`,\n rollbackLdif: `dn: cn={{.Username}},ou=users,dc=learn,dc=example\nchangetype: delete\n`,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.ldap.SecretBackend(\"config\",\n path=\"my-custom-ldap\",\n binddn=\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass=\"SuperSecretPassw0rd\",\n url=\"ldaps://localhost\",\n userdn=\"CN=Users,DC=corp,DC=example,DC=net\")\nrole = vault.ldap.SecretBackendDynamicRole(\"role\",\n mount=config.path,\n role_name=\"alice\",\n creation_ldif=\"\"\"dn: cn={{.Username}},ou=users,dc=learn,dc=example\nobjectClass: person\nobjectClass: top\ncn: learn\nsn: {{ random 20 }}\nmemberOf: cn=dev,ou=groups,dc=learn,dc=example\nuserPassword: {{.Password}}\n\"\"\",\n deletion_ldif=\"\"\"dn: cn={{.Username}},ou=users,dc=learn,dc=example\nchangetype: delete\n\"\"\",\n rollback_ldif=\"\"\"dn: cn={{.Username}},ou=users,dc=learn,dc=example\nchangetype: delete\n\"\"\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Ldap.SecretBackend(\"config\", new()\n {\n Path = \"my-custom-ldap\",\n Binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n Bindpass = \"SuperSecretPassw0rd\",\n Url = \"ldaps://localhost\",\n Userdn = \"CN=Users,DC=corp,DC=example,DC=net\",\n });\n\n var role = new Vault.Ldap.SecretBackendDynamicRole(\"role\", new()\n {\n Mount = config.Path,\n RoleName = \"alice\",\n CreationLdif = @\"dn: cn={{.Username}},ou=users,dc=learn,dc=example\nobjectClass: person\nobjectClass: top\ncn: learn\nsn: {{ random 20 }}\nmemberOf: cn=dev,ou=groups,dc=learn,dc=example\nuserPassword: {{.Password}}\n\",\n DeletionLdif = @\"dn: cn={{.Username}},ou=users,dc=learn,dc=example\nchangetype: delete\n\",\n RollbackLdif = @\"dn: cn={{.Username}},ou=users,dc=learn,dc=example\nchangetype: delete\n\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ldap\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tconfig, err := ldap.NewSecretBackend(ctx, \"config\", \u0026ldap.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"my-custom-ldap\"),\n\t\t\tBinddn: pulumi.String(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t\tBindpass: pulumi.String(\"SuperSecretPassw0rd\"),\n\t\t\tUrl: pulumi.String(\"ldaps://localhost\"),\n\t\t\tUserdn: pulumi.String(\"CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = ldap.NewSecretBackendDynamicRole(ctx, \"role\", \u0026ldap.SecretBackendDynamicRoleArgs{\n\t\t\tMount: config.Path,\n\t\t\tRoleName: pulumi.String(\"alice\"),\n\t\t\tCreationLdif: pulumi.String(`dn: cn={{.Username}},ou=users,dc=learn,dc=example\nobjectClass: person\nobjectClass: top\ncn: learn\nsn: {{ random 20 }}\nmemberOf: cn=dev,ou=groups,dc=learn,dc=example\nuserPassword: {{.Password}}\n`),\n\t\t\tDeletionLdif: pulumi.String(\"dn: cn={{.Username}},ou=users,dc=learn,dc=example\\nchangetype: delete\\n\"),\n\t\t\tRollbackLdif: pulumi.String(\"dn: cn={{.Username}},ou=users,dc=learn,dc=example\\nchangetype: delete\\n\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ldap_secretbackend\" \"config\" {\n path = \"my-custom-ldap\"\n binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"\n bindpass = \"SuperSecretPassw0rd\"\n url = \"ldaps://localhost\"\n userdn = \"CN=Users,DC=corp,DC=example,DC=net\"\n}\nresource \"vault_ldap_secretbackenddynamicrole\" \"role\" {\n mount = vault_ldap_secretbackend.config.path\n role_name = \"alice\"\n creation_ldif = \"dn: cn={{.Username}},ou=users,dc=learn,dc=example\\nobjectClass: person\\nobjectClass: top\\ncn: learn\\nsn: {{ random 20 }}\\nmemberOf: cn=dev,ou=groups,dc=learn,dc=example\\nuserPassword: {{.Password}}\\n\"\n deletion_ldif = \"dn: cn={{.Username}},ou=users,dc=learn,dc=example\\nchangetype: delete\\n\"\n rollback_ldif = \"dn: cn={{.Username}},ou=users,dc=learn,dc=example\\nchangetype: delete\\n\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ldap.SecretBackend;\nimport com.pulumi.vault.ldap.SecretBackendArgs;\nimport com.pulumi.vault.ldap.SecretBackendDynamicRole;\nimport com.pulumi.vault.ldap.SecretBackendDynamicRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .path(\"my-custom-ldap\")\n .binddn(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\")\n .bindpass(\"SuperSecretPassw0rd\")\n .url(\"ldaps://localhost\")\n .userdn(\"CN=Users,DC=corp,DC=example,DC=net\")\n .build());\n\n var role = new SecretBackendDynamicRole(\"role\", SecretBackendDynamicRoleArgs.builder()\n .mount(config.path())\n .roleName(\"alice\")\n .creationLdif(\"\"\"\ndn: cn={{.Username}},ou=users,dc=learn,dc=example\nobjectClass: person\nobjectClass: top\ncn: learn\nsn: {{ random 20 }}\nmemberOf: cn=dev,ou=groups,dc=learn,dc=example\nuserPassword: {{.Password}}\n \"\"\")\n .deletionLdif(\"\"\"\ndn: cn={{.Username}},ou=users,dc=learn,dc=example\nchangetype: delete\n \"\"\")\n .rollbackLdif(\"\"\"\ndn: cn={{.Username}},ou=users,dc=learn,dc=example\nchangetype: delete\n \"\"\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:ldap:SecretBackend\n properties:\n path: my-custom-ldap\n binddn: CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\n bindpass: SuperSecretPassw0rd\n url: ldaps://localhost\n userdn: CN=Users,DC=corp,DC=example,DC=net\n role:\n type: vault:ldap:SecretBackendDynamicRole\n properties:\n mount: ${config.path}\n roleName: alice\n creationLdif: |\n dn: cn={{.Username}},ou=users,dc=learn,dc=example\n objectClass: person\n objectClass: top\n cn: learn\n sn: {{ random 20 }}\n memberOf: cn=dev,ou=groups,dc=learn,dc=example\n userPassword: {{.Password}}\n deletionLdif: |\n dn: cn={{.Username}},ou=users,dc=learn,dc=example\n changetype: delete\n rollbackLdif: |\n dn: cn={{.Username}},ou=users,dc=learn,dc=example\n changetype: delete\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nLDAP secret backend dynamic role can be imported using the full path to the role\nof the form: `\u003cmount_path\u003e/dynamic-role/\u003crole_name\u003e` e.g.\n\n```sh\n$ pulumi import vault:ldap/secretBackendDynamicRole:SecretBackendDynamicRole role ldap/role/dynamic-role\n```\n\n", "properties": { "creationLdif": { "type": "string", "description": "A templatized LDIF string used to create a user\naccount. This may contain multiple LDIF entries. The \u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e can also\nbe used to add the user account to an existing group. All LDIF entries are\nperformed in order. If Vault encounters an error while executing the\n\u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e it will stop at the first error and not execute any remaining\nLDIF entries. If an error occurs and \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e is specified, the LDIF\nentries in \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e will be executed. See \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e for more\ndetails. This field may optionally be provided as a base64 encoded string.\n" }, "defaultTtl": { "type": "integer", "description": "Specifies the TTL for the leases associated with this role.\n" }, "deletionLdif": { "type": "string", "description": "A templatized LDIF string used to delete the\nuser account once its TTL has expired. This may contain multiple LDIF\nentries. All LDIF entries are performed in order. If Vault encounters an\nerror while executing an entry in the \u003cspan pulumi-lang-nodejs=\"`deletionLdif`\" pulumi-lang-dotnet=\"`DeletionLdif`\" pulumi-lang-go=\"`deletionLdif`\" pulumi-lang-python=\"`deletion_ldif`\" pulumi-lang-yaml=\"`deletionLdif`\" pulumi-lang-java=\"`deletionLdif`\" pulumi-lang-hcl=\"`deletion_ldif`\"\u003e`deletionLdif`\u003c/span\u003e it will attempt to\ncontinue executing any remaining entries. This field may optionally be\nprovided as a base64 encoded string.\n" }, "maxTtl": { "type": "integer", "description": "Specifies the maximum TTL for the leases associated with this role.\n" }, "mount": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords for this role.\nRequires Vault 2.2.0+.\n" }, "roleName": { "type": "string", "description": "Name of the role.\n" }, "rollbackLdif": { "type": "string", "description": "A templatized LDIF string used to attempt to\nrollback any changes in the event that execution of the \u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e results\nin an error. This may contain multiple LDIF entries. All LDIF entries are\nperformed in order. If Vault encounters an error while executing an entry in\nthe \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e it will attempt to continue executing any remaining\nentries. This field may optionally be provided as a base64 encoded string.\n" }, "usernameTemplate": { "type": "string", "description": "A template used to generate a dynamic\nusername. This will be used to fill in the `.Username` field within the\n\u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e string.\n" } }, "required": [ "creationLdif", "deletionLdif", "roleName" ], "inputProperties": { "creationLdif": { "type": "string", "description": "A templatized LDIF string used to create a user\naccount. This may contain multiple LDIF entries. The \u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e can also\nbe used to add the user account to an existing group. All LDIF entries are\nperformed in order. If Vault encounters an error while executing the\n\u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e it will stop at the first error and not execute any remaining\nLDIF entries. If an error occurs and \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e is specified, the LDIF\nentries in \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e will be executed. See \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e for more\ndetails. This field may optionally be provided as a base64 encoded string.\n" }, "defaultTtl": { "type": "integer", "description": "Specifies the TTL for the leases associated with this role.\n" }, "deletionLdif": { "type": "string", "description": "A templatized LDIF string used to delete the\nuser account once its TTL has expired. This may contain multiple LDIF\nentries. All LDIF entries are performed in order. If Vault encounters an\nerror while executing an entry in the \u003cspan pulumi-lang-nodejs=\"`deletionLdif`\" pulumi-lang-dotnet=\"`DeletionLdif`\" pulumi-lang-go=\"`deletionLdif`\" pulumi-lang-python=\"`deletion_ldif`\" pulumi-lang-yaml=\"`deletionLdif`\" pulumi-lang-java=\"`deletionLdif`\" pulumi-lang-hcl=\"`deletion_ldif`\"\u003e`deletionLdif`\u003c/span\u003e it will attempt to\ncontinue executing any remaining entries. This field may optionally be\nprovided as a base64 encoded string.\n" }, "maxTtl": { "type": "integer", "description": "Specifies the maximum TTL for the leases associated with this role.\n" }, "mount": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords for this role.\nRequires Vault 2.2.0+.\n" }, "roleName": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "rollbackLdif": { "type": "string", "description": "A templatized LDIF string used to attempt to\nrollback any changes in the event that execution of the \u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e results\nin an error. This may contain multiple LDIF entries. All LDIF entries are\nperformed in order. If Vault encounters an error while executing an entry in\nthe \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e it will attempt to continue executing any remaining\nentries. This field may optionally be provided as a base64 encoded string.\n" }, "usernameTemplate": { "type": "string", "description": "A template used to generate a dynamic\nusername. This will be used to fill in the `.Username` field within the\n\u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e string.\n" } }, "requiredInputs": [ "creationLdif", "deletionLdif", "roleName" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendDynamicRole resources.\n", "properties": { "creationLdif": { "type": "string", "description": "A templatized LDIF string used to create a user\naccount. This may contain multiple LDIF entries. The \u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e can also\nbe used to add the user account to an existing group. All LDIF entries are\nperformed in order. If Vault encounters an error while executing the\n\u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e it will stop at the first error and not execute any remaining\nLDIF entries. If an error occurs and \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e is specified, the LDIF\nentries in \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e will be executed. See \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e for more\ndetails. This field may optionally be provided as a base64 encoded string.\n" }, "defaultTtl": { "type": "integer", "description": "Specifies the TTL for the leases associated with this role.\n" }, "deletionLdif": { "type": "string", "description": "A templatized LDIF string used to delete the\nuser account once its TTL has expired. This may contain multiple LDIF\nentries. All LDIF entries are performed in order. If Vault encounters an\nerror while executing an entry in the \u003cspan pulumi-lang-nodejs=\"`deletionLdif`\" pulumi-lang-dotnet=\"`DeletionLdif`\" pulumi-lang-go=\"`deletionLdif`\" pulumi-lang-python=\"`deletion_ldif`\" pulumi-lang-yaml=\"`deletionLdif`\" pulumi-lang-java=\"`deletionLdif`\" pulumi-lang-hcl=\"`deletion_ldif`\"\u003e`deletionLdif`\u003c/span\u003e it will attempt to\ncontinue executing any remaining entries. This field may optionally be\nprovided as a base64 encoded string.\n" }, "maxTtl": { "type": "integer", "description": "Specifies the maximum TTL for the leases associated with this role.\n" }, "mount": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords for this role.\nRequires Vault 2.2.0+.\n" }, "roleName": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "rollbackLdif": { "type": "string", "description": "A templatized LDIF string used to attempt to\nrollback any changes in the event that execution of the \u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e results\nin an error. This may contain multiple LDIF entries. All LDIF entries are\nperformed in order. If Vault encounters an error while executing an entry in\nthe \u003cspan pulumi-lang-nodejs=\"`rollbackLdif`\" pulumi-lang-dotnet=\"`RollbackLdif`\" pulumi-lang-go=\"`rollbackLdif`\" pulumi-lang-python=\"`rollback_ldif`\" pulumi-lang-yaml=\"`rollbackLdif`\" pulumi-lang-java=\"`rollbackLdif`\" pulumi-lang-hcl=\"`rollback_ldif`\"\u003e`rollbackLdif`\u003c/span\u003e it will attempt to continue executing any remaining\nentries. This field may optionally be provided as a base64 encoded string.\n" }, "usernameTemplate": { "type": "string", "description": "A template used to generate a dynamic\nusername. This will be used to fill in the `.Username` field within the\n\u003cspan pulumi-lang-nodejs=\"`creationLdif`\" pulumi-lang-dotnet=\"`CreationLdif`\" pulumi-lang-go=\"`creationLdif`\" pulumi-lang-python=\"`creation_ldif`\" pulumi-lang-yaml=\"`creationLdif`\" pulumi-lang-java=\"`creationLdif`\" pulumi-lang-hcl=\"`creation_ldif`\"\u003e`creationLdif`\u003c/span\u003e string.\n" } }, "type": "object" } }, "vault:ldap/secretBackendLibrarySet:SecretBackendLibrarySet": { "description": "Creates a library on an LDAP Secret Backend for Vault. Libraries create\na pool of existing LDAP service accounts which can be checked out\nby users.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.ldap.SecretBackend(\"config\", {\n path: \"ldap\",\n binddn: \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass: \"SuperSecretPassw0rd\",\n url: \"ldaps://localhost\",\n insecureTls: true,\n userdn: \"CN=Users,DC=corp,DC=example,DC=net\",\n});\nconst qa = new vault.ldap.SecretBackendLibrarySet(\"qa\", {\n mount: config.path,\n name: \"qa\",\n serviceAccountNames: [\n \"Bob\",\n \"Mary\",\n ],\n ttl: 60,\n disableCheckInEnforcement: true,\n maxTtl: 120,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.ldap.SecretBackend(\"config\",\n path=\"ldap\",\n binddn=\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass=\"SuperSecretPassw0rd\",\n url=\"ldaps://localhost\",\n insecure_tls=True,\n userdn=\"CN=Users,DC=corp,DC=example,DC=net\")\nqa = vault.ldap.SecretBackendLibrarySet(\"qa\",\n mount=config.path,\n name=\"qa\",\n service_account_names=[\n \"Bob\",\n \"Mary\",\n ],\n ttl=60,\n disable_check_in_enforcement=True,\n max_ttl=120)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Ldap.SecretBackend(\"config\", new()\n {\n Path = \"ldap\",\n Binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n Bindpass = \"SuperSecretPassw0rd\",\n Url = \"ldaps://localhost\",\n InsecureTls = true,\n Userdn = \"CN=Users,DC=corp,DC=example,DC=net\",\n });\n\n var qa = new Vault.Ldap.SecretBackendLibrarySet(\"qa\", new()\n {\n Mount = config.Path,\n Name = \"qa\",\n ServiceAccountNames = new[]\n {\n \"Bob\",\n \"Mary\",\n },\n Ttl = 60,\n DisableCheckInEnforcement = true,\n MaxTtl = 120,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ldap\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tconfig, err := ldap.NewSecretBackend(ctx, \"config\", \u0026ldap.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"ldap\"),\n\t\t\tBinddn: pulumi.String(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t\tBindpass: pulumi.String(\"SuperSecretPassw0rd\"),\n\t\t\tUrl: pulumi.String(\"ldaps://localhost\"),\n\t\t\tInsecureTls: pulumi.Bool(true),\n\t\t\tUserdn: pulumi.String(\"CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = ldap.NewSecretBackendLibrarySet(ctx, \"qa\", \u0026ldap.SecretBackendLibrarySetArgs{\n\t\t\tMount: config.Path,\n\t\t\tName: pulumi.String(\"qa\"),\n\t\t\tServiceAccountNames: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"Bob\"),\n\t\t\t\tpulumi.String(\"Mary\"),\n\t\t\t},\n\t\t\tTtl: pulumi.Int(60),\n\t\t\tDisableCheckInEnforcement: pulumi.Bool(true),\n\t\t\tMaxTtl: pulumi.Int(120),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ldap_secretbackend\" \"config\" {\n path = \"ldap\"\n binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"\n bindpass = \"SuperSecretPassw0rd\"\n url = \"ldaps://localhost\"\n insecure_tls = \"true\"\n userdn = \"CN=Users,DC=corp,DC=example,DC=net\"\n}\nresource \"vault_ldap_secretbackendlibraryset\" \"qa\" {\n mount = vault_ldap_secretbackend.config.path\n name = \"qa\"\n service_account_names = [\"Bob\", \"Mary\"]\n ttl = 60\n disable_check_in_enforcement = true\n max_ttl = 120\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ldap.SecretBackend;\nimport com.pulumi.vault.ldap.SecretBackendArgs;\nimport com.pulumi.vault.ldap.SecretBackendLibrarySet;\nimport com.pulumi.vault.ldap.SecretBackendLibrarySetArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .path(\"ldap\")\n .binddn(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\")\n .bindpass(\"SuperSecretPassw0rd\")\n .url(\"ldaps://localhost\")\n .insecureTls(true)\n .userdn(\"CN=Users,DC=corp,DC=example,DC=net\")\n .build());\n\n var qa = new SecretBackendLibrarySet(\"qa\", SecretBackendLibrarySetArgs.builder()\n .mount(config.path())\n .name(\"qa\")\n .serviceAccountNames( \n \"Bob\",\n \"Mary\")\n .ttl(60)\n .disableCheckInEnforcement(true)\n .maxTtl(120)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:ldap:SecretBackend\n properties:\n path: ldap\n binddn: CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\n bindpass: SuperSecretPassw0rd\n url: ldaps://localhost\n insecureTls: 'true'\n userdn: CN=Users,DC=corp,DC=example,DC=net\n qa:\n type: vault:ldap:SecretBackendLibrarySet\n properties:\n mount: ${config.path}\n name: qa\n serviceAccountNames:\n - Bob\n - Mary\n ttl: 60\n disableCheckInEnforcement: true\n maxTtl: 120\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nLDAP secret backend libraries can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:ldap/secretBackendLibrarySet:SecretBackendLibrarySet qa ldap/library/bob\n```\n\n", "properties": { "disableCheckInEnforcement": { "type": "boolean", "description": "Disable enforcing that service\naccounts must be checked in by the entity or client token that checked them\nout. Defaults to false.\n" }, "maxTtl": { "type": "integer", "description": "The maximum password time-to-live in seconds. Defaults\nto the configuration\u003cspan pulumi-lang-nodejs=\" maxTtl \" pulumi-lang-dotnet=\" MaxTtl \" pulumi-lang-go=\" maxTtl \" pulumi-lang-python=\" max_ttl \" pulumi-lang-yaml=\" maxTtl \" pulumi-lang-java=\" maxTtl \" pulumi-lang-hcl=\" max_ttl \"\u003e maxTtl \u003c/span\u003eif not provided.\n" }, "mount": { "type": "string", "description": "The path where the LDAP secrets backend is mounted." }, "name": { "type": "string", "description": "The name to identify this set of service accounts.\nMust be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "serviceAccountNames": { "type": "array", "items": { "type": "string" }, "description": "Specifies the slice of service accounts mapped to this set.\n" }, "ttl": { "type": "integer", "description": "The password time-to-live in seconds. Defaults to the configuration\nttl if not provided.\n" } }, "required": [ "maxTtl", "name", "serviceAccountNames", "ttl" ], "inputProperties": { "disableCheckInEnforcement": { "type": "boolean", "description": "Disable enforcing that service\naccounts must be checked in by the entity or client token that checked them\nout. Defaults to false.\n" }, "maxTtl": { "type": "integer", "description": "The maximum password time-to-live in seconds. Defaults\nto the configuration\u003cspan pulumi-lang-nodejs=\" maxTtl \" pulumi-lang-dotnet=\" MaxTtl \" pulumi-lang-go=\" maxTtl \" pulumi-lang-python=\" max_ttl \" pulumi-lang-yaml=\" maxTtl \" pulumi-lang-java=\" maxTtl \" pulumi-lang-hcl=\" max_ttl \"\u003e maxTtl \u003c/span\u003eif not provided.\n" }, "mount": { "type": "string", "description": "The path where the LDAP secrets backend is mounted." }, "name": { "type": "string", "description": "The name to identify this set of service accounts.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "serviceAccountNames": { "type": "array", "items": { "type": "string" }, "description": "Specifies the slice of service accounts mapped to this set.\n", "willReplaceOnChanges": true }, "ttl": { "type": "integer", "description": "The password time-to-live in seconds. Defaults to the configuration\nttl if not provided.\n" } }, "requiredInputs": [ "serviceAccountNames" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendLibrarySet resources.\n", "properties": { "disableCheckInEnforcement": { "type": "boolean", "description": "Disable enforcing that service\naccounts must be checked in by the entity or client token that checked them\nout. Defaults to false.\n" }, "maxTtl": { "type": "integer", "description": "The maximum password time-to-live in seconds. Defaults\nto the configuration\u003cspan pulumi-lang-nodejs=\" maxTtl \" pulumi-lang-dotnet=\" MaxTtl \" pulumi-lang-go=\" maxTtl \" pulumi-lang-python=\" max_ttl \" pulumi-lang-yaml=\" maxTtl \" pulumi-lang-java=\" maxTtl \" pulumi-lang-hcl=\" max_ttl \"\u003e maxTtl \u003c/span\u003eif not provided.\n" }, "mount": { "type": "string", "description": "The path where the LDAP secrets backend is mounted." }, "name": { "type": "string", "description": "The name to identify this set of service accounts.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "serviceAccountNames": { "type": "array", "items": { "type": "string" }, "description": "Specifies the slice of service accounts mapped to this set.\n", "willReplaceOnChanges": true }, "ttl": { "type": "integer", "description": "The password time-to-live in seconds. Defaults to the configuration\nttl if not provided.\n" } }, "type": "object" } }, "vault:ldap/secretBackendStaticRole:SecretBackendStaticRole": { "description": "Creates a static role for LDAP Secret Backend for Vault.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst config = new vault.ldap.SecretBackend(\"config\", {\n path: \"my-custom-ldap\",\n binddn: \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass: \"SuperSecretPassw0rd\",\n url: \"ldaps://localhost\",\n insecureTls: true,\n userdn: \"CN=Users,DC=corp,DC=example,DC=net\",\n});\nconst role = new vault.ldap.SecretBackendStaticRole(\"role\", {\n mount: config.path,\n username: \"alice\",\n dn: \"cn=alice,ou=Users,DC=corp,DC=example,DC=net\",\n roleName: \"alice\",\n rotationPeriod: 60,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nconfig = vault.ldap.SecretBackend(\"config\",\n path=\"my-custom-ldap\",\n binddn=\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n bindpass=\"SuperSecretPassw0rd\",\n url=\"ldaps://localhost\",\n insecure_tls=True,\n userdn=\"CN=Users,DC=corp,DC=example,DC=net\")\nrole = vault.ldap.SecretBackendStaticRole(\"role\",\n mount=config.path,\n username=\"alice\",\n dn=\"cn=alice,ou=Users,DC=corp,DC=example,DC=net\",\n role_name=\"alice\",\n rotation_period=60)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var config = new Vault.Ldap.SecretBackend(\"config\", new()\n {\n Path = \"my-custom-ldap\",\n Binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\",\n Bindpass = \"SuperSecretPassw0rd\",\n Url = \"ldaps://localhost\",\n InsecureTls = true,\n Userdn = \"CN=Users,DC=corp,DC=example,DC=net\",\n });\n\n var role = new Vault.Ldap.SecretBackendStaticRole(\"role\", new()\n {\n Mount = config.Path,\n Username = \"alice\",\n Dn = \"cn=alice,ou=Users,DC=corp,DC=example,DC=net\",\n RoleName = \"alice\",\n RotationPeriod = 60,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/ldap\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tconfig, err := ldap.NewSecretBackend(ctx, \"config\", \u0026ldap.SecretBackendArgs{\n\t\t\tPath: pulumi.String(\"my-custom-ldap\"),\n\t\t\tBinddn: pulumi.String(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t\tBindpass: pulumi.String(\"SuperSecretPassw0rd\"),\n\t\t\tUrl: pulumi.String(\"ldaps://localhost\"),\n\t\t\tInsecureTls: pulumi.Bool(true),\n\t\t\tUserdn: pulumi.String(\"CN=Users,DC=corp,DC=example,DC=net\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = ldap.NewSecretBackendStaticRole(ctx, \"role\", \u0026ldap.SecretBackendStaticRoleArgs{\n\t\t\tMount: config.Path,\n\t\t\tUsername: pulumi.String(\"alice\"),\n\t\t\tDn: pulumi.String(\"cn=alice,ou=Users,DC=corp,DC=example,DC=net\"),\n\t\t\tRoleName: pulumi.String(\"alice\"),\n\t\t\tRotationPeriod: pulumi.Int(60),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_ldap_secretbackend\" \"config\" {\n path = \"my-custom-ldap\"\n binddn = \"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\"\n bindpass = \"SuperSecretPassw0rd\"\n url = \"ldaps://localhost\"\n insecure_tls = \"true\"\n userdn = \"CN=Users,DC=corp,DC=example,DC=net\"\n}\nresource \"vault_ldap_secretbackendstaticrole\" \"role\" {\n mount = vault_ldap_secretbackend.config.path\n username = \"alice\"\n dn = \"cn=alice,ou=Users,DC=corp,DC=example,DC=net\"\n role_name = \"alice\"\n rotation_period = 60\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.ldap.SecretBackend;\nimport com.pulumi.vault.ldap.SecretBackendArgs;\nimport com.pulumi.vault.ldap.SecretBackendStaticRole;\nimport com.pulumi.vault.ldap.SecretBackendStaticRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .path(\"my-custom-ldap\")\n .binddn(\"CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\")\n .bindpass(\"SuperSecretPassw0rd\")\n .url(\"ldaps://localhost\")\n .insecureTls(true)\n .userdn(\"CN=Users,DC=corp,DC=example,DC=net\")\n .build());\n\n var role = new SecretBackendStaticRole(\"role\", SecretBackendStaticRoleArgs.builder()\n .mount(config.path())\n .username(\"alice\")\n .dn(\"cn=alice,ou=Users,DC=corp,DC=example,DC=net\")\n .roleName(\"alice\")\n .rotationPeriod(60)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n config:\n type: vault:ldap:SecretBackend\n properties:\n path: my-custom-ldap\n binddn: CN=Administrator,CN=Users,DC=corp,DC=example,DC=net\n bindpass: SuperSecretPassw0rd\n url: ldaps://localhost\n insecureTls: 'true'\n userdn: CN=Users,DC=corp,DC=example,DC=net\n role:\n type: vault:ldap:SecretBackendStaticRole\n properties:\n mount: ${config.path}\n username: alice\n dn: cn=alice,ou=Users,DC=corp,DC=example,DC=net\n roleName: alice\n rotationPeriod: 60\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\n* \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e - (Optional) The password for the user. Can be updated.\n **Note**: This property is write-only and will not be read from the API.\n Requires Vault Enterprise 2.0+.\n\n## Import\n\nLDAP secret backend static role can be imported using the full path to the role\nof the form: `\u003cmount_path\u003e/static-role/\u003crole_name\u003e` e.g.\n\n```sh\n$ pulumi import vault:ldap/secretBackendStaticRole:SecretBackendStaticRole role ldap/static-role/example-role\n```\n\n", "properties": { "autoUnlock": { "type": "boolean", "description": "Overrides the mount-level\u003cspan pulumi-lang-nodejs=\" autoUnlock \" pulumi-lang-dotnet=\" AutoUnlock \" pulumi-lang-go=\" autoUnlock \" pulumi-lang-python=\" auto_unlock \" pulumi-lang-yaml=\" autoUnlock \" pulumi-lang-java=\" autoUnlock \" pulumi-lang-hcl=\" auto_unlock \"\u003e autoUnlock \u003c/span\u003esetting for this role.\nWhen true, Vault unlocks the admin managed LDAP account automatically after a successful rotation.\nWhen false, disables automatic unlock for this role even if the mount has \u003cspan pulumi-lang-nodejs=\"`autoUnlock \" pulumi-lang-dotnet=\"`AutoUnlock \" pulumi-lang-go=\"`autoUnlock \" pulumi-lang-python=\"`auto_unlock \" pulumi-lang-yaml=\"`autoUnlock \" pulumi-lang-java=\"`autoUnlock \" pulumi-lang-hcl=\"`auto_unlock \"\u003e`autoUnlock \u003c/span\u003e= true`.\nWhen unset, the role inherits the mount-level setting. Active Directory schema only.\nRequires Vault 2.2.0+.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the static credential until unset. Requires Vault Enterprise 2.0+.\n" }, "dn": { "type": "string", "description": "Distinguished name (DN) of the existing LDAP entry to manage\npassword rotation for. If given, it will take precedence over \u003cspan pulumi-lang-nodejs=\"`username`\" pulumi-lang-dotnet=\"`Username`\" pulumi-lang-go=\"`username`\" pulumi-lang-python=\"`username`\" pulumi-lang-yaml=\"`username`\" pulumi-lang-java=\"`username`\" pulumi-lang-hcl=\"`username`\"\u003e`username`\u003c/span\u003e for the LDAP\nsearch performed during password rotation. Cannot be modified after creation.\n" }, "mount": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords for this role.\nRequires Vault 2.2.0+.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nPassword for the static role. This is required for Vault to manage an existing account and enable rotation.", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e. For more info see updating write-only attributes.\nRequires Vault Enterprise 2.0+.\n" }, "roleName": { "type": "string", "description": "Name of the role.\n" }, "rotateOnRead": { "type": "boolean", "description": "If true, credentials are rotated on each read. When set, this overrides\nthe engine-level \u003cspan pulumi-lang-nodejs=\"`rotateOnRead`\" pulumi-lang-dotnet=\"`RotateOnRead`\" pulumi-lang-go=\"`rotateOnRead`\" pulumi-lang-python=\"`rotate_on_read`\" pulumi-lang-yaml=\"`rotateOnRead`\" pulumi-lang-java=\"`rotateOnRead`\" pulumi-lang-hcl=\"`rotate_on_read`\"\u003e`rotateOnRead`\u003c/span\u003e default. When unset, the role inherits the engine-level value.\nRemoving this attribute after it has been set is not supported without recreating the role.\nRequires Vault Enterprise 2.2.0+.\n" }, "rotateOnReadCooldown": { "type": "integer", "description": "Minimum number of seconds between rotate-on-read rotations\nfor this role. When set, this overrides the engine-level \u003cspan pulumi-lang-nodejs=\"`rotateOnReadCooldown`\" pulumi-lang-dotnet=\"`RotateOnReadCooldown`\" pulumi-lang-go=\"`rotateOnReadCooldown`\" pulumi-lang-python=\"`rotate_on_read_cooldown`\" pulumi-lang-yaml=\"`rotateOnReadCooldown`\" pulumi-lang-java=\"`rotateOnReadCooldown`\" pulumi-lang-hcl=\"`rotate_on_read_cooldown`\"\u003e`rotateOnReadCooldown`\u003c/span\u003e default.\nWhen unset, the role inherits the engine-level value.\nRemoving this attribute after it has been set is not supported without recreating the role.\nRequires Vault Enterprise 2.2.0+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the static credential.\nA zero value tells Vault not to rotate the credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 2.0+.\n" }, "rotationPolicy": { "type": "string", "description": "The rotation policy to use for this credential. Requires Vault Enterprise 2.0+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the static credential. Requires Vault Enterprise 2.0+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 2.0+.\n" }, "skipImportRotation": { "type": "boolean", "description": "Causes vault to skip the initial secret rotation on import. Not applicable to updates.\nRequires Vault 1.16 or above.\n" }, "username": { "type": "string", "description": "The username of the existing LDAP entry to manage password rotation for.\n" } }, "required": [ "autoUnlock", "roleName", "username" ], "inputProperties": { "autoUnlock": { "type": "boolean", "description": "Overrides the mount-level\u003cspan pulumi-lang-nodejs=\" autoUnlock \" pulumi-lang-dotnet=\" AutoUnlock \" pulumi-lang-go=\" autoUnlock \" pulumi-lang-python=\" auto_unlock \" pulumi-lang-yaml=\" autoUnlock \" pulumi-lang-java=\" autoUnlock \" pulumi-lang-hcl=\" auto_unlock \"\u003e autoUnlock \u003c/span\u003esetting for this role.\nWhen true, Vault unlocks the admin managed LDAP account automatically after a successful rotation.\nWhen false, disables automatic unlock for this role even if the mount has \u003cspan pulumi-lang-nodejs=\"`autoUnlock \" pulumi-lang-dotnet=\"`AutoUnlock \" pulumi-lang-go=\"`autoUnlock \" pulumi-lang-python=\"`auto_unlock \" pulumi-lang-yaml=\"`autoUnlock \" pulumi-lang-java=\"`autoUnlock \" pulumi-lang-hcl=\"`auto_unlock \"\u003e`autoUnlock \u003c/span\u003e= true`.\nWhen unset, the role inherits the mount-level setting. Active Directory schema only.\nRequires Vault 2.2.0+.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the static credential until unset. Requires Vault Enterprise 2.0+.\n" }, "dn": { "type": "string", "description": "Distinguished name (DN) of the existing LDAP entry to manage\npassword rotation for. If given, it will take precedence over \u003cspan pulumi-lang-nodejs=\"`username`\" pulumi-lang-dotnet=\"`Username`\" pulumi-lang-go=\"`username`\" pulumi-lang-python=\"`username`\" pulumi-lang-yaml=\"`username`\" pulumi-lang-java=\"`username`\" pulumi-lang-hcl=\"`username`\"\u003e`username`\u003c/span\u003e for the LDAP\nsearch performed during password rotation. Cannot be modified after creation.\n" }, "mount": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords for this role.\nRequires Vault 2.2.0+.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nPassword for the static role. This is required for Vault to manage an existing account and enable rotation.", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e. For more info see updating write-only attributes.\nRequires Vault Enterprise 2.0+.\n" }, "roleName": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "rotateOnRead": { "type": "boolean", "description": "If true, credentials are rotated on each read. When set, this overrides\nthe engine-level \u003cspan pulumi-lang-nodejs=\"`rotateOnRead`\" pulumi-lang-dotnet=\"`RotateOnRead`\" pulumi-lang-go=\"`rotateOnRead`\" pulumi-lang-python=\"`rotate_on_read`\" pulumi-lang-yaml=\"`rotateOnRead`\" pulumi-lang-java=\"`rotateOnRead`\" pulumi-lang-hcl=\"`rotate_on_read`\"\u003e`rotateOnRead`\u003c/span\u003e default. When unset, the role inherits the engine-level value.\nRemoving this attribute after it has been set is not supported without recreating the role.\nRequires Vault Enterprise 2.2.0+.\n" }, "rotateOnReadCooldown": { "type": "integer", "description": "Minimum number of seconds between rotate-on-read rotations\nfor this role. When set, this overrides the engine-level \u003cspan pulumi-lang-nodejs=\"`rotateOnReadCooldown`\" pulumi-lang-dotnet=\"`RotateOnReadCooldown`\" pulumi-lang-go=\"`rotateOnReadCooldown`\" pulumi-lang-python=\"`rotate_on_read_cooldown`\" pulumi-lang-yaml=\"`rotateOnReadCooldown`\" pulumi-lang-java=\"`rotateOnReadCooldown`\" pulumi-lang-hcl=\"`rotate_on_read_cooldown`\"\u003e`rotateOnReadCooldown`\u003c/span\u003e default.\nWhen unset, the role inherits the engine-level value.\nRemoving this attribute after it has been set is not supported without recreating the role.\nRequires Vault Enterprise 2.2.0+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the static credential.\nA zero value tells Vault not to rotate the credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 2.0+.\n" }, "rotationPolicy": { "type": "string", "description": "The rotation policy to use for this credential. Requires Vault Enterprise 2.0+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the static credential. Requires Vault Enterprise 2.0+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 2.0+.\n" }, "skipImportRotation": { "type": "boolean", "description": "Causes vault to skip the initial secret rotation on import. Not applicable to updates.\nRequires Vault 1.16 or above.\n" }, "username": { "type": "string", "description": "The username of the existing LDAP entry to manage password rotation for.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "roleName", "username" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendStaticRole resources.\n", "properties": { "autoUnlock": { "type": "boolean", "description": "Overrides the mount-level\u003cspan pulumi-lang-nodejs=\" autoUnlock \" pulumi-lang-dotnet=\" AutoUnlock \" pulumi-lang-go=\" autoUnlock \" pulumi-lang-python=\" auto_unlock \" pulumi-lang-yaml=\" autoUnlock \" pulumi-lang-java=\" autoUnlock \" pulumi-lang-hcl=\" auto_unlock \"\u003e autoUnlock \u003c/span\u003esetting for this role.\nWhen true, Vault unlocks the admin managed LDAP account automatically after a successful rotation.\nWhen false, disables automatic unlock for this role even if the mount has \u003cspan pulumi-lang-nodejs=\"`autoUnlock \" pulumi-lang-dotnet=\"`AutoUnlock \" pulumi-lang-go=\"`autoUnlock \" pulumi-lang-python=\"`auto_unlock \" pulumi-lang-yaml=\"`autoUnlock \" pulumi-lang-java=\"`autoUnlock \" pulumi-lang-hcl=\"`auto_unlock \"\u003e`autoUnlock \u003c/span\u003e= true`.\nWhen unset, the role inherits the mount-level setting. Active Directory schema only.\nRequires Vault 2.2.0+.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Cancels all upcoming rotations of the static credential until unset. Requires Vault Enterprise 2.0+.\n" }, "dn": { "type": "string", "description": "Distinguished name (DN) of the existing LDAP entry to manage\npassword rotation for. If given, it will take precedence over \u003cspan pulumi-lang-nodejs=\"`username`\" pulumi-lang-dotnet=\"`Username`\" pulumi-lang-go=\"`username`\" pulumi-lang-python=\"`username`\" pulumi-lang-yaml=\"`username`\" pulumi-lang-java=\"`username`\" pulumi-lang-hcl=\"`username`\"\u003e`username`\u003c/span\u003e for the LDAP\nsearch performed during password rotation. Cannot be modified after creation.\n" }, "mount": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`ldap`\" pulumi-lang-dotnet=\"`Ldap`\" pulumi-lang-go=\"`ldap`\" pulumi-lang-python=\"`ldap`\" pulumi-lang-yaml=\"`ldap`\" pulumi-lang-java=\"`ldap`\" pulumi-lang-hcl=\"`ldap`\"\u003e`ldap`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "passwordPolicy": { "type": "string", "description": "Name of the password policy to use to generate passwords for this role.\nRequires Vault 2.2.0+.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nPassword for the static role. This is required for Vault to manage an existing account and enable rotation.", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "The version of the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e. For more info see updating write-only attributes.\nRequires Vault Enterprise 2.0+.\n" }, "roleName": { "type": "string", "description": "Name of the role.\n", "willReplaceOnChanges": true }, "rotateOnRead": { "type": "boolean", "description": "If true, credentials are rotated on each read. When set, this overrides\nthe engine-level \u003cspan pulumi-lang-nodejs=\"`rotateOnRead`\" pulumi-lang-dotnet=\"`RotateOnRead`\" pulumi-lang-go=\"`rotateOnRead`\" pulumi-lang-python=\"`rotate_on_read`\" pulumi-lang-yaml=\"`rotateOnRead`\" pulumi-lang-java=\"`rotateOnRead`\" pulumi-lang-hcl=\"`rotate_on_read`\"\u003e`rotateOnRead`\u003c/span\u003e default. When unset, the role inherits the engine-level value.\nRemoving this attribute after it has been set is not supported without recreating the role.\nRequires Vault Enterprise 2.2.0+.\n" }, "rotateOnReadCooldown": { "type": "integer", "description": "Minimum number of seconds between rotate-on-read rotations\nfor this role. When set, this overrides the engine-level \u003cspan pulumi-lang-nodejs=\"`rotateOnReadCooldown`\" pulumi-lang-dotnet=\"`RotateOnReadCooldown`\" pulumi-lang-go=\"`rotateOnReadCooldown`\" pulumi-lang-python=\"`rotate_on_read_cooldown`\" pulumi-lang-yaml=\"`rotateOnReadCooldown`\" pulumi-lang-java=\"`rotateOnReadCooldown`\" pulumi-lang-hcl=\"`rotate_on_read_cooldown`\"\u003e`rotateOnReadCooldown`\u003c/span\u003e default.\nWhen unset, the role inherits the engine-level value.\nRemoving this attribute after it has been set is not supported without recreating the role.\nRequires Vault Enterprise 2.2.0+.\n" }, "rotationPeriod": { "type": "integer", "description": "The amount of time in seconds Vault should wait before rotating the static credential.\nA zero value tells Vault not to rotate the credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 2.0+.\n" }, "rotationPolicy": { "type": "string", "description": "The rotation policy to use for this credential. Requires Vault Enterprise 2.0+.\n" }, "rotationSchedule": { "type": "string", "description": "The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),\ndefining the schedule on which Vault should rotate the static credential. Requires Vault Enterprise 2.0+.\n" }, "rotationWindow": { "type": "integer", "description": "The maximum amount of time in seconds allowed to complete\na rotation when a scheduled rotation occurs. The default rotation window is\nunbound and the minimum allowable window is \u003cspan pulumi-lang-nodejs=\"`3600`\" pulumi-lang-dotnet=\"`3600`\" pulumi-lang-go=\"`3600`\" pulumi-lang-python=\"`3600`\" pulumi-lang-yaml=\"`3600`\" pulumi-lang-java=\"`3600`\" pulumi-lang-hcl=\"`3600`\"\u003e`3600`\u003c/span\u003e. Requires Vault Enterprise 2.0+.\n" }, "skipImportRotation": { "type": "boolean", "description": "Causes vault to skip the initial secret rotation on import. Not applicable to updates.\nRequires Vault 1.16 or above.\n" }, "username": { "type": "string", "description": "The username of the existing LDAP entry to manage password rotation for.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:managed/keys:Keys": { "description": "A resource that manages the lifecycle of all [Managed Keys](https://www.vaultproject.io/docs/enterprise/managed-keys) in Vault.\n\n**Note** this feature is available only with Vault Enterprise.\n\n## Example Usage\n\n### AWS\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst keys = new vault.managed.Keys(\"keys\", {aws: [\n {\n name: \"aws-key-1\",\n accessKey: awsAccessKey,\n secretKey: awsSecretKey,\n keyBits: \"2048\",\n keyType: \"RSA\",\n kmsKey: \"alias/vault_aws_key_1\",\n },\n {\n name: \"aws-key-2\",\n accessKey: awsAccessKey,\n secretKey: awsSecretKey,\n keyBits: \"4096\",\n keyType: \"RSA\",\n kmsKey: \"alias/vault_aws_key_2\",\n },\n]});\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki\",\n type: \"pki\",\n description: \"Example mount for managed keys\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 36000,\n allowedManagedKeys: [\n keys.aws.apply(aws =\u003e aws?.[0]?.name),\n keys.aws.apply(aws =\u003e aws?.[1]?.name),\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nkeys = vault.managed.Keys(\"keys\", aws=[\n {\n \"name\": \"aws-key-1\",\n \"access_key\": aws_access_key,\n \"secret_key\": aws_secret_key,\n \"key_bits\": \"2048\",\n \"key_type\": \"RSA\",\n \"kms_key\": \"alias/vault_aws_key_1\",\n },\n {\n \"name\": \"aws-key-2\",\n \"access_key\": aws_access_key,\n \"secret_key\": aws_secret_key,\n \"key_bits\": \"4096\",\n \"key_type\": \"RSA\",\n \"kms_key\": \"alias/vault_aws_key_2\",\n },\n])\npki = vault.Mount(\"pki\",\n path=\"pki\",\n type=\"pki\",\n description=\"Example mount for managed keys\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=36000,\n allowed_managed_keys=[\n keys.aws[0].name,\n keys.aws[1].name,\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var keys = new Vault.Managed.Keys(\"keys\", new()\n {\n Aws = new[]\n {\n new Vault.Managed.Inputs.KeysAwArgs\n {\n Name = \"aws-key-1\",\n AccessKey = awsAccessKey,\n SecretKey = awsSecretKey,\n KeyBits = \"2048\",\n KeyType = \"RSA\",\n KmsKey = \"alias/vault_aws_key_1\",\n },\n new Vault.Managed.Inputs.KeysAwArgs\n {\n Name = \"aws-key-2\",\n AccessKey = awsAccessKey,\n SecretKey = awsSecretKey,\n KeyBits = \"4096\",\n KeyType = \"RSA\",\n KmsKey = \"alias/vault_aws_key_2\",\n },\n },\n });\n\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki\",\n Type = \"pki\",\n Description = \"Example mount for managed keys\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 36000,\n AllowedManagedKeys = new[]\n {\n keys.Aws.Apply(aws =\u003e aws[0]?.Name),\n keys.Aws.Apply(aws =\u003e aws[1]?.Name),\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/managed\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkeys, err := managed.NewKeys(ctx, \"keys\", \u0026managed.KeysArgs{\n\t\t\tAws: managed.KeysAwArray{\n\t\t\t\t\u0026managed.KeysAwArgs{\n\t\t\t\t\tName: pulumi.String(\"aws-key-1\"),\n\t\t\t\t\tAccessKey: pulumi.Any(awsAccessKey),\n\t\t\t\t\tSecretKey: pulumi.Any(awsSecretKey),\n\t\t\t\t\tKeyBits: pulumi.String(\"2048\"),\n\t\t\t\t\tKeyType: pulumi.String(\"RSA\"),\n\t\t\t\t\tKmsKey: pulumi.String(\"alias/vault_aws_key_1\"),\n\t\t\t\t},\n\t\t\t\t\u0026managed.KeysAwArgs{\n\t\t\t\t\tName: pulumi.String(\"aws-key-2\"),\n\t\t\t\t\tAccessKey: pulumi.Any(awsAccessKey),\n\t\t\t\t\tSecretKey: pulumi.Any(awsSecretKey),\n\t\t\t\t\tKeyBits: pulumi.String(\"4096\"),\n\t\t\t\t\tKeyType: pulumi.String(\"RSA\"),\n\t\t\t\t\tKmsKey: pulumi.String(\"alias/vault_aws_key_2\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"Example mount for managed keys\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(36000),\n\t\t\tAllowedManagedKeys: pulumi.StringArray{\n\t\t\t\tkeys.Aws.ApplyT(func(aws []managed.KeysAw) (*string, error) {\n\t\t\t\t\treturn aws[0].Name, nil\n\t\t\t\t}).(pulumi.StringPtrOutput),\n\t\t\t\tkeys.Aws.ApplyT(func(aws []managed.KeysAw) (*string, error) {\n\t\t\t\t\treturn aws[1].Name, nil\n\t\t\t\t}).(pulumi.StringPtrOutput),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_managed_keys\" \"keys\" {\n aws {\n name = \"aws-key-1\"\n access_key = awsAccessKey\n secret_key = awsSecretKey\n key_bits = \"2048\"\n key_type = \"RSA\"\n kms_key = \"alias/vault_aws_key_1\"\n }\n aws {\n name = \"aws-key-2\"\n access_key = awsAccessKey\n secret_key = awsSecretKey\n key_bits = \"4096\"\n key_type = \"RSA\"\n kms_key = \"alias/vault_aws_key_2\"\n }\n}\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n description = \"Example mount for managed keys\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 36000\n allowed_managed_keys = [vault_managed_keys.keys.aws[0].name, vault_managed_keys.keys.aws[1].name]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.managed.Keys;\nimport com.pulumi.vault.managed.KeysArgs;\nimport com.pulumi.vault.managed.inputs.KeysAwArgs;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var keys = new Keys(\"keys\", KeysArgs.builder()\n .aws( \n KeysAwArgs.builder()\n .name(\"aws-key-1\")\n .accessKey(awsAccessKey)\n .secretKey(awsSecretKey)\n .keyBits(\"2048\")\n .keyType(\"RSA\")\n .kmsKey(\"alias/vault_aws_key_1\")\n .build(),\n KeysAwArgs.builder()\n .name(\"aws-key-2\")\n .accessKey(awsAccessKey)\n .secretKey(awsSecretKey)\n .keyBits(\"4096\")\n .keyType(\"RSA\")\n .kmsKey(\"alias/vault_aws_key_2\")\n .build())\n .build());\n\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki\")\n .type(\"pki\")\n .description(\"Example mount for managed keys\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(36000)\n .allowedManagedKeys( \n keys.aws().applyValue(_aws -\u003e _aws[0].name()),\n keys.aws().applyValue(_aws -\u003e _aws[1].name()))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n keys:\n type: vault:managed:Keys\n properties:\n aws:\n - name: aws-key-1\n accessKey: ${awsAccessKey}\n secretKey: ${awsSecretKey}\n keyBits: '2048'\n keyType: RSA\n kmsKey: alias/vault_aws_key_1\n - name: aws-key-2\n accessKey: ${awsAccessKey}\n secretKey: ${awsSecretKey}\n keyBits: '4096'\n keyType: RSA\n kmsKey: alias/vault_aws_key_2\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n description: Example mount for managed keys\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 36000\n allowedManagedKeys:\n - ${keys.aws[0].name}\n - ${keys.aws[1].name}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### GCP Cloud KMS\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpKeys = new vault.managed.Keys(\"gcp_keys\", {gcps: [{\n name: \"gcp-key-1\",\n credentials: std.file({\n input: \"sa-credentials.json\",\n }).then(invoke =\u003e invoke.result),\n project: gcpProject,\n region: \"us-east1\",\n keyRing: \"vault-keyring\",\n cryptoKey: \"vault-key\",\n algorithm: \"rsa_sign_pkcs1_2048_sha256\",\n}]});\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki\",\n type: \"pki\",\n description: \"Example PKI mount using GCP Cloud KMS managed key\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 36000,\n allowedManagedKeys: [gcpKeys.gcps.apply(gcps =\u003e gcps?.[0]?.name)],\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp_keys = vault.managed.Keys(\"gcp_keys\", gcps=[{\n \"name\": \"gcp-key-1\",\n \"credentials\": std.file(input=\"sa-credentials.json\").result,\n \"project\": gcp_project,\n \"region\": \"us-east1\",\n \"key_ring\": \"vault-keyring\",\n \"crypto_key\": \"vault-key\",\n \"algorithm\": \"rsa_sign_pkcs1_2048_sha256\",\n}])\npki = vault.Mount(\"pki\",\n path=\"pki\",\n type=\"pki\",\n description=\"Example PKI mount using GCP Cloud KMS managed key\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=36000,\n allowed_managed_keys=[gcp_keys.gcps[0].name])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpKeys = new Vault.Managed.Keys(\"gcp_keys\", new()\n {\n Gcps = new[]\n {\n new Vault.Managed.Inputs.KeysGcpArgs\n {\n Name = \"gcp-key-1\",\n Credentials = Std.File.Invoke(new()\n {\n Input = \"sa-credentials.json\",\n }).Apply(invoke =\u003e invoke.Result),\n Project = gcpProject,\n Region = \"us-east1\",\n KeyRing = \"vault-keyring\",\n CryptoKey = \"vault-key\",\n Algorithm = \"rsa_sign_pkcs1_2048_sha256\",\n },\n },\n });\n\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki\",\n Type = \"pki\",\n Description = \"Example PKI mount using GCP Cloud KMS managed key\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 36000,\n AllowedManagedKeys = new[]\n {\n gcpKeys.Gcps.Apply(gcps =\u003e gcps[0]?.Name),\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/managed\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: \"sa-credentials.json\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tgcpKeys, err := managed.NewKeys(ctx, \"gcp_keys\", \u0026managed.KeysArgs{\n\t\t\tGcps: managed.KeysGcpArray{\n\t\t\t\t\u0026managed.KeysGcpArgs{\n\t\t\t\t\tName: pulumi.String(\"gcp-key-1\"),\n\t\t\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t\t\t\tProject: pulumi.Any(gcpProject),\n\t\t\t\t\tRegion: pulumi.String(\"us-east1\"),\n\t\t\t\t\tKeyRing: pulumi.String(\"vault-keyring\"),\n\t\t\t\t\tCryptoKey: pulumi.String(\"vault-key\"),\n\t\t\t\t\tAlgorithm: pulumi.String(\"rsa_sign_pkcs1_2048_sha256\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"Example PKI mount using GCP Cloud KMS managed key\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(36000),\n\t\t\tAllowedManagedKeys: pulumi.StringArray{\n\t\t\t\tgcpKeys.Gcps.ApplyT(func(gcps []managed.KeysGcp) (*string, error) {\n\t\t\t\t\treturn gcps[0].Name, nil\n\t\t\t\t}).(pulumi.StringPtrOutput),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_managed_keys\" \"gcp_keys\" {\n gcps {\n name = \"gcp-key-1\"\n credentials = file(\"sa-credentials.json\")\n project = gcpProject\n region = \"us-east1\"\n key_ring = \"vault-keyring\"\n crypto_key = \"vault-key\"\n algorithm = \"rsa_sign_pkcs1_2048_sha256\"\n }\n}\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n description = \"Example PKI mount using GCP Cloud KMS managed key\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 36000\n allowed_managed_keys = [vault_managed_keys.gcp_keys.gcps[0].name]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.managed.Keys;\nimport com.pulumi.vault.managed.KeysArgs;\nimport com.pulumi.vault.managed.inputs.KeysGcpArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpKeys = new Keys(\"gcpKeys\", KeysArgs.builder()\n .gcps(KeysGcpArgs.builder()\n .name(\"gcp-key-1\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(\"sa-credentials.json\")\n .build()).result())\n .project(gcpProject)\n .region(\"us-east1\")\n .keyRing(\"vault-keyring\")\n .cryptoKey(\"vault-key\")\n .algorithm(\"rsa_sign_pkcs1_2048_sha256\")\n .build())\n .build());\n\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki\")\n .type(\"pki\")\n .description(\"Example PKI mount using GCP Cloud KMS managed key\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(36000)\n .allowedManagedKeys(gcpKeys.gcps().applyValue(_gcps -\u003e _gcps[0].name()))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpKeys:\n type: vault:managed:Keys\n name: gcp_keys\n properties:\n gcps:\n - name: gcp-key-1\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: sa-credentials.json\n return: result\n project: ${gcpProject}\n region: us-east1\n keyRing: vault-keyring\n cryptoKey: vault-key\n algorithm: rsa_sign_pkcs1_2048_sha256\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n description: Example PKI mount using GCP Cloud KMS managed key\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 36000\n allowedManagedKeys:\n - ${gcpKeys.gcps[0].name}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\n## Caveats\n\nThis single resource handles the lifecycle of _all_ the managed keys that must be created in Vault.\nThere can only be one such resource in the TF state, and if there are already provisioned managed\nkeys in Vault, we recommend using `pulumi import` instead.\n\n## Import\n\nMounts can be imported using the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e of \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:managed/keys:Keys keys default\n```\n\n", "properties": { "aws": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysAw:KeysAw" }, "description": "Configuration block for AWS Managed Keys" }, "azures": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysAzure:KeysAzure" }, "description": "Configuration block for Azure Managed Keys" }, "gcps": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysGcp:KeysGcp" }, "description": "Configuration block for GCP Cloud KMS Managed Keys" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "pkcs": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysPkc:KeysPkc" }, "description": "Configuration block for PKCS Managed Keys" } }, "inputProperties": { "aws": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysAw:KeysAw" }, "description": "Configuration block for AWS Managed Keys" }, "azures": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysAzure:KeysAzure" }, "description": "Configuration block for Azure Managed Keys" }, "gcps": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysGcp:KeysGcp" }, "description": "Configuration block for GCP Cloud KMS Managed Keys" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true }, "pkcs": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysPkc:KeysPkc" }, "description": "Configuration block for PKCS Managed Keys" } }, "stateInputs": { "description": "Input properties used for looking up and filtering Keys resources.\n", "properties": { "aws": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysAw:KeysAw" }, "description": "Configuration block for AWS Managed Keys" }, "azures": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysAzure:KeysAzure" }, "description": "Configuration block for Azure Managed Keys" }, "gcps": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysGcp:KeysGcp" }, "description": "Configuration block for GCP Cloud KMS Managed Keys" }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)", "willReplaceOnChanges": true }, "pkcs": { "type": "array", "items": { "$ref": "#/types/vault:managed/KeysPkc:KeysPkc" }, "description": "Configuration block for PKCS Managed Keys" } }, "type": "object" } }, "vault:mongodbatlas/secretBackend:SecretBackend": { "description": "Creates a MongoDB Atlas Secret Backend for Vault.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n### Basic Configuration (Legacy)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst mongo = new vault.Mount(\"mongo\", {\n path: \"mongodbatlas\",\n type: \"mongodbatlas\",\n description: \"MongoDB Atlas secret engine mount\",\n});\nconst config = new vault.mongodbatlas.SecretBackend(\"config\", {\n mount: mongo.path,\n privateKey: \"privateKey\",\n publicKey: \"publicKey\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nmongo = vault.Mount(\"mongo\",\n path=\"mongodbatlas\",\n type=\"mongodbatlas\",\n description=\"MongoDB Atlas secret engine mount\")\nconfig = vault.mongodbatlas.SecretBackend(\"config\",\n mount=mongo.path,\n private_key=\"privateKey\",\n public_key=\"publicKey\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var mongo = new Vault.Mount(\"mongo\", new()\n {\n Path = \"mongodbatlas\",\n Type = \"mongodbatlas\",\n Description = \"MongoDB Atlas secret engine mount\",\n });\n\n var config = new Vault.MongoDBAtlas.SecretBackend(\"config\", new()\n {\n Mount = mongo.Path,\n PrivateKey = \"privateKey\",\n PublicKey = \"publicKey\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/mongodbatlas\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tmongo, err := vault.NewMount(ctx, \"mongo\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"mongodbatlas\"),\n\t\t\tType: pulumi.String(\"mongodbatlas\"),\n\t\t\tDescription: pulumi.String(\"MongoDB Atlas secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = mongodbatlas.NewSecretBackend(ctx, \"config\", \u0026mongodbatlas.SecretBackendArgs{\n\t\t\tMount: mongo.Path,\n\t\t\tPrivateKey: pulumi.String(\"privateKey\"),\n\t\t\tPublicKey: pulumi.String(\"publicKey\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"mongo\" {\n path = \"mongodbatlas\"\n type = \"mongodbatlas\"\n description = \"MongoDB Atlas secret engine mount\"\n}\nresource \"vault_mongodbatlas_secretbackend\" \"config\" {\n mount = vault_mount.mongo.path\n private_key = \"privateKey\"\n public_key = \"publicKey\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.mongodbatlas.SecretBackend;\nimport com.pulumi.vault.mongodbatlas.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var mongo = new Mount(\"mongo\", MountArgs.builder()\n .path(\"mongodbatlas\")\n .type(\"mongodbatlas\")\n .description(\"MongoDB Atlas secret engine mount\")\n .build());\n\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .mount(mongo.path())\n .privateKey(\"privateKey\")\n .publicKey(\"publicKey\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n mongo:\n type: vault:Mount\n properties:\n path: mongodbatlas\n type: mongodbatlas\n description: MongoDB Atlas secret engine mount\n config:\n type: vault:mongodbatlas:SecretBackend\n properties:\n mount: ${mongo.path}\n privateKey: privateKey\n publicKey: publicKey\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Recommended Configuration (Write-Only Fields)\n\n\u003e **Security Note**: Using write-only fields (\u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e) is recommended as the private key will not be stored in Terraform state.\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst mongo = new vault.Mount(\"mongo\", {\n path: \"mongodbatlas\",\n type: \"mongodbatlas\",\n description: \"MongoDB Atlas secret engine mount\",\n});\nconst config = new vault.mongodbatlas.SecretBackend(\"config\", {\n mount: mongo.path,\n privateKeyWo: \"privateKey\",\n privateKeyWoVersion: 1,\n publicKey: \"publicKey\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nmongo = vault.Mount(\"mongo\",\n path=\"mongodbatlas\",\n type=\"mongodbatlas\",\n description=\"MongoDB Atlas secret engine mount\")\nconfig = vault.mongodbatlas.SecretBackend(\"config\",\n mount=mongo.path,\n private_key_wo=\"privateKey\",\n private_key_wo_version=1,\n public_key=\"publicKey\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var mongo = new Vault.Mount(\"mongo\", new()\n {\n Path = \"mongodbatlas\",\n Type = \"mongodbatlas\",\n Description = \"MongoDB Atlas secret engine mount\",\n });\n\n var config = new Vault.MongoDBAtlas.SecretBackend(\"config\", new()\n {\n Mount = mongo.Path,\n PrivateKeyWo = \"privateKey\",\n PrivateKeyWoVersion = 1,\n PublicKey = \"publicKey\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/mongodbatlas\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tmongo, err := vault.NewMount(ctx, \"mongo\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"mongodbatlas\"),\n\t\t\tType: pulumi.String(\"mongodbatlas\"),\n\t\t\tDescription: pulumi.String(\"MongoDB Atlas secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = mongodbatlas.NewSecretBackend(ctx, \"config\", \u0026mongodbatlas.SecretBackendArgs{\n\t\t\tMount: mongo.Path,\n\t\t\tPrivateKeyWo: pulumi.String(\"privateKey\"),\n\t\t\tPrivateKeyWoVersion: pulumi.Int(1),\n\t\t\tPublicKey: pulumi.String(\"publicKey\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"mongo\" {\n path = \"mongodbatlas\"\n type = \"mongodbatlas\"\n description = \"MongoDB Atlas secret engine mount\"\n}\nresource \"vault_mongodbatlas_secretbackend\" \"config\" {\n mount = vault_mount.mongo.path\n private_key_wo = \"privateKey\"\n private_key_wo_version = 1 # Increment to rotate\n public_key = \"publicKey\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.mongodbatlas.SecretBackend;\nimport com.pulumi.vault.mongodbatlas.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var mongo = new Mount(\"mongo\", MountArgs.builder()\n .path(\"mongodbatlas\")\n .type(\"mongodbatlas\")\n .description(\"MongoDB Atlas secret engine mount\")\n .build());\n\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .mount(mongo.path())\n .privateKeyWo(\"privateKey\")\n .privateKeyWoVersion(1)\n .publicKey(\"publicKey\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n mongo:\n type: vault:Mount\n properties:\n path: mongodbatlas\n type: mongodbatlas\n description: MongoDB Atlas secret engine mount\n config:\n type: vault:mongodbatlas:SecretBackend\n properties:\n mount: ${mongo.path}\n privateKeyWo: privateKey\n privateKeyWoVersion: 1 # Increment to rotate\n publicKey: publicKey\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e - (Optional) Specifies the Private API Key used to authenticate with the MongoDB Atlas API. \n This is a write-only field that is not stored in Terraform state, providing enhanced security.\n Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`privateKey`\" pulumi-lang-dotnet=\"`PrivateKey`\" pulumi-lang-go=\"`privateKey`\" pulumi-lang-python=\"`private_key`\" pulumi-lang-yaml=\"`privateKey`\" pulumi-lang-java=\"`privateKey`\" pulumi-lang-hcl=\"`private_key`\"\u003e`privateKey`\u003c/span\u003e. Must be used with \u003cspan pulumi-lang-nodejs=\"`privateKeyWoVersion`\" pulumi-lang-dotnet=\"`PrivateKeyWoVersion`\" pulumi-lang-go=\"`privateKeyWoVersion`\" pulumi-lang-python=\"`private_key_wo_version`\" pulumi-lang-yaml=\"`privateKeyWoVersion`\" pulumi-lang-java=\"`privateKeyWoVersion`\" pulumi-lang-hcl=\"`private_key_wo_version`\"\u003e`privateKeyWoVersion`\u003c/span\u003e. To rotate the secret, update the value and increment \u003cspan pulumi-lang-nodejs=\"`privateKeyWoVersion`\" pulumi-lang-dotnet=\"`PrivateKeyWoVersion`\" pulumi-lang-go=\"`privateKeyWoVersion`\" pulumi-lang-python=\"`private_key_wo_version`\" pulumi-lang-yaml=\"`privateKeyWoVersion`\" pulumi-lang-java=\"`privateKeyWoVersion`\" pulumi-lang-hcl=\"`private_key_wo_version`\"\u003e`privateKeyWoVersion`\u003c/span\u003e.\n\n## Import\n\nMongoDB Atlas secret backends can be imported using the `${mount}/config`, e.g.\n\n```sh\n$ pulumi import vault:mongodbatlas/secretBackend:SecretBackend config mongodbatlas/config\n```\n\n", "properties": { "mount": { "type": "string", "description": "Path where the MongoDB Atlas Secrets Engine is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Path where MongoDB Atlas configuration is located" }, "privateKey": { "type": "string", "description": "Specifies the Private API Key used to authenticate with the MongoDB Atlas API. Mutually exclusive\nwith \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e. **Note:** This field will be stored in Terraform state. Consider using \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "privateKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe Private Programmatic API Key used to connect with MongoDB Atlas API. This is a write-only field that is not stored in state.", "secret": true }, "privateKeyWoVersion": { "type": "integer", "description": "An incrementing version counter. Increment this value to force an update \nto the private key. Required when using \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e.\n" }, "publicKey": { "type": "string", "description": "Specifies the Public API Key used to authenticate with the MongoDB Atlas API.\n" } }, "required": [ "mount", "path", "publicKey" ], "inputProperties": { "mount": { "type": "string", "description": "Path where the MongoDB Atlas Secrets Engine is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "privateKey": { "type": "string", "description": "Specifies the Private API Key used to authenticate with the MongoDB Atlas API. Mutually exclusive\nwith \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e. **Note:** This field will be stored in Terraform state. Consider using \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "privateKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe Private Programmatic API Key used to connect with MongoDB Atlas API. This is a write-only field that is not stored in state.", "secret": true }, "privateKeyWoVersion": { "type": "integer", "description": "An incrementing version counter. Increment this value to force an update \nto the private key. Required when using \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e.\n" }, "publicKey": { "type": "string", "description": "Specifies the Public API Key used to authenticate with the MongoDB Atlas API.\n" } }, "requiredInputs": [ "mount", "publicKey" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "mount": { "type": "string", "description": "Path where the MongoDB Atlas Secrets Engine is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path where MongoDB Atlas configuration is located" }, "privateKey": { "type": "string", "description": "Specifies the Private API Key used to authenticate with the MongoDB Atlas API. Mutually exclusive\nwith \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e. **Note:** This field will be stored in Terraform state. Consider using \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e instead for enhanced security.\n", "secret": true }, "privateKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe Private Programmatic API Key used to connect with MongoDB Atlas API. This is a write-only field that is not stored in state.", "secret": true }, "privateKeyWoVersion": { "type": "integer", "description": "An incrementing version counter. Increment this value to force an update \nto the private key. Required when using \u003cspan pulumi-lang-nodejs=\"`privateKeyWo`\" pulumi-lang-dotnet=\"`PrivateKeyWo`\" pulumi-lang-go=\"`privateKeyWo`\" pulumi-lang-python=\"`private_key_wo`\" pulumi-lang-yaml=\"`privateKeyWo`\" pulumi-lang-java=\"`privateKeyWo`\" pulumi-lang-hcl=\"`private_key_wo`\"\u003e`privateKeyWo`\u003c/span\u003e.\n" }, "publicKey": { "type": "string", "description": "Specifies the Public API Key used to authenticate with the MongoDB Atlas API.\n" } }, "type": "object" } }, "vault:mongodbatlas/secretRole:SecretRole": { "description": "Creates a role for the MongoDB Atlas Secret Engine for Vault.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst mongo = new vault.Mount(\"mongo\", {\n path: \"%s\",\n type: \"mongodbatlas\",\n description: \"MongoDB Atlas secret engine mount\",\n});\nconst config = new vault.mongodbatlas.SecretBackend(\"config\", {\n mount: mongo.path,\n privateKey: \"privateKey\",\n publicKey: \"publicKey\",\n});\nconst role = new vault.mongodbatlas.SecretRole(\"role\", {\n mount: mongo.path,\n name: \"tf-test-role\",\n organizationId: \"7cf5a45a9ccf6400e60981b7\",\n projectId: \"5cf5a45a9ccf6400e60981b6\",\n roles: [\"ORG_READ_ONLY\"],\n ipAddresses: \"192.168.1.5, 192.168.1.6\",\n cidrBlocks: \"192.168.1.3/35\",\n projectRoles: [\"GROUP_READ_ONLY\"],\n ttl: \"60\",\n maxTtl: \"120\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nmongo = vault.Mount(\"mongo\",\n path=\"%s\",\n type=\"mongodbatlas\",\n description=\"MongoDB Atlas secret engine mount\")\nconfig = vault.mongodbatlas.SecretBackend(\"config\",\n mount=mongo.path,\n private_key=\"privateKey\",\n public_key=\"publicKey\")\nrole = vault.mongodbatlas.SecretRole(\"role\",\n mount=mongo.path,\n name=\"tf-test-role\",\n organization_id=\"7cf5a45a9ccf6400e60981b7\",\n project_id=\"5cf5a45a9ccf6400e60981b6\",\n roles=[\"ORG_READ_ONLY\"],\n ip_addresses=\"192.168.1.5, 192.168.1.6\",\n cidr_blocks=\"192.168.1.3/35\",\n project_roles=[\"GROUP_READ_ONLY\"],\n ttl=\"60\",\n max_ttl=\"120\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var mongo = new Vault.Mount(\"mongo\", new()\n {\n Path = \"%s\",\n Type = \"mongodbatlas\",\n Description = \"MongoDB Atlas secret engine mount\",\n });\n\n var config = new Vault.MongoDBAtlas.SecretBackend(\"config\", new()\n {\n Mount = mongo.Path,\n PrivateKey = \"privateKey\",\n PublicKey = \"publicKey\",\n });\n\n var role = new Vault.MongoDBAtlas.SecretRole(\"role\", new()\n {\n Mount = mongo.Path,\n Name = \"tf-test-role\",\n OrganizationId = \"7cf5a45a9ccf6400e60981b7\",\n ProjectId = \"5cf5a45a9ccf6400e60981b6\",\n Roles = new[]\n {\n \"ORG_READ_ONLY\",\n },\n IpAddresses = \"192.168.1.5, 192.168.1.6\",\n CidrBlocks = \"192.168.1.3/35\",\n ProjectRoles = new[]\n {\n \"GROUP_READ_ONLY\",\n },\n Ttl = \"60\",\n MaxTtl = \"120\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/mongodbatlas\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tmongo, err := vault.NewMount(ctx, \"mongo\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"%s\"),\n\t\t\tType: pulumi.String(\"mongodbatlas\"),\n\t\t\tDescription: pulumi.String(\"MongoDB Atlas secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = mongodbatlas.NewSecretBackend(ctx, \"config\", \u0026mongodbatlas.SecretBackendArgs{\n\t\t\tMount: mongo.Path,\n\t\t\tPrivateKey: pulumi.String(\"privateKey\"),\n\t\t\tPublicKey: pulumi.String(\"publicKey\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = mongodbatlas.NewSecretRole(ctx, \"role\", \u0026mongodbatlas.SecretRoleArgs{\n\t\t\tMount: mongo.Path,\n\t\t\tName: pulumi.String(\"tf-test-role\"),\n\t\t\tOrganizationId: pulumi.String(\"7cf5a45a9ccf6400e60981b7\"),\n\t\t\tProjectId: pulumi.String(\"5cf5a45a9ccf6400e60981b6\"),\n\t\t\tRoles: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"ORG_READ_ONLY\"),\n\t\t\t},\n\t\t\tIpAddresses: pulumi.StringArray(\"192.168.1.5, 192.168.1.6\"),\n\t\t\tCidrBlocks: pulumi.StringArray(\"192.168.1.3/35\"),\n\t\t\tProjectRoles: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"GROUP_READ_ONLY\"),\n\t\t\t},\n\t\t\tTtl: pulumi.String(\"60\"),\n\t\t\tMaxTtl: pulumi.String(\"120\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"mongo\" {\n path = \"%s\"\n type = \"mongodbatlas\"\n description = \"MongoDB Atlas secret engine mount\"\n}\nresource \"vault_mongodbatlas_secretbackend\" \"config\" {\n mount = vault_mount.mongo.path\n private_key = \"privateKey\"\n public_key = \"publicKey\"\n}\nresource \"vault_mongodbatlas_secretrole\" \"role\" {\n mount = vault_mount.mongo.path\n name = \"tf-test-role\"\n organization_id = \"7cf5a45a9ccf6400e60981b7\"\n project_id = \"5cf5a45a9ccf6400e60981b6\"\n roles = [\"ORG_READ_ONLY\"]\n ip_addresses = \"192.168.1.5, 192.168.1.6\"\n cidr_blocks = \"192.168.1.3/35\"\n project_roles = [\"GROUP_READ_ONLY\"]\n ttl = \"60\"\n max_ttl = \"120\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.mongodbatlas.SecretBackend;\nimport com.pulumi.vault.mongodbatlas.SecretBackendArgs;\nimport com.pulumi.vault.mongodbatlas.SecretRole;\nimport com.pulumi.vault.mongodbatlas.SecretRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var mongo = new Mount(\"mongo\", MountArgs.builder()\n .path(\"%s\")\n .type(\"mongodbatlas\")\n .description(\"MongoDB Atlas secret engine mount\")\n .build());\n\n var config = new SecretBackend(\"config\", SecretBackendArgs.builder()\n .mount(mongo.path())\n .privateKey(\"privateKey\")\n .publicKey(\"publicKey\")\n .build());\n\n var role = new SecretRole(\"role\", SecretRoleArgs.builder()\n .mount(mongo.path())\n .name(\"tf-test-role\")\n .organizationId(\"7cf5a45a9ccf6400e60981b7\")\n .projectId(\"5cf5a45a9ccf6400e60981b6\")\n .roles(\"ORG_READ_ONLY\")\n .ipAddresses(\"192.168.1.5, 192.168.1.6\")\n .cidrBlocks(\"192.168.1.3/35\")\n .projectRoles(\"GROUP_READ_ONLY\")\n .ttl(\"60\")\n .maxTtl(\"120\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n mongo:\n type: vault:Mount\n properties:\n path: '%s'\n type: mongodbatlas\n description: MongoDB Atlas secret engine mount\n config:\n type: vault:mongodbatlas:SecretBackend\n properties:\n mount: ${mongo.path}\n privateKey: privateKey\n publicKey: publicKey\n role:\n type: vault:mongodbatlas:SecretRole\n properties:\n mount: ${mongo.path}\n name: tf-test-role\n organizationId: 7cf5a45a9ccf6400e60981b7\n projectId: 5cf5a45a9ccf6400e60981b6\n roles:\n - ORG_READ_ONLY\n ipAddresses: 192.168.1.5, 192.168.1.6\n cidrBlocks: 192.168.1.3/35\n projectRoles:\n - GROUP_READ_ONLY\n ttl: '60'\n maxTtl: '120'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe MongoDB Atlas secret role can be imported using the full path to the role\nof the form: `\u003cmount_path\u003e/roles/\u003crole_name\u003e` e.g.\n\n```sh\n$ pulumi import vault:mongodbatlas/secretRole:SecretRole example mongodbatlas/roles/example-role\n```\n\n", "properties": { "cidrBlocks": { "type": "array", "items": { "type": "string" }, "description": "Whitelist entry in CIDR notation to be added for the API key.\n" }, "ipAddresses": { "type": "array", "items": { "type": "string" }, "description": "IP address to be added to the whitelist for the API key.\n" }, "maxTtl": { "type": "string", "description": "The maximum allowed lifetime of credentials issued using this role.\n" }, "mount": { "type": "string", "description": "Path where the MongoDB Atlas Secrets Engine is mounted.\n" }, "name": { "type": "string", "description": "The name of the role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "organizationId": { "type": "string", "description": "Unique identifier for the organization to which the target API Key belongs. \nRequired if \u003cspan pulumi-lang-nodejs=\"`projectId`\" pulumi-lang-dotnet=\"`ProjectId`\" pulumi-lang-go=\"`projectId`\" pulumi-lang-python=\"`project_id`\" pulumi-lang-yaml=\"`projectId`\" pulumi-lang-java=\"`projectId`\" pulumi-lang-hcl=\"`project_id`\"\u003e`projectId`\u003c/span\u003e is not set.\n" }, "projectId": { "type": "string", "description": "Unique identifier for the project to which the target API Key belongs.\nRequired if \u003cspan pulumi-lang-nodejs=\"`organizationId`\" pulumi-lang-dotnet=\"`OrganizationId`\" pulumi-lang-go=\"`organizationId`\" pulumi-lang-python=\"`organization_id`\" pulumi-lang-yaml=\"`organizationId`\" pulumi-lang-java=\"`organizationId`\" pulumi-lang-hcl=\"`organization_id`\"\u003e`organizationId`\u003c/span\u003e is not set.\n" }, "projectRoles": { "type": "array", "items": { "type": "string" }, "description": "Roles assigned when an org API key is assigned to a project API key. Possible values are `GROUP_CLUSTER_MANAGER`, `GROUP_DATA_ACCESS_ADMIN`, `GROUP_DATA_ACCESS_READ_ONLY`, `GROUP_DATA_ACCESS_READ_WRITE`, `GROUP_OWNER` and `GROUP_READ_ONLY`.\n" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "List of roles that the API Key needs to have. Possible values are `ORG_OWNER`, `ORG_MEMBER`, `ORG_GROUP_CREATOR`, `ORG_BILLING_ADMIN` and `ORG_READ_ONLY`.\n" }, "ttl": { "type": "string", "description": "Duration in seconds after which the issued credential should expire.\n" } }, "required": [ "mount", "name", "roles" ], "inputProperties": { "cidrBlocks": { "type": "array", "items": { "type": "string" }, "description": "Whitelist entry in CIDR notation to be added for the API key.\n" }, "ipAddresses": { "type": "array", "items": { "type": "string" }, "description": "IP address to be added to the whitelist for the API key.\n" }, "maxTtl": { "type": "string", "description": "The maximum allowed lifetime of credentials issued using this role.\n" }, "mount": { "type": "string", "description": "Path where the MongoDB Atlas Secrets Engine is mounted.\n" }, "name": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "organizationId": { "type": "string", "description": "Unique identifier for the organization to which the target API Key belongs. \nRequired if \u003cspan pulumi-lang-nodejs=\"`projectId`\" pulumi-lang-dotnet=\"`ProjectId`\" pulumi-lang-go=\"`projectId`\" pulumi-lang-python=\"`project_id`\" pulumi-lang-yaml=\"`projectId`\" pulumi-lang-java=\"`projectId`\" pulumi-lang-hcl=\"`project_id`\"\u003e`projectId`\u003c/span\u003e is not set.\n" }, "projectId": { "type": "string", "description": "Unique identifier for the project to which the target API Key belongs.\nRequired if \u003cspan pulumi-lang-nodejs=\"`organizationId`\" pulumi-lang-dotnet=\"`OrganizationId`\" pulumi-lang-go=\"`organizationId`\" pulumi-lang-python=\"`organization_id`\" pulumi-lang-yaml=\"`organizationId`\" pulumi-lang-java=\"`organizationId`\" pulumi-lang-hcl=\"`organization_id`\"\u003e`organizationId`\u003c/span\u003e is not set.\n" }, "projectRoles": { "type": "array", "items": { "type": "string" }, "description": "Roles assigned when an org API key is assigned to a project API key. Possible values are `GROUP_CLUSTER_MANAGER`, `GROUP_DATA_ACCESS_ADMIN`, `GROUP_DATA_ACCESS_READ_ONLY`, `GROUP_DATA_ACCESS_READ_WRITE`, `GROUP_OWNER` and `GROUP_READ_ONLY`.\n" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "List of roles that the API Key needs to have. Possible values are `ORG_OWNER`, `ORG_MEMBER`, `ORG_GROUP_CREATOR`, `ORG_BILLING_ADMIN` and `ORG_READ_ONLY`.\n" }, "ttl": { "type": "string", "description": "Duration in seconds after which the issued credential should expire.\n" } }, "requiredInputs": [ "mount", "roles" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretRole resources.\n", "properties": { "cidrBlocks": { "type": "array", "items": { "type": "string" }, "description": "Whitelist entry in CIDR notation to be added for the API key.\n" }, "ipAddresses": { "type": "array", "items": { "type": "string" }, "description": "IP address to be added to the whitelist for the API key.\n" }, "maxTtl": { "type": "string", "description": "The maximum allowed lifetime of credentials issued using this role.\n" }, "mount": { "type": "string", "description": "Path where the MongoDB Atlas Secrets Engine is mounted.\n" }, "name": { "type": "string", "description": "The name of the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "organizationId": { "type": "string", "description": "Unique identifier for the organization to which the target API Key belongs. \nRequired if \u003cspan pulumi-lang-nodejs=\"`projectId`\" pulumi-lang-dotnet=\"`ProjectId`\" pulumi-lang-go=\"`projectId`\" pulumi-lang-python=\"`project_id`\" pulumi-lang-yaml=\"`projectId`\" pulumi-lang-java=\"`projectId`\" pulumi-lang-hcl=\"`project_id`\"\u003e`projectId`\u003c/span\u003e is not set.\n" }, "projectId": { "type": "string", "description": "Unique identifier for the project to which the target API Key belongs.\nRequired if \u003cspan pulumi-lang-nodejs=\"`organizationId`\" pulumi-lang-dotnet=\"`OrganizationId`\" pulumi-lang-go=\"`organizationId`\" pulumi-lang-python=\"`organization_id`\" pulumi-lang-yaml=\"`organizationId`\" pulumi-lang-java=\"`organizationId`\" pulumi-lang-hcl=\"`organization_id`\"\u003e`organizationId`\u003c/span\u003e is not set.\n" }, "projectRoles": { "type": "array", "items": { "type": "string" }, "description": "Roles assigned when an org API key is assigned to a project API key. Possible values are `GROUP_CLUSTER_MANAGER`, `GROUP_DATA_ACCESS_ADMIN`, `GROUP_DATA_ACCESS_READ_ONLY`, `GROUP_DATA_ACCESS_READ_WRITE`, `GROUP_OWNER` and `GROUP_READ_ONLY`.\n" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "List of roles that the API Key needs to have. Possible values are `ORG_OWNER`, `ORG_MEMBER`, `ORG_GROUP_CREATOR`, `ORG_BILLING_ADMIN` and `ORG_READ_ONLY`.\n" }, "ttl": { "type": "string", "description": "Duration in seconds after which the issued credential should expire.\n" } }, "type": "object" } }, "vault:okta/authBackend:AuthBackend": { "description": "Provides a resource for managing an\n[Okta auth backend within Vault](https://www.vaultproject.io/docs/auth/okta.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.okta.AuthBackend(\"example\", {\n description: \"Demonstration of the Terraform Okta auth backend\",\n organization: \"example\",\n token: \"something that should be kept secret\",\n groups: [{\n groupName: \"foo\",\n policies: [\n \"one\",\n \"two\",\n ],\n }],\n users: [{\n username: \"bar\",\n groups: [\"foo\"],\n }],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.okta.AuthBackend(\"example\",\n description=\"Demonstration of the Terraform Okta auth backend\",\n organization=\"example\",\n token=\"something that should be kept secret\",\n groups=[{\n \"group_name\": \"foo\",\n \"policies\": [\n \"one\",\n \"two\",\n ],\n }],\n users=[{\n \"username\": \"bar\",\n \"groups\": [\"foo\"],\n }])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Okta.AuthBackend(\"example\", new()\n {\n Description = \"Demonstration of the Terraform Okta auth backend\",\n Organization = \"example\",\n Token = \"something that should be kept secret\",\n Groups = new[]\n {\n new Vault.Okta.Inputs.AuthBackendGroupArgs\n {\n GroupName = \"foo\",\n Policies = new[]\n {\n \"one\",\n \"two\",\n },\n },\n },\n Users = new[]\n {\n new Vault.Okta.Inputs.AuthBackendUserArgs\n {\n Username = \"bar\",\n Groups = new[]\n {\n \"foo\",\n },\n },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/okta\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := okta.NewAuthBackend(ctx, \"example\", \u0026okta.AuthBackendArgs{\n\t\t\tDescription: pulumi.String(\"Demonstration of the Terraform Okta auth backend\"),\n\t\t\tOrganization: pulumi.String(\"example\"),\n\t\t\tToken: pulumi.String(\"something that should be kept secret\"),\n\t\t\tGroups: okta.AuthBackendGroupTypeArray{\n\t\t\t\t\u0026okta.AuthBackendGroupTypeArgs{\n\t\t\t\t\tGroupName: pulumi.String(\"foo\"),\n\t\t\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\t\t\tpulumi.String(\"one\"),\n\t\t\t\t\t\tpulumi.String(\"two\"),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t\tUsers: okta.AuthBackendUserTypeArray{\n\t\t\t\t\u0026okta.AuthBackendUserTypeArgs{\n\t\t\t\t\tUsername: pulumi.String(\"bar\"),\n\t\t\t\t\tGroups: pulumi.StringArray{\n\t\t\t\t\t\tpulumi.String(\"foo\"),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_okta_authbackend\" \"example\" {\n description = \"Demonstration of the Terraform Okta auth backend\"\n organization = \"example\"\n token = \"something that should be kept secret\"\n groups {\n group_name = \"foo\"\n policies = [\"one\", \"two\"]\n }\n users {\n username = \"bar\"\n groups = [\"foo\"]\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.okta.AuthBackend;\nimport com.pulumi.vault.okta.AuthBackendArgs;\nimport com.pulumi.vault.okta.inputs.AuthBackendGroupArgs;\nimport com.pulumi.vault.okta.inputs.AuthBackendUserArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .description(\"Demonstration of the Terraform Okta auth backend\")\n .organization(\"example\")\n .token(\"something that should be kept secret\")\n .groups(AuthBackendGroupArgs.builder()\n .groupName(\"foo\")\n .policies( \n \"one\",\n \"two\")\n .build())\n .users(AuthBackendUserArgs.builder()\n .username(\"bar\")\n .groups(\"foo\")\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:okta:AuthBackend\n properties:\n description: Demonstration of the Terraform Okta auth backend\n organization: example\n token: something that should be kept secret\n groups:\n - groupName: foo\n policies:\n - one\n - two\n users:\n - username: bar\n groups:\n - foo\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThe following write-only attributes are supported:\n\n* \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e - (Optional) Write-only Okta API token. This is required to query Okta for user group membership.\n Use this for enhanced security when you don't want the token to appear in state files. Requires \u003cspan pulumi-lang-nodejs=\"`apiTokenWoVersion`\" pulumi-lang-dotnet=\"`ApiTokenWoVersion`\" pulumi-lang-go=\"`apiTokenWoVersion`\" pulumi-lang-python=\"`api_token_wo_version`\" pulumi-lang-yaml=\"`apiTokenWoVersion`\" pulumi-lang-java=\"`apiTokenWoVersion`\" pulumi-lang-hcl=\"`api_token_wo_version`\"\u003e`apiTokenWoVersion`\u003c/span\u003e. Conflicts with \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`apiToken`\" pulumi-lang-dotnet=\"`ApiToken`\" pulumi-lang-go=\"`apiToken`\" pulumi-lang-python=\"`api_token`\" pulumi-lang-yaml=\"`apiToken`\" pulumi-lang-java=\"`apiToken`\" pulumi-lang-hcl=\"`api_token`\"\u003e`apiToken`\u003c/span\u003e.\n **Note**: This property is write-only and will not be read from the API.\n\n## Import\n\nOkta authentication backends can be imported using its \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:okta/authBackend:AuthBackend example okta\n```\n\n", "properties": { "accessor": { "type": "string", "description": "The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).\n" }, "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "apiToken": { "type": "string", "description": "The Okta API token. This is required to query Okta for user group membership.\nIf this is not supplied only locally configured groups will be enabled.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\n", "secret": true }, "apiTokenWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only Okta API token. This is required to query Okta for user group membership. If this is not supplied only locally configured groups will be enabled.", "secret": true }, "apiTokenWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\nIncrement this value to trigger an update of the write-only token. Required when using \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\n" }, "baseUrl": { "type": "string", "description": "The Okta url. Examples: oktapreview.com, okta.com\n" }, "bypassOktaMfa": { "type": "boolean", "description": "When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.\n" }, "description": { "type": "string", "description": "The description of the auth backend\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "groups": { "type": "array", "items": { "$ref": "#/types/vault:okta/AuthBackendGroup:AuthBackendGroup" }, "description": "Associate Okta groups with policies within Vault.\nSee below for more details.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "orgName": { "type": "string", "description": "The Okta organization. This will be the first part of the url `https://XXX.okta.com`.\nExactly one of \u003cspan pulumi-lang-nodejs=\"`orgName`\" pulumi-lang-dotnet=\"`OrgName`\" pulumi-lang-go=\"`orgName`\" pulumi-lang-python=\"`org_name`\" pulumi-lang-yaml=\"`orgName`\" pulumi-lang-java=\"`orgName`\" pulumi-lang-hcl=\"`org_name`\"\u003e`orgName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`organization`\" pulumi-lang-dotnet=\"`Organization`\" pulumi-lang-go=\"`organization`\" pulumi-lang-python=\"`organization`\" pulumi-lang-yaml=\"`organization`\" pulumi-lang-java=\"`organization`\" pulumi-lang-hcl=\"`organization`\"\u003e`organization`\u003c/span\u003e must be specified.\n" }, "organization": { "type": "string", "description": "**Deprecated: Use \u003cspan pulumi-lang-nodejs=\"`orgName`\" pulumi-lang-dotnet=\"`OrgName`\" pulumi-lang-go=\"`orgName`\" pulumi-lang-python=\"`org_name`\" pulumi-lang-yaml=\"`orgName`\" pulumi-lang-java=\"`orgName`\" pulumi-lang-hcl=\"`org_name`\"\u003e`orgName`\u003c/span\u003e instead.** The Okta organization. This will be the first part of the url `https://XXX.okta.com`.\nExactly one of \u003cspan pulumi-lang-nodejs=\"`orgName`\" pulumi-lang-dotnet=\"`OrgName`\" pulumi-lang-go=\"`orgName`\" pulumi-lang-python=\"`org_name`\" pulumi-lang-yaml=\"`orgName`\" pulumi-lang-java=\"`orgName`\" pulumi-lang-hcl=\"`org_name`\"\u003e`orgName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`organization`\" pulumi-lang-dotnet=\"`Organization`\" pulumi-lang-go=\"`organization`\" pulumi-lang-python=\"`organization`\" pulumi-lang-yaml=\"`organization`\" pulumi-lang-java=\"`organization`\" pulumi-lang-hcl=\"`organization`\"\u003e`organization`\u003c/span\u003e must be specified.\n", "deprecationMessage": "Use\u003cspan pulumi-lang-nodejs=\" orgName \" pulumi-lang-dotnet=\" OrgName \" pulumi-lang-go=\" orgName \" pulumi-lang-python=\" org_name \" pulumi-lang-yaml=\" orgName \" pulumi-lang-java=\" orgName \" pulumi-lang-hcl=\" org_name \"\u003e orgName \u003c/span\u003einstead" }, "path": { "type": "string", "description": "Path to mount the Okta auth backend. Default to path \u003cspan pulumi-lang-nodejs=\"`okta`\" pulumi-lang-dotnet=\"`Okta`\" pulumi-lang-go=\"`okta`\" pulumi-lang-python=\"`okta`\" pulumi-lang-yaml=\"`okta`\" pulumi-lang-java=\"`okta`\" pulumi-lang-hcl=\"`okta`\"\u003e`okta`\u003c/span\u003e.\n" }, "token": { "type": "string", "description": "**Deprecated: Use \u003cspan pulumi-lang-nodejs=\"`apiToken`\" pulumi-lang-dotnet=\"`ApiToken`\" pulumi-lang-go=\"`apiToken`\" pulumi-lang-python=\"`api_token`\" pulumi-lang-yaml=\"`apiToken`\" pulumi-lang-java=\"`apiToken`\" pulumi-lang-hcl=\"`api_token`\"\u003e`apiToken`\u003c/span\u003e instead.** The Okta API token. This is required to query Okta for user group membership.\nIf this is not supplied only locally configured groups will be enabled.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`apiToken`\" pulumi-lang-dotnet=\"`ApiToken`\" pulumi-lang-go=\"`apiToken`\" pulumi-lang-python=\"`api_token`\" pulumi-lang-yaml=\"`apiToken`\" pulumi-lang-java=\"`apiToken`\" pulumi-lang-hcl=\"`api_token`\"\u003e`apiToken`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\n", "deprecationMessage": "Use\u003cspan pulumi-lang-nodejs=\" apiToken \" pulumi-lang-dotnet=\" ApiToken \" pulumi-lang-go=\" apiToken \" pulumi-lang-python=\" api_token \" pulumi-lang-yaml=\" apiToken \" pulumi-lang-java=\" apiToken \" pulumi-lang-hcl=\" api_token \"\u003e apiToken \u003c/span\u003einstead", "secret": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "tune": { "$ref": "#/types/vault:okta/AuthBackendTune:AuthBackendTune" }, "users": { "type": "array", "items": { "$ref": "#/types/vault:okta/AuthBackendUser:AuthBackendUser" }, "description": "Associate Okta users with groups or policies within Vault.\nSee below for more details.\n" } }, "required": [ "accessor", "groups", "orgName", "organization", "tune", "users" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "apiToken": { "type": "string", "description": "The Okta API token. This is required to query Okta for user group membership.\nIf this is not supplied only locally configured groups will be enabled.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\n", "secret": true }, "apiTokenWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only Okta API token. This is required to query Okta for user group membership. If this is not supplied only locally configured groups will be enabled.", "secret": true }, "apiTokenWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\nIncrement this value to trigger an update of the write-only token. Required when using \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\n" }, "baseUrl": { "type": "string", "description": "The Okta url. Examples: oktapreview.com, okta.com\n" }, "bypassOktaMfa": { "type": "boolean", "description": "When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.\n" }, "description": { "type": "string", "description": "The description of the auth backend\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "groups": { "type": "array", "items": { "$ref": "#/types/vault:okta/AuthBackendGroup:AuthBackendGroup" }, "description": "Associate Okta groups with policies within Vault.\nSee below for more details.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "orgName": { "type": "string", "description": "The Okta organization. This will be the first part of the url `https://XXX.okta.com`.\nExactly one of \u003cspan pulumi-lang-nodejs=\"`orgName`\" pulumi-lang-dotnet=\"`OrgName`\" pulumi-lang-go=\"`orgName`\" pulumi-lang-python=\"`org_name`\" pulumi-lang-yaml=\"`orgName`\" pulumi-lang-java=\"`orgName`\" pulumi-lang-hcl=\"`org_name`\"\u003e`orgName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`organization`\" pulumi-lang-dotnet=\"`Organization`\" pulumi-lang-go=\"`organization`\" pulumi-lang-python=\"`organization`\" pulumi-lang-yaml=\"`organization`\" pulumi-lang-java=\"`organization`\" pulumi-lang-hcl=\"`organization`\"\u003e`organization`\u003c/span\u003e must be specified.\n" }, "organization": { "type": "string", "description": "**Deprecated: Use \u003cspan pulumi-lang-nodejs=\"`orgName`\" pulumi-lang-dotnet=\"`OrgName`\" pulumi-lang-go=\"`orgName`\" pulumi-lang-python=\"`org_name`\" pulumi-lang-yaml=\"`orgName`\" pulumi-lang-java=\"`orgName`\" pulumi-lang-hcl=\"`org_name`\"\u003e`orgName`\u003c/span\u003e instead.** The Okta organization. This will be the first part of the url `https://XXX.okta.com`.\nExactly one of \u003cspan pulumi-lang-nodejs=\"`orgName`\" pulumi-lang-dotnet=\"`OrgName`\" pulumi-lang-go=\"`orgName`\" pulumi-lang-python=\"`org_name`\" pulumi-lang-yaml=\"`orgName`\" pulumi-lang-java=\"`orgName`\" pulumi-lang-hcl=\"`org_name`\"\u003e`orgName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`organization`\" pulumi-lang-dotnet=\"`Organization`\" pulumi-lang-go=\"`organization`\" pulumi-lang-python=\"`organization`\" pulumi-lang-yaml=\"`organization`\" pulumi-lang-java=\"`organization`\" pulumi-lang-hcl=\"`organization`\"\u003e`organization`\u003c/span\u003e must be specified.\n", "deprecationMessage": "Use\u003cspan pulumi-lang-nodejs=\" orgName \" pulumi-lang-dotnet=\" OrgName \" pulumi-lang-go=\" orgName \" pulumi-lang-python=\" org_name \" pulumi-lang-yaml=\" orgName \" pulumi-lang-java=\" orgName \" pulumi-lang-hcl=\" org_name \"\u003e orgName \u003c/span\u003einstead" }, "path": { "type": "string", "description": "Path to mount the Okta auth backend. Default to path \u003cspan pulumi-lang-nodejs=\"`okta`\" pulumi-lang-dotnet=\"`Okta`\" pulumi-lang-go=\"`okta`\" pulumi-lang-python=\"`okta`\" pulumi-lang-yaml=\"`okta`\" pulumi-lang-java=\"`okta`\" pulumi-lang-hcl=\"`okta`\"\u003e`okta`\u003c/span\u003e.\n" }, "token": { "type": "string", "description": "**Deprecated: Use \u003cspan pulumi-lang-nodejs=\"`apiToken`\" pulumi-lang-dotnet=\"`ApiToken`\" pulumi-lang-go=\"`apiToken`\" pulumi-lang-python=\"`api_token`\" pulumi-lang-yaml=\"`apiToken`\" pulumi-lang-java=\"`apiToken`\" pulumi-lang-hcl=\"`api_token`\"\u003e`apiToken`\u003c/span\u003e instead.** The Okta API token. This is required to query Okta for user group membership.\nIf this is not supplied only locally configured groups will be enabled.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`apiToken`\" pulumi-lang-dotnet=\"`ApiToken`\" pulumi-lang-go=\"`apiToken`\" pulumi-lang-python=\"`api_token`\" pulumi-lang-yaml=\"`apiToken`\" pulumi-lang-java=\"`apiToken`\" pulumi-lang-hcl=\"`api_token`\"\u003e`apiToken`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\n", "deprecationMessage": "Use\u003cspan pulumi-lang-nodejs=\" apiToken \" pulumi-lang-dotnet=\" ApiToken \" pulumi-lang-go=\" apiToken \" pulumi-lang-python=\" api_token \" pulumi-lang-yaml=\" apiToken \" pulumi-lang-java=\" apiToken \" pulumi-lang-hcl=\" api_token \"\u003e apiToken \u003c/span\u003einstead", "secret": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "tune": { "$ref": "#/types/vault:okta/AuthBackendTune:AuthBackendTune" }, "users": { "type": "array", "items": { "$ref": "#/types/vault:okta/AuthBackendUser:AuthBackendUser" }, "description": "Associate Okta users with groups or policies within Vault.\nSee below for more details.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).\n" }, "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "apiToken": { "type": "string", "description": "The Okta API token. This is required to query Okta for user group membership.\nIf this is not supplied only locally configured groups will be enabled.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`token`\" pulumi-lang-dotnet=\"`Token`\" pulumi-lang-go=\"`token`\" pulumi-lang-python=\"`token`\" pulumi-lang-yaml=\"`token`\" pulumi-lang-java=\"`token`\" pulumi-lang-hcl=\"`token`\"\u003e`token`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\n", "secret": true }, "apiTokenWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nWrite-only Okta API token. This is required to query Okta for user group membership. If this is not supplied only locally configured groups will be enabled.", "secret": true }, "apiTokenWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\nIncrement this value to trigger an update of the write-only token. Required when using \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\n" }, "baseUrl": { "type": "string", "description": "The Okta url. Examples: oktapreview.com, okta.com\n" }, "bypassOktaMfa": { "type": "boolean", "description": "When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.\n" }, "description": { "type": "string", "description": "The description of the auth backend\n" }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "groups": { "type": "array", "items": { "$ref": "#/types/vault:okta/AuthBackendGroup:AuthBackendGroup" }, "description": "Associate Okta groups with policies within Vault.\nSee below for more details.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "orgName": { "type": "string", "description": "The Okta organization. This will be the first part of the url `https://XXX.okta.com`.\nExactly one of \u003cspan pulumi-lang-nodejs=\"`orgName`\" pulumi-lang-dotnet=\"`OrgName`\" pulumi-lang-go=\"`orgName`\" pulumi-lang-python=\"`org_name`\" pulumi-lang-yaml=\"`orgName`\" pulumi-lang-java=\"`orgName`\" pulumi-lang-hcl=\"`org_name`\"\u003e`orgName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`organization`\" pulumi-lang-dotnet=\"`Organization`\" pulumi-lang-go=\"`organization`\" pulumi-lang-python=\"`organization`\" pulumi-lang-yaml=\"`organization`\" pulumi-lang-java=\"`organization`\" pulumi-lang-hcl=\"`organization`\"\u003e`organization`\u003c/span\u003e must be specified.\n" }, "organization": { "type": "string", "description": "**Deprecated: Use \u003cspan pulumi-lang-nodejs=\"`orgName`\" pulumi-lang-dotnet=\"`OrgName`\" pulumi-lang-go=\"`orgName`\" pulumi-lang-python=\"`org_name`\" pulumi-lang-yaml=\"`orgName`\" pulumi-lang-java=\"`orgName`\" pulumi-lang-hcl=\"`org_name`\"\u003e`orgName`\u003c/span\u003e instead.** The Okta organization. This will be the first part of the url `https://XXX.okta.com`.\nExactly one of \u003cspan pulumi-lang-nodejs=\"`orgName`\" pulumi-lang-dotnet=\"`OrgName`\" pulumi-lang-go=\"`orgName`\" pulumi-lang-python=\"`org_name`\" pulumi-lang-yaml=\"`orgName`\" pulumi-lang-java=\"`orgName`\" pulumi-lang-hcl=\"`org_name`\"\u003e`orgName`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`organization`\" pulumi-lang-dotnet=\"`Organization`\" pulumi-lang-go=\"`organization`\" pulumi-lang-python=\"`organization`\" pulumi-lang-yaml=\"`organization`\" pulumi-lang-java=\"`organization`\" pulumi-lang-hcl=\"`organization`\"\u003e`organization`\u003c/span\u003e must be specified.\n", "deprecationMessage": "Use\u003cspan pulumi-lang-nodejs=\" orgName \" pulumi-lang-dotnet=\" OrgName \" pulumi-lang-go=\" orgName \" pulumi-lang-python=\" org_name \" pulumi-lang-yaml=\" orgName \" pulumi-lang-java=\" orgName \" pulumi-lang-hcl=\" org_name \"\u003e orgName \u003c/span\u003einstead" }, "path": { "type": "string", "description": "Path to mount the Okta auth backend. Default to path \u003cspan pulumi-lang-nodejs=\"`okta`\" pulumi-lang-dotnet=\"`Okta`\" pulumi-lang-go=\"`okta`\" pulumi-lang-python=\"`okta`\" pulumi-lang-yaml=\"`okta`\" pulumi-lang-java=\"`okta`\" pulumi-lang-hcl=\"`okta`\"\u003e`okta`\u003c/span\u003e.\n" }, "token": { "type": "string", "description": "**Deprecated: Use \u003cspan pulumi-lang-nodejs=\"`apiToken`\" pulumi-lang-dotnet=\"`ApiToken`\" pulumi-lang-go=\"`apiToken`\" pulumi-lang-python=\"`api_token`\" pulumi-lang-yaml=\"`apiToken`\" pulumi-lang-java=\"`apiToken`\" pulumi-lang-hcl=\"`api_token`\"\u003e`apiToken`\u003c/span\u003e instead.** The Okta API token. This is required to query Okta for user group membership.\nIf this is not supplied only locally configured groups will be enabled.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`apiToken`\" pulumi-lang-dotnet=\"`ApiToken`\" pulumi-lang-go=\"`apiToken`\" pulumi-lang-python=\"`api_token`\" pulumi-lang-yaml=\"`apiToken`\" pulumi-lang-java=\"`apiToken`\" pulumi-lang-hcl=\"`api_token`\"\u003e`apiToken`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`apiTokenWo`\" pulumi-lang-dotnet=\"`ApiTokenWo`\" pulumi-lang-go=\"`apiTokenWo`\" pulumi-lang-python=\"`api_token_wo`\" pulumi-lang-yaml=\"`apiTokenWo`\" pulumi-lang-java=\"`apiTokenWo`\" pulumi-lang-hcl=\"`api_token_wo`\"\u003e`apiTokenWo`\u003c/span\u003e.\n", "deprecationMessage": "Use\u003cspan pulumi-lang-nodejs=\" apiToken \" pulumi-lang-dotnet=\" ApiToken \" pulumi-lang-go=\" apiToken \" pulumi-lang-python=\" api_token \" pulumi-lang-yaml=\" apiToken \" pulumi-lang-java=\" apiToken \" pulumi-lang-hcl=\" api_token \"\u003e apiToken \u003c/span\u003einstead", "secret": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "tune": { "$ref": "#/types/vault:okta/AuthBackendTune:AuthBackendTune" }, "users": { "type": "array", "items": { "$ref": "#/types/vault:okta/AuthBackendUser:AuthBackendUser" }, "description": "Associate Okta users with groups or policies within Vault.\nSee below for more details.\n" } }, "type": "object" } }, "vault:okta/authBackendGroup:AuthBackendGroup": { "description": "Provides a resource to create a group in an\n[Okta auth backend within Vault](https://www.vaultproject.io/docs/auth/okta.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.okta.AuthBackend(\"example\", {\n path: \"group_okta\",\n organization: \"dummy\",\n});\nconst foo = new vault.okta.AuthBackendGroup(\"foo\", {\n path: example.path,\n groupName: \"foo\",\n policies: [\n \"one\",\n \"two\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.okta.AuthBackend(\"example\",\n path=\"group_okta\",\n organization=\"dummy\")\nfoo = vault.okta.AuthBackendGroup(\"foo\",\n path=example.path,\n group_name=\"foo\",\n policies=[\n \"one\",\n \"two\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Okta.AuthBackend(\"example\", new()\n {\n Path = \"group_okta\",\n Organization = \"dummy\",\n });\n\n var foo = new Vault.Okta.AuthBackendGroup(\"foo\", new()\n {\n Path = example.Path,\n GroupName = \"foo\",\n Policies = new[]\n {\n \"one\",\n \"two\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/okta\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := okta.NewAuthBackend(ctx, \"example\", \u0026okta.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"group_okta\"),\n\t\t\tOrganization: pulumi.String(\"dummy\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = okta.NewAuthBackendGroup(ctx, \"foo\", \u0026okta.AuthBackendGroupArgs{\n\t\t\tPath: example.Path,\n\t\t\tGroupName: pulumi.String(\"foo\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"one\"),\n\t\t\t\tpulumi.String(\"two\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_okta_authbackend\" \"example\" {\n path = \"group_okta\"\n organization = \"dummy\"\n}\nresource \"vault_okta_authbackendgroup\" \"foo\" {\n path = vault_okta_authbackend.example.path\n group_name = \"foo\"\n policies = [\"one\", \"two\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.okta.AuthBackend;\nimport com.pulumi.vault.okta.AuthBackendArgs;\nimport com.pulumi.vault.okta.AuthBackendGroup;\nimport com.pulumi.vault.okta.AuthBackendGroupArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .path(\"group_okta\")\n .organization(\"dummy\")\n .build());\n\n var foo = new AuthBackendGroup(\"foo\", AuthBackendGroupArgs.builder()\n .path(example.path())\n .groupName(\"foo\")\n .policies( \n \"one\",\n \"two\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:okta:AuthBackend\n properties:\n path: group_okta\n organization: dummy\n foo:\n type: vault:okta:AuthBackendGroup\n properties:\n path: ${example.path}\n groupName: foo\n policies:\n - one\n - two\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nOkta authentication backend groups can be imported using the format `backend/groupName` e.g.\n\n```sh\n$ pulumi import vault:okta/authBackendGroup:AuthBackendGroup foo okta/foo\n```\n\n", "properties": { "groupName": { "type": "string", "description": "Name of the group within the Okta\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "The path where the Okta auth backend is mounted\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Vault policies to associate with this group\n" } }, "required": [ "groupName", "path" ], "inputProperties": { "groupName": { "type": "string", "description": "Name of the group within the Okta\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path where the Okta auth backend is mounted\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Vault policies to associate with this group\n" } }, "requiredInputs": [ "groupName", "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendGroup resources.\n", "properties": { "groupName": { "type": "string", "description": "Name of the group within the Okta\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path where the Okta auth backend is mounted\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "Vault policies to associate with this group\n" } }, "type": "object" } }, "vault:okta/authBackendUser:AuthBackendUser": { "description": "Provides a resource to create a user in an\n[Okta auth backend within Vault](https://www.vaultproject.io/docs/auth/okta.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.okta.AuthBackend(\"example\", {\n path: \"user_okta\",\n organization: \"dummy\",\n});\nconst foo = new vault.okta.AuthBackendUser(\"foo\", {\n path: example.path,\n username: \"foo\",\n groups: [\n \"one\",\n \"two\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.okta.AuthBackend(\"example\",\n path=\"user_okta\",\n organization=\"dummy\")\nfoo = vault.okta.AuthBackendUser(\"foo\",\n path=example.path,\n username=\"foo\",\n groups=[\n \"one\",\n \"two\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Okta.AuthBackend(\"example\", new()\n {\n Path = \"user_okta\",\n Organization = \"dummy\",\n });\n\n var foo = new Vault.Okta.AuthBackendUser(\"foo\", new()\n {\n Path = example.Path,\n Username = \"foo\",\n Groups = new[]\n {\n \"one\",\n \"two\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/okta\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := okta.NewAuthBackend(ctx, \"example\", \u0026okta.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"user_okta\"),\n\t\t\tOrganization: pulumi.String(\"dummy\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = okta.NewAuthBackendUser(ctx, \"foo\", \u0026okta.AuthBackendUserArgs{\n\t\t\tPath: example.Path,\n\t\t\tUsername: pulumi.String(\"foo\"),\n\t\t\tGroups: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"one\"),\n\t\t\t\tpulumi.String(\"two\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_okta_authbackend\" \"example\" {\n path = \"user_okta\"\n organization = \"dummy\"\n}\nresource \"vault_okta_authbackenduser\" \"foo\" {\n path = vault_okta_authbackend.example.path\n username = \"foo\"\n groups = [\"one\", \"two\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.okta.AuthBackend;\nimport com.pulumi.vault.okta.AuthBackendArgs;\nimport com.pulumi.vault.okta.AuthBackendUser;\nimport com.pulumi.vault.okta.AuthBackendUserArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .path(\"user_okta\")\n .organization(\"dummy\")\n .build());\n\n var foo = new AuthBackendUser(\"foo\", AuthBackendUserArgs.builder()\n .path(example.path())\n .username(\"foo\")\n .groups( \n \"one\",\n \"two\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:okta:AuthBackend\n properties:\n path: user_okta\n organization: dummy\n foo:\n type: vault:okta:AuthBackendUser\n properties:\n path: ${example.path}\n username: foo\n groups:\n - one\n - two\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nOkta authentication backend users can be imported using its `path/user` ID format, e.g.\n```sh\n$ pulumi import vault:okta/authBackendUser:AuthBackendUser example okta/foo\n```\n\n", "properties": { "groups": { "type": "array", "items": { "type": "string" }, "description": "List of Okta groups to associate with this user\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "The path where the Okta auth backend is mounted\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of Vault policies to associate with this user\n" }, "username": { "type": "string", "description": "Name of the user within Okta\n" } }, "required": [ "path", "username" ], "inputProperties": { "groups": { "type": "array", "items": { "type": "string" }, "description": "List of Okta groups to associate with this user\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path where the Okta auth backend is mounted\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of Vault policies to associate with this user\n" }, "username": { "type": "string", "description": "Name of the user within Okta\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "path", "username" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendUser resources.\n", "properties": { "groups": { "type": "array", "items": { "type": "string" }, "description": "List of Okta groups to associate with this user\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "The path where the Okta auth backend is mounted\n", "willReplaceOnChanges": true }, "policies": { "type": "array", "items": { "type": "string" }, "description": "List of Vault policies to associate with this user\n" }, "username": { "type": "string", "description": "Name of the user within Okta\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:os/secretBackend:SecretBackend": { "description": "Manages OS Secrets Engine backend configuration in a Vault server. The OS Secrets Engine manages credentials\nfor operating system accounts on remote hosts via SSH. This resource requires Vault 2.0.0 or later.\n\nThe OS Secrets Engine mount itself is managed separately, typically with \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e. This resource only manages\nbackend configuration for an existing OS mount.\n\nBefore mounting the OS Secrets Engine, the external OS plugin must already be registered in Vault's plugin catalog.\nYou can register it with the \u003cspan pulumi-lang-nodejs=\"`vault.Plugin`\" pulumi-lang-dotnet=\"`vault.Plugin`\" pulumi-lang-go=\"`Plugin`\" pulumi-lang-python=\"`Plugin`\" pulumi-lang-yaml=\"`vault.Plugin`\" pulumi-lang-java=\"`vault.Plugin`\" pulumi-lang-hcl=\"`vault_plugin`\"\u003e`vault.Plugin`\u003c/span\u003e resource.\n\nThe examples below use the canonical plugin name `vault-plugin-secrets-os`. If your Vault cluster registers the\nOS plugin under a different catalog name, use that name in `vault_mount.type` instead.\n\nSee the [Vault documentation](https://www.vaultproject.io/docs/secrets/os) for more information.\n\n## Example Usage\n\n### Register Plugin And Configure Backend\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Plugin(\"os\", {\n type: \"secret\",\n name: \"vault-plugin-secrets-os\",\n version: \"v0.1.0+ent\",\n});\nconst osMount = new vault.Mount(\"os\", {\n path: \"os\",\n type: os.name,\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: osMount.path});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Plugin(\"os\",\n type=\"secret\",\n name=\"vault-plugin-secrets-os\",\n version=\"v0.1.0+ent\")\nos_mount = vault.Mount(\"os\",\n path=\"os\",\n type=os.name)\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os_mount.path)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Plugin(\"os\", new()\n {\n Type = \"secret\",\n Name = \"vault-plugin-secrets-os\",\n Version = \"v0.1.0+ent\",\n });\n\n var osMount = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = os.Name,\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = osMount.Path,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewPlugin(ctx, \"os\", \u0026vault.PluginArgs{\n\t\t\tType: pulumi.String(\"secret\"),\n\t\t\tName: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t\tVersion: pulumi.String(\"v0.1.0+ent\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosMount, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: os2.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: osMount.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_plugin\" \"os\" {\n type = \"secret\"\n name = \"vault-plugin-secrets-os\"\n version = \"v0.1.0+ent\"\n}\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = vault_plugin.os.name\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Plugin;\nimport com.pulumi.vault.PluginArgs;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Plugin(\"os\", PluginArgs.builder()\n .type(\"secret\")\n .name(\"vault-plugin-secrets-os\")\n .version(\"v0.1.0+ent\")\n .build());\n\n var osMount = new Mount(\"osMount\", MountArgs.builder()\n .path(\"os\")\n .type(os.name())\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(osMount.path())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Plugin\n properties:\n type: secret\n name: vault-plugin-secrets-os\n version: v0.1.0+ent\n osMount:\n type: vault:Mount\n name: os\n properties:\n path: os\n type: ${os.name}\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${osMount.path}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Basic Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Mount(\"os\", {\n path: \"os\",\n type: \"vault-plugin-secrets-os\",\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: os.path});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Mount(\"os\",\n path=\"os\",\n type=\"vault-plugin-secrets-os\")\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os.path)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = \"vault-plugin-secrets-os\",\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = os.Path,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: os2.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = \"vault-plugin-secrets-os\"\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Mount(\"os\", MountArgs.builder()\n .path(\"os\")\n .type(\"vault-plugin-secrets-os\")\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(os.path())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Mount\n properties:\n path: os\n type: vault-plugin-secrets-os\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${os.path}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Advanced Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Mount(\"os\", {\n path: \"os-prod\",\n type: \"vault-plugin-secrets-os\",\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {\n mount: os.path,\n maxVersions: 10,\n sshHostKeyTrustOnFirstUse: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Mount(\"os\",\n path=\"os-prod\",\n type=\"vault-plugin-secrets-os\")\nos_secret_backend = vault.os.SecretBackend(\"os\",\n mount=os.path,\n max_versions=10,\n ssh_host_key_trust_on_first_use=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Mount(\"os\", new()\n {\n Path = \"os-prod\",\n Type = \"vault-plugin-secrets-os\",\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = os.Path,\n MaxVersions = 10,\n SshHostKeyTrustOnFirstUse = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os-prod\"),\n\t\t\tType: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: os2.Path,\n\t\t\tMaxVersions: pulumi.Int(10),\n\t\t\tSshHostKeyTrustOnFirstUse: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"os\" {\n path = \"os-prod\"\n type = \"vault-plugin-secrets-os\"\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n max_versions = 10\n ssh_host_key_trust_on_first_use = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Mount(\"os\", MountArgs.builder()\n .path(\"os-prod\")\n .type(\"vault-plugin-secrets-os\")\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(os.path())\n .maxVersions(10)\n .sshHostKeyTrustOnFirstUse(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Mount\n properties:\n path: os-prod\n type: vault-plugin-secrets-os\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${os.path}\n maxVersions: 10\n sshHostKeyTrustOnFirstUse: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Notes\n\n* This resource requires Vault 2.0.0 or later.\n* The OS Secrets Engine plugin must be registered before the mount is enabled. Use \u003cspan pulumi-lang-nodejs=\"`vault.Plugin`\" pulumi-lang-dotnet=\"`vault.Plugin`\" pulumi-lang-go=\"`Plugin`\" pulumi-lang-python=\"`Plugin`\" pulumi-lang-yaml=\"`vault.Plugin`\" pulumi-lang-java=\"`vault.Plugin`\" pulumi-lang-hcl=\"`vault_plugin`\"\u003e`vault.Plugin`\u003c/span\u003e to manage catalog registration when appropriate.\n* Use \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e to create, tune, or remove the OS Secrets Engine mount.\n* When \u003cspan pulumi-lang-nodejs=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-dotnet=\"`SshHostKeyTrustOnFirstUse`\" pulumi-lang-go=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-python=\"`ssh_host_key_trust_on_first_use`\" pulumi-lang-yaml=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-java=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-hcl=\"`ssh_host_key_trust_on_first_use`\"\u003e`sshHostKeyTrustOnFirstUse`\u003c/span\u003e is enabled, the first connection to a host will automatically trust and store its SSH host key.\n\n## Import\n\nOS Secret backend can be imported using the \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:os/secretBackend:SecretBackend os os\n```\n\n", "properties": { "maxVersions": { "type": "integer", "description": "The maximum number of versions to keep. When omitted, Vault applies its server-side default of \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If you later remove the field from configuration, Vault retains the current value. Set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e to explicitly store zero in Vault.\n" }, "mount": { "type": "string", "description": "The path where the OS secrets engine is already mounted. Must not begin or end with a `/`.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "sshHostKeyTrustOnFirstUse": { "type": "boolean", "description": "If \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, SSH host keys will be trusted on first use (TOFU). If \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, host keys must be explicitly configured. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" } }, "required": [ "maxVersions", "mount", "sshHostKeyTrustOnFirstUse" ], "inputProperties": { "maxVersions": { "type": "integer", "description": "The maximum number of versions to keep. When omitted, Vault applies its server-side default of \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If you later remove the field from configuration, Vault retains the current value. Set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e to explicitly store zero in Vault.\n" }, "mount": { "type": "string", "description": "The path where the OS secrets engine is already mounted. Must not begin or end with a `/`.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "sshHostKeyTrustOnFirstUse": { "type": "boolean", "description": "If \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, SSH host keys will be trusted on first use (TOFU). If \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, host keys must be explicitly configured. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" } }, "requiredInputs": [ "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "maxVersions": { "type": "integer", "description": "The maximum number of versions to keep. When omitted, Vault applies its server-side default of \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If you later remove the field from configuration, Vault retains the current value. Set to \u003cspan pulumi-lang-nodejs=\"`0`\" pulumi-lang-dotnet=\"`0`\" pulumi-lang-go=\"`0`\" pulumi-lang-python=\"`0`\" pulumi-lang-yaml=\"`0`\" pulumi-lang-java=\"`0`\" pulumi-lang-hcl=\"`0`\"\u003e`0`\u003c/span\u003e to explicitly store zero in Vault.\n" }, "mount": { "type": "string", "description": "The path where the OS secrets engine is already mounted. Must not begin or end with a `/`.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "sshHostKeyTrustOnFirstUse": { "type": "boolean", "description": "If \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, SSH host keys will be trusted on first use (TOFU). If \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e, host keys must be explicitly configured. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" } }, "type": "object" } }, "vault:os/secretBackendAccount:SecretBackendAccount": { "description": "Manages account configurations in the OS Secrets Engine. Accounts represent operating system user\naccounts on remote hosts that Vault will manage, including automatic password rotation.\nThis resource requires Vault 2.0.0 or later.\n\n\u003e **Important** The \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field is write-only, create-only, and will not be read back from Vault.\nIt can only be set during resource creation. To update the password after creation, use the Vault CLI or API\nto call the reset endpoint directly (see \"Password Management\" section below).\nAll data provided in the resource configuration will be written in cleartext to state and plan\nfiles generated by Terraform. Protect these artifacts accordingly. See\nthe main provider documentation for more details.\n\nSee the [Vault documentation](https://www.vaultproject.io/docs/secrets/os) for more information.\n\nThe OS Secrets Engine mount itself is managed separately, typically with \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e. This resource manages\naccounts beneath an existing OS mount and host.\n\nBefore mounting the OS Secrets Engine, the external OS plugin must already be registered in Vault's plugin catalog.\nYou can register it with the \u003cspan pulumi-lang-nodejs=\"`vault.Plugin`\" pulumi-lang-dotnet=\"`vault.Plugin`\" pulumi-lang-go=\"`Plugin`\" pulumi-lang-python=\"`Plugin`\" pulumi-lang-yaml=\"`vault.Plugin`\" pulumi-lang-java=\"`vault.Plugin`\" pulumi-lang-hcl=\"`vault_plugin`\"\u003e`vault.Plugin`\u003c/span\u003e resource.\n\nThe examples below use the canonical plugin name `vault-plugin-secrets-os`. If your Vault cluster registers the\nOS plugin under a different catalog name, use that name in `vault_mount.type` instead.\n\n## Example Usage\n\n### Register Plugin And Configure Account\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Plugin(\"os\", {\n type: \"secret\",\n name: \"vault-plugin-secrets-os\",\n version: \"v0.1.0+ent\",\n});\nconst osMount = new vault.Mount(\"os\", {\n path: \"os\",\n type: os.name,\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: osMount.path});\nconst server = new vault.os.SecretBackendHost(\"server\", {\n mount: osSecretBackend.mount,\n name: \"web-server\",\n address: \"192.168.1.100\",\n port: 22,\n});\nconst admin = new vault.os.SecretBackendAccount(\"admin\", {\n mount: osSecretBackend.mount,\n host: server.name,\n name: \"admin-account\",\n username: \"admin\",\n passwordWo: \"initial-secure-password-123\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Plugin(\"os\",\n type=\"secret\",\n name=\"vault-plugin-secrets-os\",\n version=\"v0.1.0+ent\")\nos_mount = vault.Mount(\"os\",\n path=\"os\",\n type=os.name)\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os_mount.path)\nserver = vault.os.SecretBackendHost(\"server\",\n mount=os_secret_backend.mount,\n name=\"web-server\",\n address=\"192.168.1.100\",\n port=22)\nadmin = vault.os.SecretBackendAccount(\"admin\",\n mount=os_secret_backend.mount,\n host=server.name,\n name=\"admin-account\",\n username=\"admin\",\n password_wo=\"initial-secure-password-123\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Plugin(\"os\", new()\n {\n Type = \"secret\",\n Name = \"vault-plugin-secrets-os\",\n Version = \"v0.1.0+ent\",\n });\n\n var osMount = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = os.Name,\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = osMount.Path,\n });\n\n var server = new Vault.Os.SecretBackendHost(\"server\", new()\n {\n Mount = osSecretBackend.Mount,\n Name = \"web-server\",\n Address = \"192.168.1.100\",\n Port = 22,\n });\n\n var admin = new Vault.Os.SecretBackendAccount(\"admin\", new()\n {\n Mount = osSecretBackend.Mount,\n Host = server.Name,\n Name = \"admin-account\",\n Username = \"admin\",\n PasswordWo = \"initial-secure-password-123\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewPlugin(ctx, \"os\", \u0026vault.PluginArgs{\n\t\t\tType: pulumi.String(\"secret\"),\n\t\t\tName: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t\tVersion: pulumi.String(\"v0.1.0+ent\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosMount, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: os2.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosSecretBackend, err := os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: osMount.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tserver, err := os.NewSecretBackendHost(ctx, \"server\", \u0026os.SecretBackendHostArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tName: pulumi.String(\"web-server\"),\n\t\t\tAddress: pulumi.String(\"192.168.1.100\"),\n\t\t\tPort: pulumi.Int(22),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackendAccount(ctx, \"admin\", \u0026os.SecretBackendAccountArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tHost: server.Name,\n\t\t\tName: pulumi.String(\"admin-account\"),\n\t\t\tUsername: pulumi.String(\"admin\"),\n\t\t\tPasswordWo: pulumi.String(\"initial-secure-password-123\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_plugin\" \"os\" {\n type = \"secret\"\n name = \"vault-plugin-secrets-os\"\n version = \"v0.1.0+ent\"\n}\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = vault_plugin.os.name\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\nresource \"vault_os_secretbackendhost\" \"server\" {\n mount = vault_os_secretbackend.os.mount\n name = \"web-server\"\n address = \"192.168.1.100\"\n port = 22\n}\nresource \"vault_os_secretbackendaccount\" \"admin\" {\n mount = vault_os_secretbackend.os.mount\n host = vault_os_secretbackendhost.server.name\n name = \"admin-account\"\n username = \"admin\"\n password_wo = \"initial-secure-password-123\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Plugin;\nimport com.pulumi.vault.PluginArgs;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport com.pulumi.vault.os.SecretBackendHost;\nimport com.pulumi.vault.os.SecretBackendHostArgs;\nimport com.pulumi.vault.os.SecretBackendAccount;\nimport com.pulumi.vault.os.SecretBackendAccountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Plugin(\"os\", PluginArgs.builder()\n .type(\"secret\")\n .name(\"vault-plugin-secrets-os\")\n .version(\"v0.1.0+ent\")\n .build());\n\n var osMount = new Mount(\"osMount\", MountArgs.builder()\n .path(\"os\")\n .type(os.name())\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(osMount.path())\n .build());\n\n var server = new SecretBackendHost(\"server\", SecretBackendHostArgs.builder()\n .mount(osSecretBackend.mount())\n .name(\"web-server\")\n .address(\"192.168.1.100\")\n .port(22)\n .build());\n\n var admin = new SecretBackendAccount(\"admin\", SecretBackendAccountArgs.builder()\n .mount(osSecretBackend.mount())\n .host(server.name())\n .name(\"admin-account\")\n .username(\"admin\")\n .passwordWo(\"initial-secure-password-123\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Plugin\n properties:\n type: secret\n name: vault-plugin-secrets-os\n version: v0.1.0+ent\n osMount:\n type: vault:Mount\n name: os\n properties:\n path: os\n type: ${os.name}\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${osMount.path}\n server:\n type: vault:os:SecretBackendHost\n properties:\n mount: ${osSecretBackend.mount}\n name: web-server\n address: 192.168.1.100\n port: 22\n admin:\n type: vault:os:SecretBackendAccount\n properties:\n mount: ${osSecretBackend.mount}\n host: ${server.name}\n name: admin-account\n username: admin\n passwordWo: initial-secure-password-123\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Basic Account Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Mount(\"os\", {\n path: \"os\",\n type: \"vault-plugin-secrets-os\",\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: os.path});\nconst server = new vault.os.SecretBackendHost(\"server\", {\n mount: osSecretBackend.mount,\n name: \"web-server\",\n address: \"192.168.1.100\",\n port: 22,\n});\nconst admin = new vault.os.SecretBackendAccount(\"admin\", {\n mount: osSecretBackend.mount,\n host: server.name,\n name: \"admin-account\",\n username: \"admin\",\n passwordWo: \"initial-secure-password-123\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Mount(\"os\",\n path=\"os\",\n type=\"vault-plugin-secrets-os\")\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os.path)\nserver = vault.os.SecretBackendHost(\"server\",\n mount=os_secret_backend.mount,\n name=\"web-server\",\n address=\"192.168.1.100\",\n port=22)\nadmin = vault.os.SecretBackendAccount(\"admin\",\n mount=os_secret_backend.mount,\n host=server.name,\n name=\"admin-account\",\n username=\"admin\",\n password_wo=\"initial-secure-password-123\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = \"vault-plugin-secrets-os\",\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = os.Path,\n });\n\n var server = new Vault.Os.SecretBackendHost(\"server\", new()\n {\n Mount = osSecretBackend.Mount,\n Name = \"web-server\",\n Address = \"192.168.1.100\",\n Port = 22,\n });\n\n var admin = new Vault.Os.SecretBackendAccount(\"admin\", new()\n {\n Mount = osSecretBackend.Mount,\n Host = server.Name,\n Name = \"admin-account\",\n Username = \"admin\",\n PasswordWo = \"initial-secure-password-123\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosSecretBackend, err := os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: os2.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tserver, err := os.NewSecretBackendHost(ctx, \"server\", \u0026os.SecretBackendHostArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tName: pulumi.String(\"web-server\"),\n\t\t\tAddress: pulumi.String(\"192.168.1.100\"),\n\t\t\tPort: pulumi.Int(22),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackendAccount(ctx, \"admin\", \u0026os.SecretBackendAccountArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tHost: server.Name,\n\t\t\tName: pulumi.String(\"admin-account\"),\n\t\t\tUsername: pulumi.String(\"admin\"),\n\t\t\tPasswordWo: pulumi.String(\"initial-secure-password-123\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = \"vault-plugin-secrets-os\"\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\nresource \"vault_os_secretbackendhost\" \"server\" {\n mount = vault_os_secretbackend.os.mount\n name = \"web-server\"\n address = \"192.168.1.100\"\n port = 22\n}\nresource \"vault_os_secretbackendaccount\" \"admin\" {\n mount = vault_os_secretbackend.os.mount\n host = vault_os_secretbackendhost.server.name\n name = \"admin-account\"\n username = \"admin\"\n password_wo = \"initial-secure-password-123\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport com.pulumi.vault.os.SecretBackendHost;\nimport com.pulumi.vault.os.SecretBackendHostArgs;\nimport com.pulumi.vault.os.SecretBackendAccount;\nimport com.pulumi.vault.os.SecretBackendAccountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Mount(\"os\", MountArgs.builder()\n .path(\"os\")\n .type(\"vault-plugin-secrets-os\")\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(os.path())\n .build());\n\n var server = new SecretBackendHost(\"server\", SecretBackendHostArgs.builder()\n .mount(osSecretBackend.mount())\n .name(\"web-server\")\n .address(\"192.168.1.100\")\n .port(22)\n .build());\n\n var admin = new SecretBackendAccount(\"admin\", SecretBackendAccountArgs.builder()\n .mount(osSecretBackend.mount())\n .host(server.name())\n .name(\"admin-account\")\n .username(\"admin\")\n .passwordWo(\"initial-secure-password-123\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Mount\n properties:\n path: os\n type: vault-plugin-secrets-os\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${os.path}\n server:\n type: vault:os:SecretBackendHost\n properties:\n mount: ${osSecretBackend.mount}\n name: web-server\n address: 192.168.1.100\n port: 22\n admin:\n type: vault:os:SecretBackendAccount\n properties:\n mount: ${osSecretBackend.mount}\n host: ${server.name}\n name: admin-account\n username: admin\n passwordWo: initial-secure-password-123\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Account with Rotation Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Mount(\"os\", {\n path: \"os\",\n type: \"vault-plugin-secrets-os\",\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: os.path});\nconst database = new vault.os.SecretBackendHost(\"database\", {\n mount: osSecretBackend.mount,\n name: \"db-server\",\n address: \"10.0.1.50\",\n port: 22,\n});\nconst dbadmin = new vault.os.SecretBackendAccount(\"dbadmin\", {\n mount: osSecretBackend.mount,\n host: database.name,\n name: \"dbadmin\",\n username: \"postgres\",\n passwordWo: \"initial-password-456\",\n rotationPeriod: 86400,\n verifyConnection: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Mount(\"os\",\n path=\"os\",\n type=\"vault-plugin-secrets-os\")\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os.path)\ndatabase = vault.os.SecretBackendHost(\"database\",\n mount=os_secret_backend.mount,\n name=\"db-server\",\n address=\"10.0.1.50\",\n port=22)\ndbadmin = vault.os.SecretBackendAccount(\"dbadmin\",\n mount=os_secret_backend.mount,\n host=database.name,\n name=\"dbadmin\",\n username=\"postgres\",\n password_wo=\"initial-password-456\",\n rotation_period=86400,\n verify_connection=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = \"vault-plugin-secrets-os\",\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = os.Path,\n });\n\n var database = new Vault.Os.SecretBackendHost(\"database\", new()\n {\n Mount = osSecretBackend.Mount,\n Name = \"db-server\",\n Address = \"10.0.1.50\",\n Port = 22,\n });\n\n var dbadmin = new Vault.Os.SecretBackendAccount(\"dbadmin\", new()\n {\n Mount = osSecretBackend.Mount,\n Host = database.Name,\n Name = \"dbadmin\",\n Username = \"postgres\",\n PasswordWo = \"initial-password-456\",\n RotationPeriod = 86400,\n VerifyConnection = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosSecretBackend, err := os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: os2.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tdatabase, err := os.NewSecretBackendHost(ctx, \"database\", \u0026os.SecretBackendHostArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tName: pulumi.String(\"db-server\"),\n\t\t\tAddress: pulumi.String(\"10.0.1.50\"),\n\t\t\tPort: pulumi.Int(22),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackendAccount(ctx, \"dbadmin\", \u0026os.SecretBackendAccountArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tHost: database.Name,\n\t\t\tName: pulumi.String(\"dbadmin\"),\n\t\t\tUsername: pulumi.String(\"postgres\"),\n\t\t\tPasswordWo: pulumi.String(\"initial-password-456\"),\n\t\t\tRotationPeriod: pulumi.Int(86400),\n\t\t\tVerifyConnection: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = \"vault-plugin-secrets-os\"\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\nresource \"vault_os_secretbackendhost\" \"database\" {\n mount = vault_os_secretbackend.os.mount\n name = \"db-server\"\n address = \"10.0.1.50\"\n port = 22\n}\nresource \"vault_os_secretbackendaccount\" \"dbadmin\" {\n mount = vault_os_secretbackend.os.mount\n host = vault_os_secretbackendhost.database.name\n name = \"dbadmin\"\n username = \"postgres\"\n password_wo = \"initial-password-456\"\n rotation_period = 86400\n verify_connection = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport com.pulumi.vault.os.SecretBackendHost;\nimport com.pulumi.vault.os.SecretBackendHostArgs;\nimport com.pulumi.vault.os.SecretBackendAccount;\nimport com.pulumi.vault.os.SecretBackendAccountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Mount(\"os\", MountArgs.builder()\n .path(\"os\")\n .type(\"vault-plugin-secrets-os\")\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(os.path())\n .build());\n\n var database = new SecretBackendHost(\"database\", SecretBackendHostArgs.builder()\n .mount(osSecretBackend.mount())\n .name(\"db-server\")\n .address(\"10.0.1.50\")\n .port(22)\n .build());\n\n var dbadmin = new SecretBackendAccount(\"dbadmin\", SecretBackendAccountArgs.builder()\n .mount(osSecretBackend.mount())\n .host(database.name())\n .name(\"dbadmin\")\n .username(\"postgres\")\n .passwordWo(\"initial-password-456\")\n .rotationPeriod(86400)\n .verifyConnection(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Mount\n properties:\n path: os\n type: vault-plugin-secrets-os\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${os.path}\n database:\n type: vault:os:SecretBackendHost\n properties:\n mount: ${osSecretBackend.mount}\n name: db-server\n address: 10.0.1.50\n port: 22\n dbadmin:\n type: vault:os:SecretBackendAccount\n properties:\n mount: ${osSecretBackend.mount}\n host: ${database.name}\n name: dbadmin\n username: postgres\n passwordWo: initial-password-456\n rotationPeriod: 86400\n verifyConnection: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Account with Scheduled Rotation\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Mount(\"os\", {\n path: \"os\",\n type: \"vault-plugin-secrets-os\",\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: os.path});\nconst appServer = new vault.os.SecretBackendHost(\"app_server\", {\n mount: osSecretBackend.mount,\n name: \"app-01\",\n address: \"192.168.1.200\",\n port: 22,\n});\nconst service = new vault.os.SecretBackendAccount(\"service\", {\n mount: osSecretBackend.mount,\n host: appServer.name,\n name: \"service-account\",\n username: \"appuser\",\n passwordWo: initialPassword,\n rotationSchedule: \"0 3 * * 0\",\n rotationWindow: 3600,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Mount(\"os\",\n path=\"os\",\n type=\"vault-plugin-secrets-os\")\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os.path)\napp_server = vault.os.SecretBackendHost(\"app_server\",\n mount=os_secret_backend.mount,\n name=\"app-01\",\n address=\"192.168.1.200\",\n port=22)\nservice = vault.os.SecretBackendAccount(\"service\",\n mount=os_secret_backend.mount,\n host=app_server.name,\n name=\"service-account\",\n username=\"appuser\",\n password_wo=initial_password,\n rotation_schedule=\"0 3 * * 0\",\n rotation_window=3600)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = \"vault-plugin-secrets-os\",\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = os.Path,\n });\n\n var appServer = new Vault.Os.SecretBackendHost(\"app_server\", new()\n {\n Mount = osSecretBackend.Mount,\n Name = \"app-01\",\n Address = \"192.168.1.200\",\n Port = 22,\n });\n\n var service = new Vault.Os.SecretBackendAccount(\"service\", new()\n {\n Mount = osSecretBackend.Mount,\n Host = appServer.Name,\n Name = \"service-account\",\n Username = \"appuser\",\n PasswordWo = initialPassword,\n RotationSchedule = \"0 3 * * 0\",\n RotationWindow = 3600,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosSecretBackend, err := os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: os2.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tappServer, err := os.NewSecretBackendHost(ctx, \"app_server\", \u0026os.SecretBackendHostArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tName: pulumi.String(\"app-01\"),\n\t\t\tAddress: pulumi.String(\"192.168.1.200\"),\n\t\t\tPort: pulumi.Int(22),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackendAccount(ctx, \"service\", \u0026os.SecretBackendAccountArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tHost: appServer.Name,\n\t\t\tName: pulumi.String(\"service-account\"),\n\t\t\tUsername: pulumi.String(\"appuser\"),\n\t\t\tPasswordWo: pulumi.Any(initialPassword),\n\t\t\tRotationSchedule: pulumi.String(\"0 3 * * 0\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = \"vault-plugin-secrets-os\"\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\nresource \"vault_os_secretbackendhost\" \"app_server\" {\n mount = vault_os_secretbackend.os.mount\n name = \"app-01\"\n address = \"192.168.1.200\"\n port = 22\n}\nresource \"vault_os_secretbackendaccount\" \"service\" {\n mount = vault_os_secretbackend.os.mount\n host = vault_os_secretbackendhost.app_server.name\n name = \"service-account\"\n username = \"appuser\"\n password_wo = initialPassword\n rotation_schedule = \"0 3 * * 0\"\n rotation_window = 3600\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport com.pulumi.vault.os.SecretBackendHost;\nimport com.pulumi.vault.os.SecretBackendHostArgs;\nimport com.pulumi.vault.os.SecretBackendAccount;\nimport com.pulumi.vault.os.SecretBackendAccountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Mount(\"os\", MountArgs.builder()\n .path(\"os\")\n .type(\"vault-plugin-secrets-os\")\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(os.path())\n .build());\n\n var appServer = new SecretBackendHost(\"appServer\", SecretBackendHostArgs.builder()\n .mount(osSecretBackend.mount())\n .name(\"app-01\")\n .address(\"192.168.1.200\")\n .port(22)\n .build());\n\n var service = new SecretBackendAccount(\"service\", SecretBackendAccountArgs.builder()\n .mount(osSecretBackend.mount())\n .host(appServer.name())\n .name(\"service-account\")\n .username(\"appuser\")\n .passwordWo(initialPassword)\n .rotationSchedule(\"0 3 * * 0\")\n .rotationWindow(3600)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Mount\n properties:\n path: os\n type: vault-plugin-secrets-os\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${os.path}\n appServer:\n type: vault:os:SecretBackendHost\n name: app_server\n properties:\n mount: ${osSecretBackend.mount}\n name: app-01\n address: 192.168.1.200\n port: 22\n service:\n type: vault:os:SecretBackendAccount\n properties:\n mount: ${osSecretBackend.mount}\n host: ${appServer.name}\n name: service-account\n username: appuser\n passwordWo: ${initialPassword}\n rotationSchedule: 0 3 * * 0\n rotationWindow: 3600\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Password Management\n\nThe \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field is **create-only** by design. This aligns with Vault's security model where password updates\nshould be performed through dedicated reset operations rather than general configuration updates.\n\n### Updating Passwords After Creation\n\nTo update an account password after the resource has been created, use the Vault CLI or API directly:\n\n**Using Vault CLI:**\n```bash\nvault write os/hosts/\u003chost\u003e/accounts/\u003cname\u003e/reset password=\"new-password\"\n```\n\n**Using Vault API:**\n```bash\ncurl -X POST \\\n -H \"X-Vault-Token: $VAULT_TOKEN\" \\\n -d '{\"password\":\"new-password\"}' \\\n https://vault.example.com/v1/os/hosts/\u003chost\u003e/accounts/\u003cname\u003e/reset\n```\n\n**Example:**\n```bash\n# Reset password for the admin account on web-server host\nvault write os/hosts/web-server/accounts/admin-account/reset password=\"new-secure-password\"\n```\n\nThis approach ensures that password updates are explicit operations separate from other configuration changes,\nproviding better audit trails and security controls.\n\n## Notes\n\n* This resource requires Vault 2.0.0 or later.\n* The OS Secrets Engine plugin must be registered before the mount is enabled. Use \u003cspan pulumi-lang-nodejs=\"`vault.Plugin`\" pulumi-lang-dotnet=\"`vault.Plugin`\" pulumi-lang-go=\"`Plugin`\" pulumi-lang-python=\"`Plugin`\" pulumi-lang-yaml=\"`vault.Plugin`\" pulumi-lang-java=\"`vault.Plugin`\" pulumi-lang-hcl=\"`vault_plugin`\"\u003e`vault.Plugin`\u003c/span\u003e to manage catalog registration when appropriate.\n* Use \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e to create, tune, or remove the OS Secrets Engine mount before managing accounts with this resource.\n* The account must reference an existing host configuration.\n* The \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field is write-only and create-only for security reasons. Once set, Vault will manage the password through rotation, but the current password cannot be retrieved through the API.\n* To manually update a password after creation, use the Vault CLI or API reset endpoint (see \"Password Management\" section above).\n* \u003cspan pulumi-lang-nodejs=\"`verifyConnection`\" pulumi-lang-dotnet=\"`VerifyConnection`\" pulumi-lang-go=\"`verifyConnection`\" pulumi-lang-python=\"`verify_connection`\" pulumi-lang-yaml=\"`verifyConnection`\" pulumi-lang-java=\"`verifyConnection`\" pulumi-lang-hcl=\"`verify_connection`\"\u003e`verifyConnection`\u003c/span\u003e defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e. In environments where SSH connectivity is intentionally unavailable during creation, set it explicitly to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n* Use either \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n* After the initial password is set, Vault will rotate it according to the configured schedule. Applications should retrieve the current password from Vault rather than storing it.\n* Changing \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`host`\" pulumi-lang-dotnet=\"`Host`\" pulumi-lang-go=\"`host`\" pulumi-lang-python=\"`host`\" pulumi-lang-yaml=\"`host`\" pulumi-lang-java=\"`host`\" pulumi-lang-hcl=\"`host`\"\u003e`host`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, or \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e will cause the resource to be recreated.\n* The computed fields \u003cspan pulumi-lang-nodejs=\"`lastVaultRotation`\" pulumi-lang-dotnet=\"`LastVaultRotation`\" pulumi-lang-go=\"`lastVaultRotation`\" pulumi-lang-python=\"`last_vault_rotation`\" pulumi-lang-yaml=\"`lastVaultRotation`\" pulumi-lang-java=\"`lastVaultRotation`\" pulumi-lang-hcl=\"`last_vault_rotation`\"\u003e`lastVaultRotation`\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"`nextVaultRotation`\" pulumi-lang-dotnet=\"`NextVaultRotation`\" pulumi-lang-go=\"`nextVaultRotation`\" pulumi-lang-python=\"`next_vault_rotation`\" pulumi-lang-yaml=\"`nextVaultRotation`\" pulumi-lang-java=\"`nextVaultRotation`\" pulumi-lang-hcl=\"`next_vault_rotation`\"\u003e`nextVaultRotation`\u003c/span\u003e are populated by Vault when rotation metadata is available.\n\n## Security Considerations\n\n* Store the initial \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e value in a secure location such as Terraform variables or a secrets management system.\n* Use `sensitive = true` in variable definitions for passwords.\n* The \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field is create-only and cannot be updated through Terraform after resource creation. This is intentional to enforce proper password management practices.\n* For password updates after creation, use the Vault CLI or API reset endpoint, which provides proper audit logging.\n* Ensure Terraform state files are properly secured as they will contain the initial password in cleartext.\n* Applications should retrieve credentials from Vault dynamically rather than storing them.\n* When importing existing accounts, use `lifecycle {\u003cspan pulumi-lang-nodejs=\" ignoreChanges \" pulumi-lang-dotnet=\" IgnoreChanges \" pulumi-lang-go=\" ignoreChanges \" pulumi-lang-python=\" ignore_changes \" pulumi-lang-yaml=\" ignoreChanges \" pulumi-lang-java=\" ignoreChanges \" pulumi-lang-hcl=\" ignore_changes \"\u003e ignoreChanges \u003c/span\u003e= \u003cspan pulumi-lang-nodejs=\"[passwordWo]\" pulumi-lang-dotnet=\"[PasswordWo]\" pulumi-lang-go=\"[passwordWo]\" pulumi-lang-python=\"[password_wo]\" pulumi-lang-yaml=\"[passwordWo]\" pulumi-lang-java=\"[passwordWo]\" pulumi-lang-hcl=\"[password_wo]\"\u003e[passwordWo]\u003c/span\u003e }` to prevent resource recreation.\n\n## Import\n\nOS Secret backend account can be imported using the format `\u003cmount\u003e/hosts/\u003chost\u003e/accounts/\u003cname\u003e`, e.g.\n\n```sh\n$ pulumi import vault:os/secretBackendAccount:SecretBackendAccount admin os/hosts/web-server/accounts/admin-account\n```\n\n\u003e **Note:** When importing, the \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field will not be populated since it is write-only.\nYou must provide a placeholder value in your configuration (e.g., \u003cspan pulumi-lang-nodejs=\"`passwordWo \" pulumi-lang-dotnet=\"`PasswordWo \" pulumi-lang-go=\"`passwordWo \" pulumi-lang-python=\"`password_wo \" pulumi-lang-yaml=\"`passwordWo \" pulumi-lang-java=\"`passwordWo \" pulumi-lang-hcl=\"`password_wo \"\u003e`passwordWo \u003c/span\u003e= \"PLACEHOLDER\"`).\nAfter import, use `lifecycle {\u003cspan pulumi-lang-nodejs=\" ignoreChanges \" pulumi-lang-dotnet=\" IgnoreChanges \" pulumi-lang-go=\" ignoreChanges \" pulumi-lang-python=\" ignore_changes \" pulumi-lang-yaml=\" ignoreChanges \" pulumi-lang-java=\" ignoreChanges \" pulumi-lang-hcl=\" ignore_changes \"\u003e ignoreChanges \u003c/span\u003e= \u003cspan pulumi-lang-nodejs=\"[passwordWo]\" pulumi-lang-dotnet=\"[PasswordWo]\" pulumi-lang-go=\"[passwordWo]\" pulumi-lang-python=\"[password_wo]\" pulumi-lang-yaml=\"[passwordWo]\" pulumi-lang-java=\"[passwordWo]\" pulumi-lang-hcl=\"[password_wo]\"\u003e[passwordWo]\u003c/span\u003e }` to prevent Terraform from trying to recreate the resource.\n\n", "properties": { "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom metadata associated with the account.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Disables automated rotation for the account.\n" }, "host": { "type": "string", "description": "The name of the host where this account exists.\n" }, "lastVaultRotation": { "type": "string", "description": "(Computed) The timestamp of the last password rotation performed by Vault.\n" }, "mount": { "type": "string", "description": "The path where the OS secrets engine is mounted.\n" }, "name": { "type": "string", "description": "Unique name for the account within the host.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "nextVaultRotation": { "type": "string", "description": "(Computed) The timestamp when the next password rotation is scheduled to occur.\n" }, "parentAccountRef": { "type": "string", "description": "Reference to a parent account that manages rotation for this account.\n" }, "passwordPolicy": { "type": "string", "description": "Password policy to use for generated passwords.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see \"Password Management\" section below). Changing this value will force resource recreation.\n", "secret": true }, "rotationPeriod": { "type": "integer", "description": "The period between automatic password rotations, in seconds. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "rotationSchedule": { "type": "string", "description": "A cron-style schedule for password rotation (for example, `\"0 3 * * 0\"`). Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e.\n" }, "rotationWindow": { "type": "integer", "description": "The rotation window, in seconds.\n" }, "username": { "type": "string", "description": "The username of the operating system account on the remote host.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" } }, "required": [ "disableAutomatedRotation", "host", "lastVaultRotation", "mount", "name", "nextVaultRotation", "passwordWo", "rotationPeriod", "rotationSchedule", "rotationWindow", "username", "verifyConnection" ], "inputProperties": { "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom metadata associated with the account.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Disables automated rotation for the account.\n" }, "host": { "type": "string", "description": "The name of the host where this account exists.\n" }, "mount": { "type": "string", "description": "The path where the OS secrets engine is mounted.\n" }, "name": { "type": "string", "description": "Unique name for the account within the host.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "parentAccountRef": { "type": "string", "description": "Reference to a parent account that manages rotation for this account.\n" }, "passwordPolicy": { "type": "string", "description": "Password policy to use for generated passwords.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see \"Password Management\" section below). Changing this value will force resource recreation.\n", "secret": true }, "rotationPeriod": { "type": "integer", "description": "The period between automatic password rotations, in seconds. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "rotationSchedule": { "type": "string", "description": "A cron-style schedule for password rotation (for example, `\"0 3 * * 0\"`). Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e.\n" }, "rotationWindow": { "type": "integer", "description": "The rotation window, in seconds.\n" }, "username": { "type": "string", "description": "The username of the operating system account on the remote host.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" } }, "requiredInputs": [ "host", "mount", "passwordWo", "username" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendAccount resources.\n", "properties": { "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom metadata associated with the account.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Disables automated rotation for the account.\n" }, "host": { "type": "string", "description": "The name of the host where this account exists.\n" }, "lastVaultRotation": { "type": "string", "description": "(Computed) The timestamp of the last password rotation performed by Vault.\n" }, "mount": { "type": "string", "description": "The path where the OS secrets engine is mounted.\n" }, "name": { "type": "string", "description": "Unique name for the account within the host.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "nextVaultRotation": { "type": "string", "description": "(Computed) The timestamp when the next password rotation is scheduled to occur.\n" }, "parentAccountRef": { "type": "string", "description": "Reference to a parent account that manages rotation for this account.\n" }, "passwordPolicy": { "type": "string", "description": "Password policy to use for generated passwords.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe initial password for the account. This field is write-only and create-only - it can only be set during resource creation and will not be read back from Vault. To update the password after creation, use the Vault CLI or API reset endpoint (see \"Password Management\" section below). Changing this value will force resource recreation.\n", "secret": true }, "rotationPeriod": { "type": "integer", "description": "The period between automatic password rotations, in seconds. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "rotationSchedule": { "type": "string", "description": "A cron-style schedule for password rotation (for example, `\"0 3 * * 0\"`). Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e.\n" }, "rotationWindow": { "type": "integer", "description": "The rotation window, in seconds.\n" }, "username": { "type": "string", "description": "The username of the operating system account on the remote host.\n" }, "verifyConnection": { "type": "boolean", "description": "Whether Vault should verify the host connection and supplied credentials during account onboarding. Defaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" } }, "type": "object" } }, "vault:os/secretBackendHost:SecretBackendHost": { "description": "Manages host configurations in the OS Secrets Engine. Hosts represent remote systems where\nVault will manage operating system account credentials via SSH. This resource requires Vault 2.0.0 or later.\n\nThe OS Secrets Engine mount itself is managed separately, typically with \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e. This resource manages\nhosts beneath an existing OS mount.\n\nBefore mounting the OS Secrets Engine, the external OS plugin must already be registered in Vault's plugin catalog.\nYou can register it with the \u003cspan pulumi-lang-nodejs=\"`vault.Plugin`\" pulumi-lang-dotnet=\"`vault.Plugin`\" pulumi-lang-go=\"`Plugin`\" pulumi-lang-python=\"`Plugin`\" pulumi-lang-yaml=\"`vault.Plugin`\" pulumi-lang-java=\"`vault.Plugin`\" pulumi-lang-hcl=\"`vault_plugin`\"\u003e`vault.Plugin`\u003c/span\u003e resource.\n\nThe examples below use the canonical plugin name `vault-plugin-secrets-os`. If your Vault cluster registers the\nOS plugin under a different catalog name, use that name in `vault_mount.type` instead.\n\nSee the [Vault documentation](https://www.vaultproject.io/docs/secrets/os) for more information.\n\n## Example Usage\n\n### Register Plugin And Configure Host\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Plugin(\"os\", {\n type: \"secret\",\n name: \"vault-plugin-secrets-os\",\n version: \"v0.1.0+ent\",\n});\nconst osMount = new vault.Mount(\"os\", {\n path: \"os\",\n type: os.name,\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: osMount.path});\nconst example = new vault.os.SecretBackendHost(\"example\", {\n mount: osSecretBackend.mount,\n name: \"web-server-01\",\n address: \"192.168.1.100\",\n port: 22,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Plugin(\"os\",\n type=\"secret\",\n name=\"vault-plugin-secrets-os\",\n version=\"v0.1.0+ent\")\nos_mount = vault.Mount(\"os\",\n path=\"os\",\n type=os.name)\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os_mount.path)\nexample = vault.os.SecretBackendHost(\"example\",\n mount=os_secret_backend.mount,\n name=\"web-server-01\",\n address=\"192.168.1.100\",\n port=22)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Plugin(\"os\", new()\n {\n Type = \"secret\",\n Name = \"vault-plugin-secrets-os\",\n Version = \"v0.1.0+ent\",\n });\n\n var osMount = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = os.Name,\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = osMount.Path,\n });\n\n var example = new Vault.Os.SecretBackendHost(\"example\", new()\n {\n Mount = osSecretBackend.Mount,\n Name = \"web-server-01\",\n Address = \"192.168.1.100\",\n Port = 22,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewPlugin(ctx, \"os\", \u0026vault.PluginArgs{\n\t\t\tType: pulumi.String(\"secret\"),\n\t\t\tName: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t\tVersion: pulumi.String(\"v0.1.0+ent\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosMount, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: os2.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosSecretBackend, err := os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: osMount.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackendHost(ctx, \"example\", \u0026os.SecretBackendHostArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tName: pulumi.String(\"web-server-01\"),\n\t\t\tAddress: pulumi.String(\"192.168.1.100\"),\n\t\t\tPort: pulumi.Int(22),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_plugin\" \"os\" {\n type = \"secret\"\n name = \"vault-plugin-secrets-os\"\n version = \"v0.1.0+ent\"\n}\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = vault_plugin.os.name\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\nresource \"vault_os_secretbackendhost\" \"example\" {\n mount = vault_os_secretbackend.os.mount\n name = \"web-server-01\"\n address = \"192.168.1.100\"\n port = 22\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Plugin;\nimport com.pulumi.vault.PluginArgs;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport com.pulumi.vault.os.SecretBackendHost;\nimport com.pulumi.vault.os.SecretBackendHostArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Plugin(\"os\", PluginArgs.builder()\n .type(\"secret\")\n .name(\"vault-plugin-secrets-os\")\n .version(\"v0.1.0+ent\")\n .build());\n\n var osMount = new Mount(\"osMount\", MountArgs.builder()\n .path(\"os\")\n .type(os.name())\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(osMount.path())\n .build());\n\n var example = new SecretBackendHost(\"example\", SecretBackendHostArgs.builder()\n .mount(osSecretBackend.mount())\n .name(\"web-server-01\")\n .address(\"192.168.1.100\")\n .port(22)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Plugin\n properties:\n type: secret\n name: vault-plugin-secrets-os\n version: v0.1.0+ent\n osMount:\n type: vault:Mount\n name: os\n properties:\n path: os\n type: ${os.name}\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${osMount.path}\n example:\n type: vault:os:SecretBackendHost\n properties:\n mount: ${osSecretBackend.mount}\n name: web-server-01\n address: 192.168.1.100\n port: 22\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Basic Host Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Mount(\"os\", {\n path: \"os\",\n type: \"vault-plugin-secrets-os\",\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: os.path});\nconst example = new vault.os.SecretBackendHost(\"example\", {\n mount: osSecretBackend.mount,\n name: \"web-server-01\",\n address: \"192.168.1.100\",\n port: 22,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Mount(\"os\",\n path=\"os\",\n type=\"vault-plugin-secrets-os\")\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os.path)\nexample = vault.os.SecretBackendHost(\"example\",\n mount=os_secret_backend.mount,\n name=\"web-server-01\",\n address=\"192.168.1.100\",\n port=22)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = \"vault-plugin-secrets-os\",\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = os.Path,\n });\n\n var example = new Vault.Os.SecretBackendHost(\"example\", new()\n {\n Mount = osSecretBackend.Mount,\n Name = \"web-server-01\",\n Address = \"192.168.1.100\",\n Port = 22,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosSecretBackend, err := os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: os2.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackendHost(ctx, \"example\", \u0026os.SecretBackendHostArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tName: pulumi.String(\"web-server-01\"),\n\t\t\tAddress: pulumi.String(\"192.168.1.100\"),\n\t\t\tPort: pulumi.Int(22),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = \"vault-plugin-secrets-os\"\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\nresource \"vault_os_secretbackendhost\" \"example\" {\n mount = vault_os_secretbackend.os.mount\n name = \"web-server-01\"\n address = \"192.168.1.100\"\n port = 22\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport com.pulumi.vault.os.SecretBackendHost;\nimport com.pulumi.vault.os.SecretBackendHostArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Mount(\"os\", MountArgs.builder()\n .path(\"os\")\n .type(\"vault-plugin-secrets-os\")\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(os.path())\n .build());\n\n var example = new SecretBackendHost(\"example\", SecretBackendHostArgs.builder()\n .mount(osSecretBackend.mount())\n .name(\"web-server-01\")\n .address(\"192.168.1.100\")\n .port(22)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Mount\n properties:\n path: os\n type: vault-plugin-secrets-os\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${os.path}\n example:\n type: vault:os:SecretBackendHost\n properties:\n mount: ${osSecretBackend.mount}\n name: web-server-01\n address: 192.168.1.100\n port: 22\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Advanced Host Configuration\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Mount(\"os\", {\n path: \"os\",\n type: \"vault-plugin-secrets-os\",\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: os.path});\nconst production = new vault.os.SecretBackendHost(\"production\", {\n mount: osSecretBackend.mount,\n name: \"prod-db-01\",\n address: \"10.0.1.50\",\n port: 2222,\n rotationSchedule: \"0 2 * * *\",\n rotationWindow: 3600,\n customMetadata: {\n environment: \"production\",\n team: \"database\",\n criticality: \"high\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Mount(\"os\",\n path=\"os\",\n type=\"vault-plugin-secrets-os\")\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os.path)\nproduction = vault.os.SecretBackendHost(\"production\",\n mount=os_secret_backend.mount,\n name=\"prod-db-01\",\n address=\"10.0.1.50\",\n port=2222,\n rotation_schedule=\"0 2 * * *\",\n rotation_window=3600,\n custom_metadata={\n \"environment\": \"production\",\n \"team\": \"database\",\n \"criticality\": \"high\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = \"vault-plugin-secrets-os\",\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = os.Path,\n });\n\n var production = new Vault.Os.SecretBackendHost(\"production\", new()\n {\n Mount = osSecretBackend.Mount,\n Name = \"prod-db-01\",\n Address = \"10.0.1.50\",\n Port = 2222,\n RotationSchedule = \"0 2 * * *\",\n RotationWindow = 3600,\n CustomMetadata = \n {\n { \"environment\", \"production\" },\n { \"team\", \"database\" },\n { \"criticality\", \"high\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosSecretBackend, err := os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: os2.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackendHost(ctx, \"production\", \u0026os.SecretBackendHostArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tName: pulumi.String(\"prod-db-01\"),\n\t\t\tAddress: pulumi.String(\"10.0.1.50\"),\n\t\t\tPort: pulumi.Int(2222),\n\t\t\tRotationSchedule: pulumi.String(\"0 2 * * *\"),\n\t\t\tRotationWindow: pulumi.Int(3600),\n\t\t\tCustomMetadata: pulumi.StringMap{\n\t\t\t\t\"environment\": pulumi.String(\"production\"),\n\t\t\t\t\"team\": pulumi.String(\"database\"),\n\t\t\t\t\"criticality\": pulumi.String(\"high\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = \"vault-plugin-secrets-os\"\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\nresource \"vault_os_secretbackendhost\" \"production\" {\n mount = vault_os_secretbackend.os.mount\n name = \"prod-db-01\"\n address = \"10.0.1.50\"\n port = 2222\n rotation_schedule = \"0 2 * * *\"\n rotation_window = 3600\n custom_metadata = {\n \"environment\" = \"production\"\n \"team\" = \"database\"\n \"criticality\" = \"high\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport com.pulumi.vault.os.SecretBackendHost;\nimport com.pulumi.vault.os.SecretBackendHostArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Mount(\"os\", MountArgs.builder()\n .path(\"os\")\n .type(\"vault-plugin-secrets-os\")\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(os.path())\n .build());\n\n var production = new SecretBackendHost(\"production\", SecretBackendHostArgs.builder()\n .mount(osSecretBackend.mount())\n .name(\"prod-db-01\")\n .address(\"10.0.1.50\")\n .port(2222)\n .rotationSchedule(\"0 2 * * *\")\n .rotationWindow(3600)\n .customMetadata(Map.ofEntries(\n Map.entry(\"environment\", \"production\"),\n Map.entry(\"team\", \"database\"),\n Map.entry(\"criticality\", \"high\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Mount\n properties:\n path: os\n type: vault-plugin-secrets-os\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${os.path}\n production:\n type: vault:os:SecretBackendHost\n properties:\n mount: ${osSecretBackend.mount}\n name: prod-db-01\n address: 10.0.1.50\n port: 2222\n rotationSchedule: 0 2 * * *\n rotationWindow: 3600\n customMetadata:\n environment: production\n team: database\n criticality: high\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Host with SSH Host Key\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst os = new vault.Mount(\"os\", {\n path: \"os\",\n type: \"vault-plugin-secrets-os\",\n});\nconst osSecretBackend = new vault.os.SecretBackend(\"os\", {mount: os.path});\nconst secure = new vault.os.SecretBackendHost(\"secure\", {\n mount: osSecretBackend.mount,\n name: \"secure-host\",\n address: \"192.168.1.200\",\n port: 22,\n sshHostKey: \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nos = vault.Mount(\"os\",\n path=\"os\",\n type=\"vault-plugin-secrets-os\")\nos_secret_backend = vault.os.SecretBackend(\"os\", mount=os.path)\nsecure = vault.os.SecretBackendHost(\"secure\",\n mount=os_secret_backend.mount,\n name=\"secure-host\",\n address=\"192.168.1.200\",\n port=22,\n ssh_host_key=\"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var os = new Vault.Mount(\"os\", new()\n {\n Path = \"os\",\n Type = \"vault-plugin-secrets-os\",\n });\n\n var osSecretBackend = new Vault.Os.SecretBackend(\"os\", new()\n {\n Mount = os.Path,\n });\n\n var secure = new Vault.Os.SecretBackendHost(\"secure\", new()\n {\n Mount = osSecretBackend.Mount,\n Name = \"secure-host\",\n Address = \"192.168.1.200\",\n Port = 22,\n SshHostKey = \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/os\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tos2, err := vault.NewMount(ctx, \"os\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"os\"),\n\t\t\tType: pulumi.String(\"vault-plugin-secrets-os\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tosSecretBackend, err := os.NewSecretBackend(ctx, \"os\", \u0026os.SecretBackendArgs{\n\t\t\tMount: os2.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = os.NewSecretBackendHost(ctx, \"secure\", \u0026os.SecretBackendHostArgs{\n\t\t\tMount: osSecretBackend.Mount,\n\t\t\tName: pulumi.String(\"secure-host\"),\n\t\t\tAddress: pulumi.String(\"192.168.1.200\"),\n\t\t\tPort: pulumi.Int(22),\n\t\t\tSshHostKey: pulumi.String(\"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"os\" {\n path = \"os\"\n type = \"vault-plugin-secrets-os\"\n}\nresource \"vault_os_secretbackend\" \"os\" {\n mount = vault_mount.os.path\n}\nresource \"vault_os_secretbackendhost\" \"secure\" {\n mount = vault_os_secretbackend.os.mount\n name = \"secure-host\"\n address = \"192.168.1.200\"\n port = 22\n ssh_host_key = \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.os.SecretBackend;\nimport com.pulumi.vault.os.SecretBackendArgs;\nimport com.pulumi.vault.os.SecretBackendHost;\nimport com.pulumi.vault.os.SecretBackendHostArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var os = new Mount(\"os\", MountArgs.builder()\n .path(\"os\")\n .type(\"vault-plugin-secrets-os\")\n .build());\n\n var osSecretBackend = new SecretBackend(\"osSecretBackend\", SecretBackendArgs.builder()\n .mount(os.path())\n .build());\n\n var secure = new SecretBackendHost(\"secure\", SecretBackendHostArgs.builder()\n .mount(osSecretBackend.mount())\n .name(\"secure-host\")\n .address(\"192.168.1.200\")\n .port(22)\n .sshHostKey(\"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n os:\n type: vault:Mount\n properties:\n path: os\n type: vault-plugin-secrets-os\n osSecretBackend:\n type: vault:os:SecretBackend\n name: os\n properties:\n mount: ${os.path}\n secure:\n type: vault:os:SecretBackendHost\n properties:\n mount: ${osSecretBackend.mount}\n name: secure-host\n address: 192.168.1.200\n port: 22\n sshHostKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Notes\n\n* This resource requires Vault 2.0.0 or later.\n* The OS Secrets Engine plugin must be registered before the mount is enabled. Use \u003cspan pulumi-lang-nodejs=\"`vault.Plugin`\" pulumi-lang-dotnet=\"`vault.Plugin`\" pulumi-lang-go=\"`Plugin`\" pulumi-lang-python=\"`Plugin`\" pulumi-lang-yaml=\"`vault.Plugin`\" pulumi-lang-java=\"`vault.Plugin`\" pulumi-lang-hcl=\"`vault_plugin`\"\u003e`vault.Plugin`\u003c/span\u003e to manage catalog registration when appropriate.\n* Use \u003cspan pulumi-lang-nodejs=\"`vault.Mount`\" pulumi-lang-dotnet=\"`vault.Mount`\" pulumi-lang-go=\"`Mount`\" pulumi-lang-python=\"`Mount`\" pulumi-lang-yaml=\"`vault.Mount`\" pulumi-lang-java=\"`vault.Mount`\" pulumi-lang-hcl=\"`vault_mount`\"\u003e`vault.Mount`\u003c/span\u003e to create, tune, or remove the OS Secrets Engine mount before managing hosts with this resource.\n* The host must be configured before accounts can be created on it.\n* When \u003cspan pulumi-lang-nodejs=\"`sshHostKey`\" pulumi-lang-dotnet=\"`SshHostKey`\" pulumi-lang-go=\"`sshHostKey`\" pulumi-lang-python=\"`ssh_host_key`\" pulumi-lang-yaml=\"`sshHostKey`\" pulumi-lang-java=\"`sshHostKey`\" pulumi-lang-hcl=\"`ssh_host_key`\"\u003e`sshHostKey`\u003c/span\u003e is not provided, the backend's \u003cspan pulumi-lang-nodejs=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-dotnet=\"`SshHostKeyTrustOnFirstUse`\" pulumi-lang-go=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-python=\"`ssh_host_key_trust_on_first_use`\" pulumi-lang-yaml=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-java=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-hcl=\"`ssh_host_key_trust_on_first_use`\"\u003e`sshHostKeyTrustOnFirstUse`\u003c/span\u003e setting determines whether the host key will be automatically trusted on first connection.\n* Use either \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n* Custom metadata is stored alongside the host configuration and can be used for organizational purposes, but does not affect host behavior.\n* Changing \u003cspan pulumi-lang-nodejs=\"`mount`\" pulumi-lang-dotnet=\"`Mount`\" pulumi-lang-go=\"`mount`\" pulumi-lang-python=\"`mount`\" pulumi-lang-yaml=\"`mount`\" pulumi-lang-java=\"`mount`\" pulumi-lang-hcl=\"`mount`\"\u003e`mount`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e will cause the resource to be recreated.\n\n## Import\n\nOS Secret backend host can be imported using the format `\u003cmount\u003e/hosts/\u003cname\u003e`, e.g.\n\n```sh\n$ pulumi import vault:os/secretBackendHost:SecretBackendHost example os/hosts/web-server-01\n```\n\n", "properties": { "address": { "type": "string", "description": "The address of the host (IP address or hostname).\n" }, "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string key-value pairs for storing custom metadata about the host.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Disables automated rotation for the host.\n" }, "mount": { "type": "string", "description": "The path where the OS secrets engine is mounted.\n" }, "name": { "type": "string", "description": "Unique name for the host within the mount.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordPolicy": { "type": "string", "description": "The password policy inherited by accounts on this host unless overridden at the account level.\n" }, "port": { "type": "integer", "description": "The port to connect to on the host. Defaults to \u003cspan pulumi-lang-nodejs=\"`22`\" pulumi-lang-dotnet=\"`22`\" pulumi-lang-go=\"`22`\" pulumi-lang-python=\"`22`\" pulumi-lang-yaml=\"`22`\" pulumi-lang-java=\"`22`\" pulumi-lang-hcl=\"`22`\"\u003e`22`\u003c/span\u003e.\n" }, "rotationPeriod": { "type": "integer", "description": "How often to rotate credentials, in seconds. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "rotationSchedule": { "type": "string", "description": "A cron-style schedule for credential rotation (for example, `\"0 2 * * *\"`). Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e.\n" }, "rotationWindow": { "type": "integer", "description": "The rotation window, in seconds. This is typically used with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "sshHostKey": { "type": "string", "description": "The SSH host key for the remote host. If not provided and \u003cspan pulumi-lang-nodejs=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-dotnet=\"`SshHostKeyTrustOnFirstUse`\" pulumi-lang-go=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-python=\"`ssh_host_key_trust_on_first_use`\" pulumi-lang-yaml=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-java=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-hcl=\"`ssh_host_key_trust_on_first_use`\"\u003e`sshHostKeyTrustOnFirstUse`\u003c/span\u003e is enabled on the backend, Vault can learn and persist the key on first connection.\n" } }, "required": [ "address", "disableAutomatedRotation", "mount", "name", "port", "rotationPeriod", "rotationSchedule", "rotationWindow", "sshHostKey" ], "inputProperties": { "address": { "type": "string", "description": "The address of the host (IP address or hostname).\n" }, "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string key-value pairs for storing custom metadata about the host.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Disables automated rotation for the host.\n" }, "mount": { "type": "string", "description": "The path where the OS secrets engine is mounted.\n" }, "name": { "type": "string", "description": "Unique name for the host within the mount.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordPolicy": { "type": "string", "description": "The password policy inherited by accounts on this host unless overridden at the account level.\n" }, "port": { "type": "integer", "description": "The port to connect to on the host. Defaults to \u003cspan pulumi-lang-nodejs=\"`22`\" pulumi-lang-dotnet=\"`22`\" pulumi-lang-go=\"`22`\" pulumi-lang-python=\"`22`\" pulumi-lang-yaml=\"`22`\" pulumi-lang-java=\"`22`\" pulumi-lang-hcl=\"`22`\"\u003e`22`\u003c/span\u003e.\n" }, "rotationPeriod": { "type": "integer", "description": "How often to rotate credentials, in seconds. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "rotationSchedule": { "type": "string", "description": "A cron-style schedule for credential rotation (for example, `\"0 2 * * *\"`). Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e.\n" }, "rotationWindow": { "type": "integer", "description": "The rotation window, in seconds. This is typically used with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "sshHostKey": { "type": "string", "description": "The SSH host key for the remote host. If not provided and \u003cspan pulumi-lang-nodejs=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-dotnet=\"`SshHostKeyTrustOnFirstUse`\" pulumi-lang-go=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-python=\"`ssh_host_key_trust_on_first_use`\" pulumi-lang-yaml=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-java=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-hcl=\"`ssh_host_key_trust_on_first_use`\"\u003e`sshHostKeyTrustOnFirstUse`\u003c/span\u003e is enabled on the backend, Vault can learn and persist the key on first connection.\n" } }, "requiredInputs": [ "address", "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendHost resources.\n", "properties": { "address": { "type": "string", "description": "The address of the host (IP address or hostname).\n" }, "customMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string key-value pairs for storing custom metadata about the host.\n" }, "disableAutomatedRotation": { "type": "boolean", "description": "Disables automated rotation for the host.\n" }, "mount": { "type": "string", "description": "The path where the OS secrets engine is mounted.\n" }, "name": { "type": "string", "description": "Unique name for the host within the mount.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "passwordPolicy": { "type": "string", "description": "The password policy inherited by accounts on this host unless overridden at the account level.\n" }, "port": { "type": "integer", "description": "The port to connect to on the host. Defaults to \u003cspan pulumi-lang-nodejs=\"`22`\" pulumi-lang-dotnet=\"`22`\" pulumi-lang-go=\"`22`\" pulumi-lang-python=\"`22`\" pulumi-lang-yaml=\"`22`\" pulumi-lang-java=\"`22`\" pulumi-lang-hcl=\"`22`\"\u003e`22`\u003c/span\u003e.\n" }, "rotationPeriod": { "type": "integer", "description": "How often to rotate credentials, in seconds. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "rotationSchedule": { "type": "string", "description": "A cron-style schedule for credential rotation (for example, `\"0 2 * * *\"`). Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`rotationPeriod`\" pulumi-lang-dotnet=\"`RotationPeriod`\" pulumi-lang-go=\"`rotationPeriod`\" pulumi-lang-python=\"`rotation_period`\" pulumi-lang-yaml=\"`rotationPeriod`\" pulumi-lang-java=\"`rotationPeriod`\" pulumi-lang-hcl=\"`rotation_period`\"\u003e`rotationPeriod`\u003c/span\u003e.\n" }, "rotationWindow": { "type": "integer", "description": "The rotation window, in seconds. This is typically used with \u003cspan pulumi-lang-nodejs=\"`rotationSchedule`\" pulumi-lang-dotnet=\"`RotationSchedule`\" pulumi-lang-go=\"`rotationSchedule`\" pulumi-lang-python=\"`rotation_schedule`\" pulumi-lang-yaml=\"`rotationSchedule`\" pulumi-lang-java=\"`rotationSchedule`\" pulumi-lang-hcl=\"`rotation_schedule`\"\u003e`rotationSchedule`\u003c/span\u003e.\n" }, "sshHostKey": { "type": "string", "description": "The SSH host key for the remote host. If not provided and \u003cspan pulumi-lang-nodejs=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-dotnet=\"`SshHostKeyTrustOnFirstUse`\" pulumi-lang-go=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-python=\"`ssh_host_key_trust_on_first_use`\" pulumi-lang-yaml=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-java=\"`sshHostKeyTrustOnFirstUse`\" pulumi-lang-hcl=\"`ssh_host_key_trust_on_first_use`\"\u003e`sshHostKeyTrustOnFirstUse`\u003c/span\u003e is enabled on the backend, Vault can learn and persist the key on first connection.\n" } }, "type": "object" } }, "vault:pkiSecret/backendAcmeEab:BackendAcmeEab": { "description": "Allows creating ACME EAB (External Account Binding) tokens and deleting unused ones.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.Mount(\"test\", {\n path: \"pki\",\n type: \"pki\",\n description: \"PKI secret engine mount\",\n});\nconst testBackendAcmeEab = new vault.pkisecret.BackendAcmeEab(\"test\", {backend: test.path});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.Mount(\"test\",\n path=\"pki\",\n type=\"pki\",\n description=\"PKI secret engine mount\")\ntest_backend_acme_eab = vault.pkisecret.BackendAcmeEab(\"test\", backend=test.path)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Mount(\"test\", new()\n {\n Path = \"pki\",\n Type = \"pki\",\n Description = \"PKI secret engine mount\",\n });\n\n var testBackendAcmeEab = new Vault.PkiSecret.BackendAcmeEab(\"test\", new()\n {\n Backend = test.Path,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\ttest, err := vault.NewMount(ctx, \"test\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"PKI secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewBackendAcmeEab(ctx, \"test\", \u0026pkisecret.BackendAcmeEabArgs{\n\t\t\tBackend: test.Path,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"test\" {\n path = \"pki\"\n type = \"pki\"\n description = \"PKI secret engine mount\"\n}\nresource \"vault_pkisecret_backendacmeeab\" \"test\" {\n backend = vault_mount.test.path\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.BackendAcmeEab;\nimport com.pulumi.vault.pkiSecret.BackendAcmeEabArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new Mount(\"test\", MountArgs.builder()\n .path(\"pki\")\n .type(\"pki\")\n .description(\"PKI secret engine mount\")\n .build());\n\n var testBackendAcmeEab = new BackendAcmeEab(\"testBackendAcmeEab\", BackendAcmeEabArgs.builder()\n .backend(test.path())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n description: PKI secret engine mount\n testBackendAcmeEab:\n type: vault:pkiSecret:BackendAcmeEab\n name: test\n properties:\n backend: ${test.path}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAs EAB tokens are only available on initial creation there is no possibility to \nimport or update this resource.\n\n", "properties": { "acmeDirectory": { "type": "string", "description": "The ACME directory to which the key belongs\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\ncreate the EAB token within, with no leading or trailing `/`s.\n" }, "createdOn": { "type": "string", "description": "An RFC3339 formatted date time when the EAB token was created\n" }, "eabId": { "type": "string", "description": "The identifier of a specific ACME EAB token\n" }, "issuer": { "type": "string", "description": "Create an EAB token that is specific to an issuer's ACME directory.\n" }, "key": { "type": "string", "description": "The EAB token\n", "secret": true }, "keyType": { "type": "string", "description": "The key type of the EAB key\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "role": { "type": "string", "description": "Create an EAB token that is specific to a role's ACME directory.\n\n**NOTE**: Within Vault ACME there are different ACME directories which an EAB token is associated with;\n\n1. Default directory (`pki/acme/`) - Do not specify a value for issuer nor role parameters.\n2. Issuer specific (`pki/issuer/:issuer_ref/acme/`) - Specify a value for the issuer parameter\n3. Role specific (`pki/roles/:role/acme/`) - Specify a value for the role parameter\n4. Issuer and Role specific (`pki/issuer/:issuer_ref/roles/:role/acme/`) - Specify a value for both the issuer and role parameters\n" } }, "required": [ "acmeDirectory", "backend", "createdOn", "eabId", "key", "keyType" ], "inputProperties": { "backend": { "type": "string", "description": "The path to the PKI secret backend to\ncreate the EAB token within, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "issuer": { "type": "string", "description": "Create an EAB token that is specific to an issuer's ACME directory.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "Create an EAB token that is specific to a role's ACME directory.\n\n**NOTE**: Within Vault ACME there are different ACME directories which an EAB token is associated with;\n\n1. Default directory (`pki/acme/`) - Do not specify a value for issuer nor role parameters.\n2. Issuer specific (`pki/issuer/:issuer_ref/acme/`) - Specify a value for the issuer parameter\n3. Role specific (`pki/roles/:role/acme/`) - Specify a value for the role parameter\n4. Issuer and Role specific (`pki/issuer/:issuer_ref/roles/:role/acme/`) - Specify a value for both the issuer and role parameters\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering BackendAcmeEab resources.\n", "properties": { "acmeDirectory": { "type": "string", "description": "The ACME directory to which the key belongs\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\ncreate the EAB token within, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "createdOn": { "type": "string", "description": "An RFC3339 formatted date time when the EAB token was created\n" }, "eabId": { "type": "string", "description": "The identifier of a specific ACME EAB token\n" }, "issuer": { "type": "string", "description": "Create an EAB token that is specific to an issuer's ACME directory.\n", "willReplaceOnChanges": true }, "key": { "type": "string", "description": "The EAB token\n", "secret": true }, "keyType": { "type": "string", "description": "The key type of the EAB key\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "role": { "type": "string", "description": "Create an EAB token that is specific to a role's ACME directory.\n\n**NOTE**: Within Vault ACME there are different ACME directories which an EAB token is associated with;\n\n1. Default directory (`pki/acme/`) - Do not specify a value for issuer nor role parameters.\n2. Issuer specific (`pki/issuer/:issuer_ref/acme/`) - Specify a value for the issuer parameter\n3. Role specific (`pki/roles/:role/acme/`) - Specify a value for the role parameter\n4. Issuer and Role specific (`pki/issuer/:issuer_ref/roles/:role/acme/`) - Specify a value for both the issuer and role parameters\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/backendConfigAcme:BackendConfigAcme": { "description": "Allows setting the ACME server configuration used by specified mount.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki\",\n type: \"pki\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 86400,\n});\nconst pkiConfigCluster = new vault.pkisecret.BackendConfigCluster(\"pki_config_cluster\", {\n backend: pki.path,\n path: \"http://127.0.0.1:8200/v1/pki\",\n aiaPath: \"http://127.0.0.1:8200/v1/pki\",\n});\nconst example = new vault.pkisecret.BackendConfigAcme(\"example\", {\n backend: pki.path,\n enabled: true,\n allowedIssuers: [\"*\"],\n allowedRoles: [\"*\"],\n allowRoleExtKeyUsage: false,\n defaultDirectoryPolicy: \"sign-verbatim\",\n dnsResolver: \"\",\n eabPolicy: \"not-required\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki = vault.Mount(\"pki\",\n path=\"pki\",\n type=\"pki\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=86400)\npki_config_cluster = vault.pkisecret.BackendConfigCluster(\"pki_config_cluster\",\n backend=pki.path,\n path=\"http://127.0.0.1:8200/v1/pki\",\n aia_path=\"http://127.0.0.1:8200/v1/pki\")\nexample = vault.pkisecret.BackendConfigAcme(\"example\",\n backend=pki.path,\n enabled=True,\n allowed_issuers=[\"*\"],\n allowed_roles=[\"*\"],\n allow_role_ext_key_usage=False,\n default_directory_policy=\"sign-verbatim\",\n dns_resolver=\"\",\n eab_policy=\"not-required\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki\",\n Type = \"pki\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 86400,\n });\n\n var pkiConfigCluster = new Vault.PkiSecret.BackendConfigCluster(\"pki_config_cluster\", new()\n {\n Backend = pki.Path,\n Path = \"http://127.0.0.1:8200/v1/pki\",\n AiaPath = \"http://127.0.0.1:8200/v1/pki\",\n });\n\n var example = new Vault.PkiSecret.BackendConfigAcme(\"example\", new()\n {\n Backend = pki.Path,\n Enabled = true,\n AllowedIssuers = new[]\n {\n \"*\",\n },\n AllowedRoles = new[]\n {\n \"*\",\n },\n AllowRoleExtKeyUsage = false,\n DefaultDirectoryPolicy = \"sign-verbatim\",\n DnsResolver = \"\",\n EabPolicy = \"not-required\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewBackendConfigCluster(ctx, \"pki_config_cluster\", \u0026pkisecret.BackendConfigClusterArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tPath: pulumi.String(\"http://127.0.0.1:8200/v1/pki\"),\n\t\t\tAiaPath: pulumi.String(\"http://127.0.0.1:8200/v1/pki\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewBackendConfigAcme(ctx, \"example\", \u0026pkisecret.BackendConfigAcmeArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tEnabled: pulumi.Bool(true),\n\t\t\tAllowedIssuers: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*\"),\n\t\t\t},\n\t\t\tAllowedRoles: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*\"),\n\t\t\t},\n\t\t\tAllowRoleExtKeyUsage: pulumi.Bool(false),\n\t\t\tDefaultDirectoryPolicy: pulumi.String(\"sign-verbatim\"),\n\t\t\tDnsResolver: pulumi.String(\"\"),\n\t\t\tEabPolicy: pulumi.String(\"not-required\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_backendconfigcluster\" \"pki_config_cluster\" {\n backend = vault_mount.pki.path\n path = \"http://127.0.0.1:8200/v1/pki\"\n aia_path = \"http://127.0.0.1:8200/v1/pki\"\n}\nresource \"vault_pkisecret_backendconfigacme\" \"example\" {\n backend = vault_mount.pki.path\n enabled = true\n allowed_issuers = [\"*\"]\n allowed_roles = [\"*\"]\n allow_role_ext_key_usage = false\n default_directory_policy = \"sign-verbatim\"\n dns_resolver = \"\"\n eab_policy = \"not-required\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.BackendConfigCluster;\nimport com.pulumi.vault.pkiSecret.BackendConfigClusterArgs;\nimport com.pulumi.vault.pkiSecret.BackendConfigAcme;\nimport com.pulumi.vault.pkiSecret.BackendConfigAcmeArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki\")\n .type(\"pki\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(86400)\n .build());\n\n var pkiConfigCluster = new BackendConfigCluster(\"pkiConfigCluster\", BackendConfigClusterArgs.builder()\n .backend(pki.path())\n .path(\"http://127.0.0.1:8200/v1/pki\")\n .aiaPath(\"http://127.0.0.1:8200/v1/pki\")\n .build());\n\n var example = new BackendConfigAcme(\"example\", BackendConfigAcmeArgs.builder()\n .backend(pki.path())\n .enabled(true)\n .allowedIssuers(\"*\")\n .allowedRoles(\"*\")\n .allowRoleExtKeyUsage(false)\n .defaultDirectoryPolicy(\"sign-verbatim\")\n .dnsResolver(\"\")\n .eabPolicy(\"not-required\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n pkiConfigCluster:\n type: vault:pkiSecret:BackendConfigCluster\n name: pki_config_cluster\n properties:\n backend: ${pki.path}\n path: http://127.0.0.1:8200/v1/pki\n aiaPath: http://127.0.0.1:8200/v1/pki\n example:\n type: vault:pkiSecret:BackendConfigAcme\n properties:\n backend: ${pki.path}\n enabled: true\n allowedIssuers:\n - '*'\n allowedRoles:\n - '*'\n allowRoleExtKeyUsage: false\n defaultDirectoryPolicy: sign-verbatim\n dnsResolver: \"\"\n eabPolicy: not-required\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe ACME configuration can be imported using the resource's \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e. \nIn the case of the example above the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e would be `pki/config/acme`, \nwhere the \u003cspan pulumi-lang-nodejs=\"`pki`\" pulumi-lang-dotnet=\"`Pki`\" pulumi-lang-go=\"`pki`\" pulumi-lang-python=\"`pki`\" pulumi-lang-yaml=\"`pki`\" pulumi-lang-java=\"`pki`\" pulumi-lang-hcl=\"`pki`\"\u003e`pki`\u003c/span\u003e component is the resource's \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/backendConfigAcme:BackendConfigAcme example pki/config/acme\n```\n\n", "properties": { "allowRoleExtKeyUsage": { "type": "boolean", "description": "Specifies whether the ExtKeyUsage field from a role is used. **Vault 1.14.1+**\n" }, "allowedIssuers": { "type": "array", "items": { "type": "string" }, "description": "Specifies which issuers are allowed for use with ACME.\n" }, "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "Specifies which roles are allowed for use with ACME.\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n" }, "challengeExcludedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of CIDR blocks specifying IP ranges that are not allowed to complete ACME challenges. **Vault 1.19.16+**\n" }, "challengePermittedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of CIDR blocks specifying IP ranges that are allowed to complete ACME challenges. **Vault 1.19.16+**\n" }, "defaultDirectoryPolicy": { "type": "string", "description": "Specifies the policy to be used for non-role-qualified ACME requests.\nAllowed values are \u003cspan pulumi-lang-nodejs=\"`forbid`\" pulumi-lang-dotnet=\"`Forbid`\" pulumi-lang-go=\"`forbid`\" pulumi-lang-python=\"`forbid`\" pulumi-lang-yaml=\"`forbid`\" pulumi-lang-java=\"`forbid`\" pulumi-lang-hcl=\"`forbid`\"\u003e`forbid`\u003c/span\u003e, `sign-verbatim`, `role:\u003crole_name\u003e`, `external-policy` or `external-policy:\u003cpolicy\u003e`.\n" }, "dnsResolver": { "type": "string", "description": "DNS resolver to use for domain resolution on this mount.\nMust be in the format `\u003chost\u003e:\u003cport\u003e`, with both parts mandatory.\n" }, "eabPolicy": { "type": "string", "description": "Specifies the policy to use for external account binding behaviour.\nAllowed values are `not-required`, `new-account-required` or `always-required`.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether ACME is enabled.\n" }, "maxTtl": { "type": "integer", "description": "The maximum TTL in seconds for certificates issued by ACME. **Vault 1.17.0+**\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "allowedIssuers", "allowedRoles", "backend", "defaultDirectoryPolicy", "eabPolicy", "enabled", "maxTtl" ], "inputProperties": { "allowRoleExtKeyUsage": { "type": "boolean", "description": "Specifies whether the ExtKeyUsage field from a role is used. **Vault 1.14.1+**\n" }, "allowedIssuers": { "type": "array", "items": { "type": "string" }, "description": "Specifies which issuers are allowed for use with ACME.\n" }, "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "Specifies which roles are allowed for use with ACME.\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "challengeExcludedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of CIDR blocks specifying IP ranges that are not allowed to complete ACME challenges. **Vault 1.19.16+**\n" }, "challengePermittedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of CIDR blocks specifying IP ranges that are allowed to complete ACME challenges. **Vault 1.19.16+**\n" }, "defaultDirectoryPolicy": { "type": "string", "description": "Specifies the policy to be used for non-role-qualified ACME requests.\nAllowed values are \u003cspan pulumi-lang-nodejs=\"`forbid`\" pulumi-lang-dotnet=\"`Forbid`\" pulumi-lang-go=\"`forbid`\" pulumi-lang-python=\"`forbid`\" pulumi-lang-yaml=\"`forbid`\" pulumi-lang-java=\"`forbid`\" pulumi-lang-hcl=\"`forbid`\"\u003e`forbid`\u003c/span\u003e, `sign-verbatim`, `role:\u003crole_name\u003e`, `external-policy` or `external-policy:\u003cpolicy\u003e`.\n" }, "dnsResolver": { "type": "string", "description": "DNS resolver to use for domain resolution on this mount.\nMust be in the format `\u003chost\u003e:\u003cport\u003e`, with both parts mandatory.\n" }, "eabPolicy": { "type": "string", "description": "Specifies the policy to use for external account binding behaviour.\nAllowed values are `not-required`, `new-account-required` or `always-required`.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether ACME is enabled.\n" }, "maxTtl": { "type": "integer", "description": "The maximum TTL in seconds for certificates issued by ACME. **Vault 1.17.0+**\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "enabled" ], "stateInputs": { "description": "Input properties used for looking up and filtering BackendConfigAcme resources.\n", "properties": { "allowRoleExtKeyUsage": { "type": "boolean", "description": "Specifies whether the ExtKeyUsage field from a role is used. **Vault 1.14.1+**\n" }, "allowedIssuers": { "type": "array", "items": { "type": "string" }, "description": "Specifies which issuers are allowed for use with ACME.\n" }, "allowedRoles": { "type": "array", "items": { "type": "string" }, "description": "Specifies which roles are allowed for use with ACME.\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "challengeExcludedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of CIDR blocks specifying IP ranges that are not allowed to complete ACME challenges. **Vault 1.19.16+**\n" }, "challengePermittedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of CIDR blocks specifying IP ranges that are allowed to complete ACME challenges. **Vault 1.19.16+**\n" }, "defaultDirectoryPolicy": { "type": "string", "description": "Specifies the policy to be used for non-role-qualified ACME requests.\nAllowed values are \u003cspan pulumi-lang-nodejs=\"`forbid`\" pulumi-lang-dotnet=\"`Forbid`\" pulumi-lang-go=\"`forbid`\" pulumi-lang-python=\"`forbid`\" pulumi-lang-yaml=\"`forbid`\" pulumi-lang-java=\"`forbid`\" pulumi-lang-hcl=\"`forbid`\"\u003e`forbid`\u003c/span\u003e, `sign-verbatim`, `role:\u003crole_name\u003e`, `external-policy` or `external-policy:\u003cpolicy\u003e`.\n" }, "dnsResolver": { "type": "string", "description": "DNS resolver to use for domain resolution on this mount.\nMust be in the format `\u003chost\u003e:\u003cport\u003e`, with both parts mandatory.\n" }, "eabPolicy": { "type": "string", "description": "Specifies the policy to use for external account binding behaviour.\nAllowed values are `not-required`, `new-account-required` or `always-required`.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether ACME is enabled.\n" }, "maxTtl": { "type": "integer", "description": "The maximum TTL in seconds for certificates issued by ACME. **Vault 1.17.0+**\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/backendConfigAutoTidy:BackendConfigAutoTidy": { "description": "Allows setting the Auto Tidy configuration on a PKI Secret Backend\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki\",\n type: \"pki\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 86400,\n});\nconst test = new vault.pkisecret.BackendConfigAutoTidy(\"test\", {\n backend: pki.path,\n enabled: true,\n tidyCertStore: true,\n intervalDuration: \"1h\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki = vault.Mount(\"pki\",\n path=\"pki\",\n type=\"pki\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=86400)\ntest = vault.pkisecret.BackendConfigAutoTidy(\"test\",\n backend=pki.path,\n enabled=True,\n tidy_cert_store=True,\n interval_duration=\"1h\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki\",\n Type = \"pki\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 86400,\n });\n\n var test = new Vault.PkiSecret.BackendConfigAutoTidy(\"test\", new()\n {\n Backend = pki.Path,\n Enabled = true,\n TidyCertStore = true,\n IntervalDuration = \"1h\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewBackendConfigAutoTidy(ctx, \"test\", \u0026pkisecret.BackendConfigAutoTidyArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tEnabled: pulumi.Bool(true),\n\t\t\tTidyCertStore: pulumi.Bool(true),\n\t\t\tIntervalDuration: pulumi.String(\"1h\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_backendconfigautotidy\" \"test\" {\n backend = vault_mount.pki.path\n enabled = true\n tidy_cert_store = true\n interval_duration = \"1h\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.BackendConfigAutoTidy;\nimport com.pulumi.vault.pkiSecret.BackendConfigAutoTidyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki\")\n .type(\"pki\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(86400)\n .build());\n\n var test = new BackendConfigAutoTidy(\"test\", BackendConfigAutoTidyArgs.builder()\n .backend(pki.path())\n .enabled(true)\n .tidyCertStore(true)\n .intervalDuration(\"1h\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n test:\n type: vault:pkiSecret:BackendConfigAutoTidy\n properties:\n backend: ${pki.path}\n enabled: true\n tidyCertStore: true\n intervalDuration: 1h\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "acmeAccountSafetyBuffer": { "type": "string", "description": "The amount of time that must pass after creation that an account with no orders is marked revoked, and the amount of time after being marked revoked or deactivated." }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the configuration from, with no leading or trailing `/`s.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether automatic tidy is enabled or not.\n" }, "intervalDuration": { "type": "string", "description": "Interval at which to run an auto-tidy operation. This is the time\nbetween tidy invocations (after one finishes to the start of the next).\n" }, "issuerSafetyBuffer": { "type": "string", "description": "The amount of extra time that must have passed beyond issuer's\nexpiration before it is removed from the backend storage.\n" }, "maintainStoredCertificateCounts": { "type": "boolean", "description": "This configures whether stored certificate are\ncounted upon initialization of the backend, and whether during normal operation, a running count\nof certificates stored is maintained.\n" }, "maxStartupBackoffDuration": { "type": "string", "description": "The maximum amount of time auto-tidy will be delayed\nafter startup.\n" }, "minStartupBackoffDuration": { "type": "string", "description": "The minimum amount of time auto-tidy will be delayed\nafter startup.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "pauseDuration": { "type": "string", "description": "The amount of time to wait between processing certificates.\n" }, "publishStoredCertificateCountMetrics": { "type": "boolean", "description": "This configures whether the stored\ncertificate count is published to the metrics consumer.\n" }, "revocationQueueSafetyBuffer": { "type": "string", "description": "The amount of time that must pass from the\ncross-cluster revocation request being initiated to when it will be slated for removal.\n" }, "safetyBuffer": { "type": "string", "description": "The amount of extra time that must have passed beyond certificate\nexpiration before it is removed from the backend storage and/or revocation list.\n" }, "tidyAcme": { "type": "boolean", "description": "Set to true to enable tidying ACME accounts, orders and authorizations.\n" }, "tidyCertMetadata": { "type": "boolean", "description": "Set to true to enable tidying up certificate metadata.\n" }, "tidyCertStore": { "type": "boolean", "description": "Set to true to enable tidying up the certificate store\n" }, "tidyCmpv2NonceStore": { "type": "boolean", "description": "Set to true to enable tidying up the CMPv2 nonce store.\n" }, "tidyCrossClusterRevokedCerts": { "type": "boolean", "description": "Set to true to enable tidying up the cross-cluster\nrevoked certificate store.\n" }, "tidyExpiredIssuers": { "type": "boolean", "description": "Set to true to automatically remove expired issuers past the\n\u003cspan pulumi-lang-nodejs=\"`issuerSafetyBuffer`\" pulumi-lang-dotnet=\"`IssuerSafetyBuffer`\" pulumi-lang-go=\"`issuerSafetyBuffer`\" pulumi-lang-python=\"`issuer_safety_buffer`\" pulumi-lang-yaml=\"`issuerSafetyBuffer`\" pulumi-lang-java=\"`issuerSafetyBuffer`\" pulumi-lang-hcl=\"`issuer_safety_buffer`\"\u003e`issuerSafetyBuffer`\u003c/span\u003e. No keys will be removed as part of this operation.\n" }, "tidyMoveLegacyCaBundle": { "type": "boolean", "description": "Set to true to move the legacy \u003cspan pulumi-lang-nodejs=\"`caBundle`\" pulumi-lang-dotnet=\"`CaBundle`\" pulumi-lang-go=\"`caBundle`\" pulumi-lang-python=\"`ca_bundle`\" pulumi-lang-yaml=\"`caBundle`\" pulumi-lang-java=\"`caBundle`\" pulumi-lang-hcl=\"`ca_bundle`\"\u003e`caBundle`\u003c/span\u003e from\n`/config/ca_bundle` to `/config/ca_bundle.bak`.\n" }, "tidyRevocationQueue": { "type": "boolean", "description": "Set to true to remove stale revocation queue entries that\nhaven't been confirmed by any active cluster.\n" }, "tidyRevokedCertIssuerAssociations": { "type": "boolean", "description": "Set to true to validate issuer associations\non revocation entries. This helps increase the performance of CRL building and OCSP responses.\n" }, "tidyRevokedCerts": { "type": "boolean", "description": "Set to true to remove all invalid and expired certificates from\nstorage. A revoked storage entry is considered invalid if the entry is empty, or the value within\nthe entry is empty. If a certificate is removed due to expiry, the entry will also be removed from\nthe CRL, and the CRL will be rotated.\n" } }, "required": [ "acmeAccountSafetyBuffer", "backend", "enabled", "intervalDuration", "issuerSafetyBuffer", "maxStartupBackoffDuration", "minStartupBackoffDuration", "pauseDuration", "revocationQueueSafetyBuffer", "safetyBuffer" ], "inputProperties": { "acmeAccountSafetyBuffer": { "type": "string", "description": "The amount of time that must pass after creation that an account with no orders is marked revoked, and the amount of time after being marked revoked or deactivated." }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the configuration from, with no leading or trailing `/`s.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether automatic tidy is enabled or not.\n" }, "intervalDuration": { "type": "string", "description": "Interval at which to run an auto-tidy operation. This is the time\nbetween tidy invocations (after one finishes to the start of the next).\n" }, "issuerSafetyBuffer": { "type": "string", "description": "The amount of extra time that must have passed beyond issuer's\nexpiration before it is removed from the backend storage.\n" }, "maintainStoredCertificateCounts": { "type": "boolean", "description": "This configures whether stored certificate are\ncounted upon initialization of the backend, and whether during normal operation, a running count\nof certificates stored is maintained.\n" }, "maxStartupBackoffDuration": { "type": "string", "description": "The maximum amount of time auto-tidy will be delayed\nafter startup.\n" }, "minStartupBackoffDuration": { "type": "string", "description": "The minimum amount of time auto-tidy will be delayed\nafter startup.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "pauseDuration": { "type": "string", "description": "The amount of time to wait between processing certificates.\n" }, "publishStoredCertificateCountMetrics": { "type": "boolean", "description": "This configures whether the stored\ncertificate count is published to the metrics consumer.\n" }, "revocationQueueSafetyBuffer": { "type": "string", "description": "The amount of time that must pass from the\ncross-cluster revocation request being initiated to when it will be slated for removal.\n" }, "safetyBuffer": { "type": "string", "description": "The amount of extra time that must have passed beyond certificate\nexpiration before it is removed from the backend storage and/or revocation list.\n" }, "tidyAcme": { "type": "boolean", "description": "Set to true to enable tidying ACME accounts, orders and authorizations.\n" }, "tidyCertMetadata": { "type": "boolean", "description": "Set to true to enable tidying up certificate metadata.\n" }, "tidyCertStore": { "type": "boolean", "description": "Set to true to enable tidying up the certificate store\n" }, "tidyCmpv2NonceStore": { "type": "boolean", "description": "Set to true to enable tidying up the CMPv2 nonce store.\n" }, "tidyCrossClusterRevokedCerts": { "type": "boolean", "description": "Set to true to enable tidying up the cross-cluster\nrevoked certificate store.\n" }, "tidyExpiredIssuers": { "type": "boolean", "description": "Set to true to automatically remove expired issuers past the\n\u003cspan pulumi-lang-nodejs=\"`issuerSafetyBuffer`\" pulumi-lang-dotnet=\"`IssuerSafetyBuffer`\" pulumi-lang-go=\"`issuerSafetyBuffer`\" pulumi-lang-python=\"`issuer_safety_buffer`\" pulumi-lang-yaml=\"`issuerSafetyBuffer`\" pulumi-lang-java=\"`issuerSafetyBuffer`\" pulumi-lang-hcl=\"`issuer_safety_buffer`\"\u003e`issuerSafetyBuffer`\u003c/span\u003e. No keys will be removed as part of this operation.\n" }, "tidyMoveLegacyCaBundle": { "type": "boolean", "description": "Set to true to move the legacy \u003cspan pulumi-lang-nodejs=\"`caBundle`\" pulumi-lang-dotnet=\"`CaBundle`\" pulumi-lang-go=\"`caBundle`\" pulumi-lang-python=\"`ca_bundle`\" pulumi-lang-yaml=\"`caBundle`\" pulumi-lang-java=\"`caBundle`\" pulumi-lang-hcl=\"`ca_bundle`\"\u003e`caBundle`\u003c/span\u003e from\n`/config/ca_bundle` to `/config/ca_bundle.bak`.\n" }, "tidyRevocationQueue": { "type": "boolean", "description": "Set to true to remove stale revocation queue entries that\nhaven't been confirmed by any active cluster.\n" }, "tidyRevokedCertIssuerAssociations": { "type": "boolean", "description": "Set to true to validate issuer associations\non revocation entries. This helps increase the performance of CRL building and OCSP responses.\n" }, "tidyRevokedCerts": { "type": "boolean", "description": "Set to true to remove all invalid and expired certificates from\nstorage. A revoked storage entry is considered invalid if the entry is empty, or the value within\nthe entry is empty. If a certificate is removed due to expiry, the entry will also be removed from\nthe CRL, and the CRL will be rotated.\n" } }, "requiredInputs": [ "backend", "enabled" ], "stateInputs": { "description": "Input properties used for looking up and filtering BackendConfigAutoTidy resources.\n", "properties": { "acmeAccountSafetyBuffer": { "type": "string", "description": "The amount of time that must pass after creation that an account with no orders is marked revoked, and the amount of time after being marked revoked or deactivated." }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the configuration from, with no leading or trailing `/`s.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether automatic tidy is enabled or not.\n" }, "intervalDuration": { "type": "string", "description": "Interval at which to run an auto-tidy operation. This is the time\nbetween tidy invocations (after one finishes to the start of the next).\n" }, "issuerSafetyBuffer": { "type": "string", "description": "The amount of extra time that must have passed beyond issuer's\nexpiration before it is removed from the backend storage.\n" }, "maintainStoredCertificateCounts": { "type": "boolean", "description": "This configures whether stored certificate are\ncounted upon initialization of the backend, and whether during normal operation, a running count\nof certificates stored is maintained.\n" }, "maxStartupBackoffDuration": { "type": "string", "description": "The maximum amount of time auto-tidy will be delayed\nafter startup.\n" }, "minStartupBackoffDuration": { "type": "string", "description": "The minimum amount of time auto-tidy will be delayed\nafter startup.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "pauseDuration": { "type": "string", "description": "The amount of time to wait between processing certificates.\n" }, "publishStoredCertificateCountMetrics": { "type": "boolean", "description": "This configures whether the stored\ncertificate count is published to the metrics consumer.\n" }, "revocationQueueSafetyBuffer": { "type": "string", "description": "The amount of time that must pass from the\ncross-cluster revocation request being initiated to when it will be slated for removal.\n" }, "safetyBuffer": { "type": "string", "description": "The amount of extra time that must have passed beyond certificate\nexpiration before it is removed from the backend storage and/or revocation list.\n" }, "tidyAcme": { "type": "boolean", "description": "Set to true to enable tidying ACME accounts, orders and authorizations.\n" }, "tidyCertMetadata": { "type": "boolean", "description": "Set to true to enable tidying up certificate metadata.\n" }, "tidyCertStore": { "type": "boolean", "description": "Set to true to enable tidying up the certificate store\n" }, "tidyCmpv2NonceStore": { "type": "boolean", "description": "Set to true to enable tidying up the CMPv2 nonce store.\n" }, "tidyCrossClusterRevokedCerts": { "type": "boolean", "description": "Set to true to enable tidying up the cross-cluster\nrevoked certificate store.\n" }, "tidyExpiredIssuers": { "type": "boolean", "description": "Set to true to automatically remove expired issuers past the\n\u003cspan pulumi-lang-nodejs=\"`issuerSafetyBuffer`\" pulumi-lang-dotnet=\"`IssuerSafetyBuffer`\" pulumi-lang-go=\"`issuerSafetyBuffer`\" pulumi-lang-python=\"`issuer_safety_buffer`\" pulumi-lang-yaml=\"`issuerSafetyBuffer`\" pulumi-lang-java=\"`issuerSafetyBuffer`\" pulumi-lang-hcl=\"`issuer_safety_buffer`\"\u003e`issuerSafetyBuffer`\u003c/span\u003e. No keys will be removed as part of this operation.\n" }, "tidyMoveLegacyCaBundle": { "type": "boolean", "description": "Set to true to move the legacy \u003cspan pulumi-lang-nodejs=\"`caBundle`\" pulumi-lang-dotnet=\"`CaBundle`\" pulumi-lang-go=\"`caBundle`\" pulumi-lang-python=\"`ca_bundle`\" pulumi-lang-yaml=\"`caBundle`\" pulumi-lang-java=\"`caBundle`\" pulumi-lang-hcl=\"`ca_bundle`\"\u003e`caBundle`\u003c/span\u003e from\n`/config/ca_bundle` to `/config/ca_bundle.bak`.\n" }, "tidyRevocationQueue": { "type": "boolean", "description": "Set to true to remove stale revocation queue entries that\nhaven't been confirmed by any active cluster.\n" }, "tidyRevokedCertIssuerAssociations": { "type": "boolean", "description": "Set to true to validate issuer associations\non revocation entries. This helps increase the performance of CRL building and OCSP responses.\n" }, "tidyRevokedCerts": { "type": "boolean", "description": "Set to true to remove all invalid and expired certificates from\nstorage. A revoked storage entry is considered invalid if the entry is empty, or the value within\nthe entry is empty. If a certificate is removed due to expiry, the entry will also be removed from\nthe CRL, and the CRL will be rotated.\n" } }, "type": "object" } }, "vault:pkiSecret/backendConfigCluster:BackendConfigCluster": { "description": "Allows setting the cluster-local's API mount path and AIA distribution point on a particular performance replication cluster.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst root = new vault.Mount(\"root\", {\n path: \"pki-root\",\n type: \"pki\",\n description: \"root PKI\",\n defaultLeaseTtlSeconds: 8640000,\n maxLeaseTtlSeconds: 8640000,\n});\nconst example = new vault.pkisecret.BackendConfigCluster(\"example\", {\n backend: root.path,\n path: \"http://127.0.0.1:8200/v1/pki-root\",\n aiaPath: \"http://127.0.0.1:8200/v1/pki-root\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nroot = vault.Mount(\"root\",\n path=\"pki-root\",\n type=\"pki\",\n description=\"root PKI\",\n default_lease_ttl_seconds=8640000,\n max_lease_ttl_seconds=8640000)\nexample = vault.pkisecret.BackendConfigCluster(\"example\",\n backend=root.path,\n path=\"http://127.0.0.1:8200/v1/pki-root\",\n aia_path=\"http://127.0.0.1:8200/v1/pki-root\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var root = new Vault.Mount(\"root\", new()\n {\n Path = \"pki-root\",\n Type = \"pki\",\n Description = \"root PKI\",\n DefaultLeaseTtlSeconds = 8640000,\n MaxLeaseTtlSeconds = 8640000,\n });\n\n var example = new Vault.PkiSecret.BackendConfigCluster(\"example\", new()\n {\n Backend = root.Path,\n Path = \"http://127.0.0.1:8200/v1/pki-root\",\n AiaPath = \"http://127.0.0.1:8200/v1/pki-root\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\troot, err := vault.NewMount(ctx, \"root\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-root\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"root PKI\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(8640000),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(8640000),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewBackendConfigCluster(ctx, \"example\", \u0026pkisecret.BackendConfigClusterArgs{\n\t\t\tBackend: root.Path,\n\t\t\tPath: pulumi.String(\"http://127.0.0.1:8200/v1/pki-root\"),\n\t\t\tAiaPath: pulumi.String(\"http://127.0.0.1:8200/v1/pki-root\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"root\" {\n path = \"pki-root\"\n type = \"pki\"\n description = \"root PKI\"\n default_lease_ttl_seconds = 8640000\n max_lease_ttl_seconds = 8640000\n}\nresource \"vault_pkisecret_backendconfigcluster\" \"example\" {\n backend = vault_mount.root.path\n path = \"http://127.0.0.1:8200/v1/pki-root\"\n aia_path = \"http://127.0.0.1:8200/v1/pki-root\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.BackendConfigCluster;\nimport com.pulumi.vault.pkiSecret.BackendConfigClusterArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var root = new Mount(\"root\", MountArgs.builder()\n .path(\"pki-root\")\n .type(\"pki\")\n .description(\"root PKI\")\n .defaultLeaseTtlSeconds(8640000)\n .maxLeaseTtlSeconds(8640000)\n .build());\n\n var example = new BackendConfigCluster(\"example\", BackendConfigClusterArgs.builder()\n .backend(root.path())\n .path(\"http://127.0.0.1:8200/v1/pki-root\")\n .aiaPath(\"http://127.0.0.1:8200/v1/pki-root\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n root:\n type: vault:Mount\n properties:\n path: pki-root\n type: pki\n description: root PKI\n defaultLeaseTtlSeconds: 8.64e+06\n maxLeaseTtlSeconds: 8.64e+06\n example:\n type: vault:pkiSecret:BackendConfigCluster\n properties:\n backend: ${root.path}\n path: http://127.0.0.1:8200/v1/pki-root\n aiaPath: http://127.0.0.1:8200/v1/pki-root\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe PKI config cluster can be imported using the resource's \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e. \nIn the case of the example above the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e would be `pki-root/config/cluster`, \nwhere the `pki-root` component is the resource's \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/backendConfigCluster:BackendConfigCluster example pki-root/config/cluster\n```\n\n", "properties": { "aiaPath": { "type": "string", "description": "Specifies the path to this performance replication cluster's AIA distribution point.\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Specifies the path to this performance replication cluster's API mount path.\n" } }, "required": [ "backend" ], "inputProperties": { "aiaPath": { "type": "string", "description": "Specifies the path to this performance replication cluster's AIA distribution point.\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Specifies the path to this performance replication cluster's API mount path.\n" } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering BackendConfigCluster resources.\n", "properties": { "aiaPath": { "type": "string", "description": "Specifies the path to this performance replication cluster's AIA distribution point.\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Specifies the path to this performance replication cluster's API mount path.\n" } }, "type": "object" } }, "vault:pkiSecret/backendConfigCmpv2:BackendConfigCmpv2": { "description": "Allows setting the CMPv2 configuration on a PKI Secret Backend\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki-root\",\n type: \"pki\",\n description: \"PKI secret engine mount\",\n});\nconst cmpv2Role = new vault.pkisecret.SecretBackendRole(\"cmpv2_role\", {\n backend: pki.path,\n name: \"cmpv2-role\",\n ttl: \"3600\",\n keyType: \"ec\",\n keyBits: 256,\n});\nconst cmpv2Role2 = new vault.pkisecret.SecretBackendRole(\"cmpv2_role_2\", {\n backend: pki.path,\n name: \"cmpv2-role-2\",\n ttl: \"3600\",\n keyType: \"ec\",\n keyBits: 256,\n});\nconst example = new vault.pkisecret.BackendConfigCmpv2(\"example\", {\n backend: pki.path,\n enabled: true,\n defaultPathPolicy: std.format({\n input: \"role:%s\",\n args: [cmpv2Role.name],\n }).then(invoke =\u003e invoke.result),\n authenticators: {\n cert: {\n accessor: \"test\",\n cert_role: \"cert-auth-role\",\n },\n },\n enableSentinelParsing: true,\n auditFields: [\n \"csr\",\n \"common_name\",\n \"alt_names\",\n \"ip_sans\",\n \"uri_sans\",\n \"other_sans\",\n \"signature_bits\",\n \"exclude_cn_from_sans\",\n \"ou\",\n \"organization\",\n \"country\",\n \"locality\",\n \"province\",\n \"street_address\",\n \"postal_code\",\n \"serial_number\",\n \"use_pss\",\n \"key_type\",\n \"key_bits\",\n \"add_basic_constraints\",\n ],\n disabledValidations: [\"DisableMatchingKeyIdValidation\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\npki = vault.Mount(\"pki\",\n path=\"pki-root\",\n type=\"pki\",\n description=\"PKI secret engine mount\")\ncmpv2_role = vault.pkisecret.SecretBackendRole(\"cmpv2_role\",\n backend=pki.path,\n name=\"cmpv2-role\",\n ttl=\"3600\",\n key_type=\"ec\",\n key_bits=256)\ncmpv2_role2 = vault.pkisecret.SecretBackendRole(\"cmpv2_role_2\",\n backend=pki.path,\n name=\"cmpv2-role-2\",\n ttl=\"3600\",\n key_type=\"ec\",\n key_bits=256)\nexample = vault.pkisecret.BackendConfigCmpv2(\"example\",\n backend=pki.path,\n enabled=True,\n default_path_policy=std.format(input=\"role:%s\",\n args=[cmpv2_role.name]).result,\n authenticators={\n \"cert\": {\n \"accessor\": \"test\",\n \"cert_role\": \"cert-auth-role\",\n },\n },\n enable_sentinel_parsing=True,\n audit_fields=[\n \"csr\",\n \"common_name\",\n \"alt_names\",\n \"ip_sans\",\n \"uri_sans\",\n \"other_sans\",\n \"signature_bits\",\n \"exclude_cn_from_sans\",\n \"ou\",\n \"organization\",\n \"country\",\n \"locality\",\n \"province\",\n \"street_address\",\n \"postal_code\",\n \"serial_number\",\n \"use_pss\",\n \"key_type\",\n \"key_bits\",\n \"add_basic_constraints\",\n ],\n disabled_validations=[\"DisableMatchingKeyIdValidation\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki-root\",\n Type = \"pki\",\n Description = \"PKI secret engine mount\",\n });\n\n var cmpv2Role = new Vault.PkiSecret.SecretBackendRole(\"cmpv2_role\", new()\n {\n Backend = pki.Path,\n Name = \"cmpv2-role\",\n Ttl = \"3600\",\n KeyType = \"ec\",\n KeyBits = 256,\n });\n\n var cmpv2Role2 = new Vault.PkiSecret.SecretBackendRole(\"cmpv2_role_2\", new()\n {\n Backend = pki.Path,\n Name = \"cmpv2-role-2\",\n Ttl = \"3600\",\n KeyType = \"ec\",\n KeyBits = 256,\n });\n\n var example = new Vault.PkiSecret.BackendConfigCmpv2(\"example\", new()\n {\n Backend = pki.Path,\n Enabled = true,\n DefaultPathPolicy = Std.Format.Invoke(new()\n {\n Input = \"role:%s\",\n Args = new[]\n {\n cmpv2Role.Name,\n },\n }).Apply(invoke =\u003e invoke.Result),\n Authenticators = new Vault.PkiSecret.Inputs.BackendConfigCmpv2AuthenticatorsArgs\n {\n Cert = \n {\n { \"accessor\", \"test\" },\n { \"cert_role\", \"cert-auth-role\" },\n },\n },\n EnableSentinelParsing = true,\n AuditFields = new[]\n {\n \"csr\",\n \"common_name\",\n \"alt_names\",\n \"ip_sans\",\n \"uri_sans\",\n \"other_sans\",\n \"signature_bits\",\n \"exclude_cn_from_sans\",\n \"ou\",\n \"organization\",\n \"country\",\n \"locality\",\n \"province\",\n \"street_address\",\n \"postal_code\",\n \"serial_number\",\n \"use_pss\",\n \"key_type\",\n \"key_bits\",\n \"add_basic_constraints\",\n },\n DisabledValidations = new[]\n {\n \"DisableMatchingKeyIdValidation\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-root\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"PKI secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tcmpv2Role, err := pkisecret.NewSecretBackendRole(ctx, \"cmpv2_role\", \u0026pkisecret.SecretBackendRoleArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tName: pulumi.String(\"cmpv2-role\"),\n\t\t\tTtl: pulumi.String(\"3600\"),\n\t\t\tKeyType: pulumi.String(\"ec\"),\n\t\t\tKeyBits: pulumi.Int(256),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewSecretBackendRole(ctx, \"cmpv2_role_2\", \u0026pkisecret.SecretBackendRoleArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tName: pulumi.String(\"cmpv2-role-2\"),\n\t\t\tTtl: pulumi.String(\"3600\"),\n\t\t\tKeyType: pulumi.String(\"ec\"),\n\t\t\tKeyBits: pulumi.Int(256),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFormat, err := std.Format(ctx, \u0026std.FormatArgs{\n\t\t\tInput: \"role:%s\",\n\t\t\tArgs: pulumi.StringArray{\n\t\t\t\tcmpv2Role.Name,\n\t\t\t},\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewBackendConfigCmpv2(ctx, \"example\", \u0026pkisecret.BackendConfigCmpv2Args{\n\t\t\tBackend: pki.Path,\n\t\t\tEnabled: pulumi.Bool(true),\n\t\t\tDefaultPathPolicy: pulumi.String(invokeFormat.Result),\n\t\t\tAuthenticators: \u0026pkisecret.BackendConfigCmpv2AuthenticatorsArgs{\n\t\t\t\tCert: pulumi.StringMap{\n\t\t\t\t\t\"accessor\": pulumi.String(\"test\"),\n\t\t\t\t\t\"cert_role\": pulumi.String(\"cert-auth-role\"),\n\t\t\t\t},\n\t\t\t},\n\t\t\tEnableSentinelParsing: pulumi.Bool(true),\n\t\t\tAuditFields: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"csr\"),\n\t\t\t\tpulumi.String(\"common_name\"),\n\t\t\t\tpulumi.String(\"alt_names\"),\n\t\t\t\tpulumi.String(\"ip_sans\"),\n\t\t\t\tpulumi.String(\"uri_sans\"),\n\t\t\t\tpulumi.String(\"other_sans\"),\n\t\t\t\tpulumi.String(\"signature_bits\"),\n\t\t\t\tpulumi.String(\"exclude_cn_from_sans\"),\n\t\t\t\tpulumi.String(\"ou\"),\n\t\t\t\tpulumi.String(\"organization\"),\n\t\t\t\tpulumi.String(\"country\"),\n\t\t\t\tpulumi.String(\"locality\"),\n\t\t\t\tpulumi.String(\"province\"),\n\t\t\t\tpulumi.String(\"street_address\"),\n\t\t\t\tpulumi.String(\"postal_code\"),\n\t\t\t\tpulumi.String(\"serial_number\"),\n\t\t\t\tpulumi.String(\"use_pss\"),\n\t\t\t\tpulumi.String(\"key_type\"),\n\t\t\t\tpulumi.String(\"key_bits\"),\n\t\t\t\tpulumi.String(\"add_basic_constraints\"),\n\t\t\t},\n\t\t\tDisabledValidations: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"DisableMatchingKeyIdValidation\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\ndata \"std_format\" \"invoke_0\" {\n input = \"role:%s\"\n args = [vault_pkisecret_secretbackendrole.cmpv2_role.name]\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki-root\"\n type = \"pki\"\n description = \"PKI secret engine mount\"\n}\nresource \"vault_pkisecret_secretbackendrole\" \"cmpv2_role\" {\n backend = vault_mount.pki.path\n name = \"cmpv2-role\"\n ttl = 3600\n key_type = \"ec\"\n key_bits = \"256\"\n}\nresource \"vault_pkisecret_secretbackendrole\" \"cmpv2_role_2\" {\n backend = vault_mount.pki.path\n name = \"cmpv2-role-2\"\n ttl = 3600\n key_type = \"ec\"\n key_bits = \"256\"\n}\nresource \"vault_pkisecret_backendconfigcmpv2\" \"example\" {\n backend = vault_mount.pki.path\n enabled = true\n default_path_policy = data.std_format.invoke_0.result\n authenticators = {\n cert = {\n \"accessor\" = \"test\"\n \"cert_role\" = \"cert-auth-role\"\n }\n }\n enable_sentinel_parsing = true\n audit_fields = [\"csr\", \"common_name\", \"alt_names\", \"ip_sans\", \"uri_sans\", \"other_sans\", \"signature_bits\", \"exclude_cn_from_sans\", \"ou\", \"organization\", \"country\", \"locality\", \"province\", \"street_address\", \"postal_code\", \"serial_number\", \"use_pss\", \"key_type\", \"key_bits\", \"add_basic_constraints\"]\n disabled_validations = [\"DisableMatchingKeyIdValidation\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendRole;\nimport com.pulumi.vault.pkiSecret.SecretBackendRoleArgs;\nimport com.pulumi.vault.pkiSecret.BackendConfigCmpv2;\nimport com.pulumi.vault.pkiSecret.BackendConfigCmpv2Args;\nimport com.pulumi.vault.pkiSecret.inputs.BackendConfigCmpv2AuthenticatorsArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FormatArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki-root\")\n .type(\"pki\")\n .description(\"PKI secret engine mount\")\n .build());\n\n var cmpv2Role = new SecretBackendRole(\"cmpv2Role\", SecretBackendRoleArgs.builder()\n .backend(pki.path())\n .name(\"cmpv2-role\")\n .ttl(\"3600\")\n .keyType(\"ec\")\n .keyBits(256)\n .build());\n\n var cmpv2Role2 = new SecretBackendRole(\"cmpv2Role2\", SecretBackendRoleArgs.builder()\n .backend(pki.path())\n .name(\"cmpv2-role-2\")\n .ttl(\"3600\")\n .keyType(\"ec\")\n .keyBits(256)\n .build());\n\n var example = new BackendConfigCmpv2(\"example\", BackendConfigCmpv2Args.builder()\n .backend(pki.path())\n .enabled(true)\n .defaultPathPolicy(StdFunctions.format(FormatArgs.builder()\n .input(\"role:%s\")\n .args(cmpv2Role.name())\n .build()).result())\n .authenticators(BackendConfigCmpv2AuthenticatorsArgs.builder()\n .cert(Map.ofEntries(\n Map.entry(\"accessor\", \"test\"),\n Map.entry(\"cert_role\", \"cert-auth-role\")\n ))\n .build())\n .enableSentinelParsing(true)\n .auditFields( \n \"csr\",\n \"common_name\",\n \"alt_names\",\n \"ip_sans\",\n \"uri_sans\",\n \"other_sans\",\n \"signature_bits\",\n \"exclude_cn_from_sans\",\n \"ou\",\n \"organization\",\n \"country\",\n \"locality\",\n \"province\",\n \"street_address\",\n \"postal_code\",\n \"serial_number\",\n \"use_pss\",\n \"key_type\",\n \"key_bits\",\n \"add_basic_constraints\")\n .disabledValidations(\"DisableMatchingKeyIdValidation\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki-root\n type: pki\n description: PKI secret engine mount\n cmpv2Role:\n type: vault:pkiSecret:SecretBackendRole\n name: cmpv2_role\n properties:\n backend: ${pki.path}\n name: cmpv2-role\n ttl: 3600\n keyType: ec\n keyBits: '256'\n cmpv2Role2:\n type: vault:pkiSecret:SecretBackendRole\n name: cmpv2_role_2\n properties:\n backend: ${pki.path}\n name: cmpv2-role-2\n ttl: 3600\n keyType: ec\n keyBits: '256'\n example:\n type: vault:pkiSecret:BackendConfigCmpv2\n properties:\n backend: ${pki.path}\n enabled: true\n defaultPathPolicy:\n fn::invoke:\n function: std:format\n arguments:\n input: role:%s\n args:\n - ${cmpv2Role.name}\n return: result\n authenticators:\n cert:\n accessor: test\n cert_role: cert-auth-role\n enableSentinelParsing: true\n auditFields:\n - csr\n - common_name\n - alt_names\n - ip_sans\n - uri_sans\n - other_sans\n - signature_bits\n - exclude_cn_from_sans\n - ou\n - organization\n - country\n - locality\n - province\n - street_address\n - postal_code\n - serial_number\n - use_pss\n - key_type\n - key_bits\n - add_basic_constraints\n disabledValidations:\n - DisableMatchingKeyIdValidation\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe PKI config cluster can be imported using the resource's \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e.\nIn the case of the example above the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e would be `pki-root/config/cmpv2`,\nwhere the `pki-root` component is the resource's \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/backendConfigCmpv2:BackendConfigCmpv2 example pki-root/config/cmpv2\n```\n\n", "properties": { "auditFields": { "type": "array", "items": { "type": "string" }, "description": "Fields parsed from the CSR that appear in the audit and can be used by sentinel policies.\n" }, "authenticators": { "$ref": "#/types/vault:pkiSecret/BackendConfigCmpv2Authenticators:BackendConfigCmpv2Authenticators", "description": "Lists the mount accessors CMPv2 should delegate authentication requests towards (see below for nested schema).\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the CMPv2 configuration from, with no leading or trailing `/`s.\n" }, "defaultPathPolicy": { "type": "string", "description": "Specifies the behavior for requests using the non-role-qualified CMPv2 requests. Can be sign-verbatim or a role given by role:\u003crole_name\u003e.\n" }, "disabledValidations": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated list of validations not to perform on CMPv2 messages.\n\n\u003ca id=\"nestedatt--authenticators\"\u003e\u003c/a\u003e\n" }, "enableSentinelParsing": { "type": "boolean", "description": "If set, parse out fields from the provided CSR making them available for Sentinel policies.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether CMPv2 is enabled.\n" }, "lastUpdated": { "type": "string", "description": "A read-only timestamp representing the last time the configuration was updated.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "auditFields", "authenticators", "backend", "lastUpdated" ], "inputProperties": { "auditFields": { "type": "array", "items": { "type": "string" }, "description": "Fields parsed from the CSR that appear in the audit and can be used by sentinel policies.\n" }, "authenticators": { "$ref": "#/types/vault:pkiSecret/BackendConfigCmpv2Authenticators:BackendConfigCmpv2Authenticators", "description": "Lists the mount accessors CMPv2 should delegate authentication requests towards (see below for nested schema).\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the CMPv2 configuration from, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "defaultPathPolicy": { "type": "string", "description": "Specifies the behavior for requests using the non-role-qualified CMPv2 requests. Can be sign-verbatim or a role given by role:\u003crole_name\u003e.\n" }, "disabledValidations": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated list of validations not to perform on CMPv2 messages.\n\n\u003ca id=\"nestedatt--authenticators\"\u003e\u003c/a\u003e\n" }, "enableSentinelParsing": { "type": "boolean", "description": "If set, parse out fields from the provided CSR making them available for Sentinel policies.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether CMPv2 is enabled.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering BackendConfigCmpv2 resources.\n", "properties": { "auditFields": { "type": "array", "items": { "type": "string" }, "description": "Fields parsed from the CSR that appear in the audit and can be used by sentinel policies.\n" }, "authenticators": { "$ref": "#/types/vault:pkiSecret/BackendConfigCmpv2Authenticators:BackendConfigCmpv2Authenticators", "description": "Lists the mount accessors CMPv2 should delegate authentication requests towards (see below for nested schema).\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the CMPv2 configuration from, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "defaultPathPolicy": { "type": "string", "description": "Specifies the behavior for requests using the non-role-qualified CMPv2 requests. Can be sign-verbatim or a role given by role:\u003crole_name\u003e.\n" }, "disabledValidations": { "type": "array", "items": { "type": "string" }, "description": "A comma-separated list of validations not to perform on CMPv2 messages.\n\n\u003ca id=\"nestedatt--authenticators\"\u003e\u003c/a\u003e\n" }, "enableSentinelParsing": { "type": "boolean", "description": "If set, parse out fields from the provided CSR making them available for Sentinel policies.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether CMPv2 is enabled.\n" }, "lastUpdated": { "type": "string", "description": "A read-only timestamp representing the last time the configuration was updated.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/backendConfigEst:BackendConfigEst": { "description": "Allows setting the EST configuration on a PKI Secret Backend\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki-root\",\n type: \"pki\",\n description: \"PKI secret engine mount\",\n});\nconst estRole = new vault.pkisecret.SecretBackendRole(\"est_role\", {\n backend: pki.path,\n name: \"est-role\",\n ttl: \"3600\",\n keyType: \"ec\",\n keyBits: 256,\n});\nconst estRole2 = new vault.pkisecret.SecretBackendRole(\"est_role_2\", {\n backend: pki.path,\n name: \"est-role-2\",\n ttl: \"3600\",\n keyType: \"ec\",\n keyBits: 256,\n});\nconst example = new vault.pkisecret.BackendConfigEst(\"example\", {\n backend: pki.path,\n enabled: true,\n defaultMount: true,\n defaultPathPolicy: std.format({\n input: \"role:%s\",\n args: [estRole.name],\n }).then(invoke =\u003e invoke.result),\n labelToPathPolicy: {\n \"test-label\": \"sign-verbatim\",\n \"test-label-2\": std.format({\n input: \"role:%s\",\n args: [estRole2.name],\n }).then(invoke =\u003e invoke.result),\n },\n authenticators: {\n cert: {\n accessor: \"test\",\n cert_role: \"cert-auth-role\",\n },\n userpass: {\n accessor: \"test2\",\n },\n },\n enableSentinelParsing: true,\n auditFields: [\n \"csr\",\n \"common_name\",\n \"alt_names\",\n \"ip_sans\",\n \"uri_sans\",\n \"other_sans\",\n \"signature_bits\",\n \"exclude_cn_from_sans\",\n \"ou\",\n \"organization\",\n \"country\",\n \"locality\",\n \"province\",\n \"street_address\",\n \"postal_code\",\n \"serial_number\",\n \"use_pss\",\n \"key_type\",\n \"key_bits\",\n \"add_basic_constraints\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\npki = vault.Mount(\"pki\",\n path=\"pki-root\",\n type=\"pki\",\n description=\"PKI secret engine mount\")\nest_role = vault.pkisecret.SecretBackendRole(\"est_role\",\n backend=pki.path,\n name=\"est-role\",\n ttl=\"3600\",\n key_type=\"ec\",\n key_bits=256)\nest_role2 = vault.pkisecret.SecretBackendRole(\"est_role_2\",\n backend=pki.path,\n name=\"est-role-2\",\n ttl=\"3600\",\n key_type=\"ec\",\n key_bits=256)\nexample = vault.pkisecret.BackendConfigEst(\"example\",\n backend=pki.path,\n enabled=True,\n default_mount=True,\n default_path_policy=std.format(input=\"role:%s\",\n args=[est_role.name]).result,\n label_to_path_policy={\n \"test-label\": \"sign-verbatim\",\n \"test-label-2\": std.format(input=\"role:%s\",\n args=[est_role2.name]).result,\n },\n authenticators={\n \"cert\": {\n \"accessor\": \"test\",\n \"cert_role\": \"cert-auth-role\",\n },\n \"userpass\": {\n \"accessor\": \"test2\",\n },\n },\n enable_sentinel_parsing=True,\n audit_fields=[\n \"csr\",\n \"common_name\",\n \"alt_names\",\n \"ip_sans\",\n \"uri_sans\",\n \"other_sans\",\n \"signature_bits\",\n \"exclude_cn_from_sans\",\n \"ou\",\n \"organization\",\n \"country\",\n \"locality\",\n \"province\",\n \"street_address\",\n \"postal_code\",\n \"serial_number\",\n \"use_pss\",\n \"key_type\",\n \"key_bits\",\n \"add_basic_constraints\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki-root\",\n Type = \"pki\",\n Description = \"PKI secret engine mount\",\n });\n\n var estRole = new Vault.PkiSecret.SecretBackendRole(\"est_role\", new()\n {\n Backend = pki.Path,\n Name = \"est-role\",\n Ttl = \"3600\",\n KeyType = \"ec\",\n KeyBits = 256,\n });\n\n var estRole2 = new Vault.PkiSecret.SecretBackendRole(\"est_role_2\", new()\n {\n Backend = pki.Path,\n Name = \"est-role-2\",\n Ttl = \"3600\",\n KeyType = \"ec\",\n KeyBits = 256,\n });\n\n var example = new Vault.PkiSecret.BackendConfigEst(\"example\", new()\n {\n Backend = pki.Path,\n Enabled = true,\n DefaultMount = true,\n DefaultPathPolicy = Std.Format.Invoke(new()\n {\n Input = \"role:%s\",\n Args = new[]\n {\n estRole.Name,\n },\n }).Apply(invoke =\u003e invoke.Result),\n LabelToPathPolicy = \n {\n { \"test-label\", \"sign-verbatim\" },\n { \"test-label-2\", Std.Format.Invoke(new()\n {\n Input = \"role:%s\",\n Args = new[]\n {\n estRole2.Name,\n },\n }).Apply(invoke =\u003e invoke.Result) },\n },\n Authenticators = new Vault.PkiSecret.Inputs.BackendConfigEstAuthenticatorsArgs\n {\n Cert = \n {\n { \"accessor\", \"test\" },\n { \"cert_role\", \"cert-auth-role\" },\n },\n Userpass = \n {\n { \"accessor\", \"test2\" },\n },\n },\n EnableSentinelParsing = true,\n AuditFields = new[]\n {\n \"csr\",\n \"common_name\",\n \"alt_names\",\n \"ip_sans\",\n \"uri_sans\",\n \"other_sans\",\n \"signature_bits\",\n \"exclude_cn_from_sans\",\n \"ou\",\n \"organization\",\n \"country\",\n \"locality\",\n \"province\",\n \"street_address\",\n \"postal_code\",\n \"serial_number\",\n \"use_pss\",\n \"key_type\",\n \"key_bits\",\n \"add_basic_constraints\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-root\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"PKI secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\testRole, err := pkisecret.NewSecretBackendRole(ctx, \"est_role\", \u0026pkisecret.SecretBackendRoleArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tName: pulumi.String(\"est-role\"),\n\t\t\tTtl: pulumi.String(\"3600\"),\n\t\t\tKeyType: pulumi.String(\"ec\"),\n\t\t\tKeyBits: pulumi.Int(256),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\testRole2, err := pkisecret.NewSecretBackendRole(ctx, \"est_role_2\", \u0026pkisecret.SecretBackendRoleArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tName: pulumi.String(\"est-role-2\"),\n\t\t\tTtl: pulumi.String(\"3600\"),\n\t\t\tKeyType: pulumi.String(\"ec\"),\n\t\t\tKeyBits: pulumi.Int(256),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFormat, err := std.Format(ctx, \u0026std.FormatArgs{\n\t\t\tInput: \"role:%s\",\n\t\t\tArgs: pulumi.StringArray{\n\t\t\t\testRole.Name,\n\t\t\t},\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tinvokeFormat1, err := std.Format(ctx, \u0026std.FormatArgs{\n\t\t\tInput: \"role:%s\",\n\t\t\tArgs: pulumi.StringArray{\n\t\t\t\testRole2.Name,\n\t\t\t},\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewBackendConfigEst(ctx, \"example\", \u0026pkisecret.BackendConfigEstArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tEnabled: pulumi.Bool(true),\n\t\t\tDefaultMount: pulumi.Bool(true),\n\t\t\tDefaultPathPolicy: pulumi.String(invokeFormat.Result),\n\t\t\tLabelToPathPolicy: pulumi.StringMap{\n\t\t\t\t\"test-label\": pulumi.String(\"sign-verbatim\"),\n\t\t\t\t\"test-label-2\": pulumi.String(invokeFormat1.Result),\n\t\t\t},\n\t\t\tAuthenticators: \u0026pkisecret.BackendConfigEstAuthenticatorsArgs{\n\t\t\t\tCert: pulumi.StringMap{\n\t\t\t\t\t\"accessor\": pulumi.String(\"test\"),\n\t\t\t\t\t\"cert_role\": pulumi.String(\"cert-auth-role\"),\n\t\t\t\t},\n\t\t\t\tUserpass: pulumi.StringMap{\n\t\t\t\t\t\"accessor\": pulumi.String(\"test2\"),\n\t\t\t\t},\n\t\t\t},\n\t\t\tEnableSentinelParsing: pulumi.Bool(true),\n\t\t\tAuditFields: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"csr\"),\n\t\t\t\tpulumi.String(\"common_name\"),\n\t\t\t\tpulumi.String(\"alt_names\"),\n\t\t\t\tpulumi.String(\"ip_sans\"),\n\t\t\t\tpulumi.String(\"uri_sans\"),\n\t\t\t\tpulumi.String(\"other_sans\"),\n\t\t\t\tpulumi.String(\"signature_bits\"),\n\t\t\t\tpulumi.String(\"exclude_cn_from_sans\"),\n\t\t\t\tpulumi.String(\"ou\"),\n\t\t\t\tpulumi.String(\"organization\"),\n\t\t\t\tpulumi.String(\"country\"),\n\t\t\t\tpulumi.String(\"locality\"),\n\t\t\t\tpulumi.String(\"province\"),\n\t\t\t\tpulumi.String(\"street_address\"),\n\t\t\t\tpulumi.String(\"postal_code\"),\n\t\t\t\tpulumi.String(\"serial_number\"),\n\t\t\t\tpulumi.String(\"use_pss\"),\n\t\t\t\tpulumi.String(\"key_type\"),\n\t\t\t\tpulumi.String(\"key_bits\"),\n\t\t\t\tpulumi.String(\"add_basic_constraints\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\ndata \"std_format\" \"invoke_0\" {\n input = \"role:%s\"\n args = [vault_pkisecret_secretbackendrole.est_role.name]\n}\ndata \"std_format\" \"invoke_1\" {\n input = \"role:%s\"\n args = [vault_pkisecret_secretbackendrole.est_role_2.name]\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki-root\"\n type = \"pki\"\n description = \"PKI secret engine mount\"\n}\nresource \"vault_pkisecret_secretbackendrole\" \"est_role\" {\n backend = vault_mount.pki.path\n name = \"est-role\"\n ttl = 3600\n key_type = \"ec\"\n key_bits = \"256\"\n}\nresource \"vault_pkisecret_secretbackendrole\" \"est_role_2\" {\n backend = vault_mount.pki.path\n name = \"est-role-2\"\n ttl = 3600\n key_type = \"ec\"\n key_bits = \"256\"\n}\nresource \"vault_pkisecret_backendconfigest\" \"example\" {\n backend = vault_mount.pki.path\n enabled = true\n default_mount = true\n default_path_policy = data.std_format.invoke_0.result\n label_to_path_policy = {\n \"test-label\" = \"sign-verbatim\"\n \"test-label-2\" = data.std_format.invoke_1.result\n }\n authenticators = {\n cert = {\n \"accessor\" = \"test\"\n \"cert_role\" = \"cert-auth-role\"\n }\n userpass = {\n \"accessor\" = \"test2\"\n }\n }\n enable_sentinel_parsing = true\n audit_fields = [\"csr\", \"common_name\", \"alt_names\", \"ip_sans\", \"uri_sans\", \"other_sans\", \"signature_bits\", \"exclude_cn_from_sans\", \"ou\", \"organization\", \"country\", \"locality\", \"province\", \"street_address\", \"postal_code\", \"serial_number\", \"use_pss\", \"key_type\", \"key_bits\", \"add_basic_constraints\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendRole;\nimport com.pulumi.vault.pkiSecret.SecretBackendRoleArgs;\nimport com.pulumi.vault.pkiSecret.BackendConfigEst;\nimport com.pulumi.vault.pkiSecret.BackendConfigEstArgs;\nimport com.pulumi.vault.pkiSecret.inputs.BackendConfigEstAuthenticatorsArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FormatArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki-root\")\n .type(\"pki\")\n .description(\"PKI secret engine mount\")\n .build());\n\n var estRole = new SecretBackendRole(\"estRole\", SecretBackendRoleArgs.builder()\n .backend(pki.path())\n .name(\"est-role\")\n .ttl(\"3600\")\n .keyType(\"ec\")\n .keyBits(256)\n .build());\n\n var estRole2 = new SecretBackendRole(\"estRole2\", SecretBackendRoleArgs.builder()\n .backend(pki.path())\n .name(\"est-role-2\")\n .ttl(\"3600\")\n .keyType(\"ec\")\n .keyBits(256)\n .build());\n\n var example = new BackendConfigEst(\"example\", BackendConfigEstArgs.builder()\n .backend(pki.path())\n .enabled(true)\n .defaultMount(true)\n .defaultPathPolicy(StdFunctions.format(FormatArgs.builder()\n .input(\"role:%s\")\n .args(estRole.name())\n .build()).result())\n .labelToPathPolicy(Map.ofEntries(\n Map.entry(\"test-label\", \"sign-verbatim\"),\n Map.entry(\"test-label-2\", StdFunctions.format(FormatArgs.builder()\n .input(\"role:%s\")\n .args(estRole2.name())\n .build()).result())\n ))\n .authenticators(BackendConfigEstAuthenticatorsArgs.builder()\n .cert(Map.ofEntries(\n Map.entry(\"accessor\", \"test\"),\n Map.entry(\"cert_role\", \"cert-auth-role\")\n ))\n .userpass(Map.of(\"accessor\", \"test2\"))\n .build())\n .enableSentinelParsing(true)\n .auditFields( \n \"csr\",\n \"common_name\",\n \"alt_names\",\n \"ip_sans\",\n \"uri_sans\",\n \"other_sans\",\n \"signature_bits\",\n \"exclude_cn_from_sans\",\n \"ou\",\n \"organization\",\n \"country\",\n \"locality\",\n \"province\",\n \"street_address\",\n \"postal_code\",\n \"serial_number\",\n \"use_pss\",\n \"key_type\",\n \"key_bits\",\n \"add_basic_constraints\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki-root\n type: pki\n description: PKI secret engine mount\n estRole:\n type: vault:pkiSecret:SecretBackendRole\n name: est_role\n properties:\n backend: ${pki.path}\n name: est-role\n ttl: 3600\n keyType: ec\n keyBits: '256'\n estRole2:\n type: vault:pkiSecret:SecretBackendRole\n name: est_role_2\n properties:\n backend: ${pki.path}\n name: est-role-2\n ttl: 3600\n keyType: ec\n keyBits: '256'\n example:\n type: vault:pkiSecret:BackendConfigEst\n properties:\n backend: ${pki.path}\n enabled: true\n defaultMount: true\n defaultPathPolicy:\n fn::invoke:\n function: std:format\n arguments:\n input: role:%s\n args:\n - ${estRole.name}\n return: result\n labelToPathPolicy:\n test-label: sign-verbatim\n test-label-2:\n fn::invoke:\n function: std:format\n arguments:\n input: role:%s\n args:\n - ${estRole2.name}\n return: result\n authenticators:\n cert:\n accessor: test\n cert_role: cert-auth-role\n userpass:\n accessor: test2\n enableSentinelParsing: true\n auditFields:\n - csr\n - common_name\n - alt_names\n - ip_sans\n - uri_sans\n - other_sans\n - signature_bits\n - exclude_cn_from_sans\n - ou\n - organization\n - country\n - locality\n - province\n - street_address\n - postal_code\n - serial_number\n - use_pss\n - key_type\n - key_bits\n - add_basic_constraints\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe PKI config cluster can be imported using the resource's \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e.\nIn the case of the example above the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e would be `pki-root/config/est`,\nwhere the `pki-root` component is the resource's \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/backendConfigEst:BackendConfigEst example pki-root/config/est\n```\n\n", "properties": { "auditFields": { "type": "array", "items": { "type": "string" }, "description": "Fields parsed from the CSR that appear in the audit and can be used by sentinel policies.\n\n\u003ca id=\"nestedatt--authenticators\"\u003e\u003c/a\u003e\n" }, "authenticators": { "$ref": "#/types/vault:pkiSecret/BackendConfigEstAuthenticators:BackendConfigEstAuthenticators", "description": "Lists the mount accessors EST should delegate authentication requests towards (see below for nested schema).\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the EST configuration from, with no leading or trailing `/`s.\n" }, "defaultMount": { "type": "boolean", "description": "If set, this mount will register the default `.well-known/est` URL path. Only a single mount can enable this across a Vault cluster.\n" }, "defaultPathPolicy": { "type": "string", "description": "Required to be set if\u003cspan pulumi-lang-nodejs=\" defaultMount \" pulumi-lang-dotnet=\" DefaultMount \" pulumi-lang-go=\" defaultMount \" pulumi-lang-python=\" default_mount \" pulumi-lang-yaml=\" defaultMount \" pulumi-lang-java=\" defaultMount \" pulumi-lang-hcl=\" default_mount \"\u003e defaultMount \u003c/span\u003eis enabled. Specifies the behavior for requests using the default EST label. Can be sign-verbatim or a role given by role:\u003crole_name\u003e.\n" }, "enableSentinelParsing": { "type": "boolean", "description": "If set, parse out fields from the provided CSR making them available for Sentinel policies.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether EST is enabled.\n" }, "labelToPathPolicy": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:\u003crole_name\u003e. Labels must be unique across Vault cluster, and will register .well-known/est/\u003clabel\u003e URL paths.\n" }, "lastUpdated": { "type": "string", "description": "A read-only timestamp representing the last time the configuration was updated.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "auditFields", "authenticators", "backend", "lastUpdated" ], "inputProperties": { "auditFields": { "type": "array", "items": { "type": "string" }, "description": "Fields parsed from the CSR that appear in the audit and can be used by sentinel policies.\n\n\u003ca id=\"nestedatt--authenticators\"\u003e\u003c/a\u003e\n" }, "authenticators": { "$ref": "#/types/vault:pkiSecret/BackendConfigEstAuthenticators:BackendConfigEstAuthenticators", "description": "Lists the mount accessors EST should delegate authentication requests towards (see below for nested schema).\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the EST configuration from, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "defaultMount": { "type": "boolean", "description": "If set, this mount will register the default `.well-known/est` URL path. Only a single mount can enable this across a Vault cluster.\n" }, "defaultPathPolicy": { "type": "string", "description": "Required to be set if\u003cspan pulumi-lang-nodejs=\" defaultMount \" pulumi-lang-dotnet=\" DefaultMount \" pulumi-lang-go=\" defaultMount \" pulumi-lang-python=\" default_mount \" pulumi-lang-yaml=\" defaultMount \" pulumi-lang-java=\" defaultMount \" pulumi-lang-hcl=\" default_mount \"\u003e defaultMount \u003c/span\u003eis enabled. Specifies the behavior for requests using the default EST label. Can be sign-verbatim or a role given by role:\u003crole_name\u003e.\n" }, "enableSentinelParsing": { "type": "boolean", "description": "If set, parse out fields from the provided CSR making them available for Sentinel policies.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether EST is enabled.\n" }, "labelToPathPolicy": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:\u003crole_name\u003e. Labels must be unique across Vault cluster, and will register .well-known/est/\u003clabel\u003e URL paths.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering BackendConfigEst resources.\n", "properties": { "auditFields": { "type": "array", "items": { "type": "string" }, "description": "Fields parsed from the CSR that appear in the audit and can be used by sentinel policies.\n\n\u003ca id=\"nestedatt--authenticators\"\u003e\u003c/a\u003e\n" }, "authenticators": { "$ref": "#/types/vault:pkiSecret/BackendConfigEstAuthenticators:BackendConfigEstAuthenticators", "description": "Lists the mount accessors EST should delegate authentication requests towards (see below for nested schema).\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the EST configuration from, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "defaultMount": { "type": "boolean", "description": "If set, this mount will register the default `.well-known/est` URL path. Only a single mount can enable this across a Vault cluster.\n" }, "defaultPathPolicy": { "type": "string", "description": "Required to be set if\u003cspan pulumi-lang-nodejs=\" defaultMount \" pulumi-lang-dotnet=\" DefaultMount \" pulumi-lang-go=\" defaultMount \" pulumi-lang-python=\" default_mount \" pulumi-lang-yaml=\" defaultMount \" pulumi-lang-java=\" defaultMount \" pulumi-lang-hcl=\" default_mount \"\u003e defaultMount \u003c/span\u003eis enabled. Specifies the behavior for requests using the default EST label. Can be sign-verbatim or a role given by role:\u003crole_name\u003e.\n" }, "enableSentinelParsing": { "type": "boolean", "description": "If set, parse out fields from the provided CSR making them available for Sentinel policies.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether EST is enabled.\n" }, "labelToPathPolicy": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:\u003crole_name\u003e. Labels must be unique across Vault cluster, and will register .well-known/est/\u003clabel\u003e URL paths.\n" }, "lastUpdated": { "type": "string", "description": "A read-only timestamp representing the last time the configuration was updated.\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/backendConfigScep:BackendConfigScep": { "description": "Allows setting the SCEP configuration on a PKI Secret Backend.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst scep = new vault.AuthBackend(\"scep\", {\n path: \"scep-auth\",\n type: \"scep\",\n});\nconst scepChallenge = new vault.ScepAuthBackendRole(\"scep_challenge\", {\n backend: scep.id,\n name: \"scep-auth\",\n displayName: \"Static challenge for SCEP clients\",\n authType: \"static-challenge\",\n challenge: \"ac7e4ada-c8ef-4393-9098-d69d08736833\",\n});\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki_scep\",\n type: \"pki\",\n description: \"PKI secret engine mount\",\n});\nconst test = new vault.pkisecret.BackendConfigScep(\"test\", {\n backend: pki.path,\n enabled: true,\n defaultPathPolicy: \"sign-verbatim\",\n restrictCaChainToIssuer: true,\n authenticators: {\n scep: {\n accessor: scep.accessor,\n scep_role: scepChallenge.name,\n },\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nscep = vault.AuthBackend(\"scep\",\n path=\"scep-auth\",\n type=\"scep\")\nscep_challenge = vault.ScepAuthBackendRole(\"scep_challenge\",\n backend=scep.id,\n name=\"scep-auth\",\n display_name=\"Static challenge for SCEP clients\",\n auth_type=\"static-challenge\",\n challenge=\"ac7e4ada-c8ef-4393-9098-d69d08736833\")\npki = vault.Mount(\"pki\",\n path=\"pki_scep\",\n type=\"pki\",\n description=\"PKI secret engine mount\")\ntest = vault.pkisecret.BackendConfigScep(\"test\",\n backend=pki.path,\n enabled=True,\n default_path_policy=\"sign-verbatim\",\n restrict_ca_chain_to_issuer=True,\n authenticators={\n \"scep\": {\n \"accessor\": scep.accessor,\n \"scep_role\": scep_challenge.name,\n },\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var scep = new Vault.AuthBackend(\"scep\", new()\n {\n Path = \"scep-auth\",\n Type = \"scep\",\n });\n\n var scepChallenge = new Vault.ScepAuthBackendRole(\"scep_challenge\", new()\n {\n Backend = scep.Id,\n Name = \"scep-auth\",\n DisplayName = \"Static challenge for SCEP clients\",\n AuthType = \"static-challenge\",\n Challenge = \"ac7e4ada-c8ef-4393-9098-d69d08736833\",\n });\n\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki_scep\",\n Type = \"pki\",\n Description = \"PKI secret engine mount\",\n });\n\n var test = new Vault.PkiSecret.BackendConfigScep(\"test\", new()\n {\n Backend = pki.Path,\n Enabled = true,\n DefaultPathPolicy = \"sign-verbatim\",\n RestrictCaChainToIssuer = true,\n Authenticators = new Vault.PkiSecret.Inputs.BackendConfigScepAuthenticatorsArgs\n {\n Scep = \n {\n { \"accessor\", scep.Accessor },\n { \"scep_role\", scepChallenge.Name },\n },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tscep, err := vault.NewAuthBackend(ctx, \"scep\", \u0026vault.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"scep-auth\"),\n\t\t\tType: pulumi.String(\"scep\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tscepChallenge, err := vault.NewScepAuthBackendRole(ctx, \"scep_challenge\", \u0026vault.ScepAuthBackendRoleArgs{\n\t\t\tBackend: scep.ID().ToIDOutput().ToStringOutput(),\n\t\t\tName: pulumi.String(\"scep-auth\"),\n\t\t\tDisplayName: pulumi.String(\"Static challenge for SCEP clients\"),\n\t\t\tAuthType: pulumi.String(\"static-challenge\"),\n\t\t\tChallenge: pulumi.String(\"ac7e4ada-c8ef-4393-9098-d69d08736833\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki_scep\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"PKI secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewBackendConfigScep(ctx, \"test\", \u0026pkisecret.BackendConfigScepArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tEnabled: pulumi.Bool(true),\n\t\t\tDefaultPathPolicy: pulumi.String(\"sign-verbatim\"),\n\t\t\tRestrictCaChainToIssuer: pulumi.Bool(true),\n\t\t\tAuthenticators: \u0026pkisecret.BackendConfigScepAuthenticatorsArgs{\n\t\t\t\tScep: pulumi.StringMap{\n\t\t\t\t\t\"accessor\": scep.Accessor,\n\t\t\t\t\t\"scep_role\": scepChallenge.Name,\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"scep\" {\n path = \"scep-auth\"\n type = \"scep\"\n}\nresource \"vault_scepauthbackendrole\" \"scep_challenge\" {\n backend = vault_authbackend.scep.id\n name = \"scep-auth\"\n display_name = \"Static challenge for SCEP clients\"\n auth_type = \"static-challenge\"\n challenge = \"ac7e4ada-c8ef-4393-9098-d69d08736833\"\n}\nresource \"vault_mount\" \"pki\" {\n path = \"pki_scep\"\n type = \"pki\"\n description = \"PKI secret engine mount\"\n}\nresource \"vault_pkisecret_backendconfigscep\" \"test\" {\n backend = vault_mount.pki.path\n enabled = true\n default_path_policy = \"sign-verbatim\"\n restrict_ca_chain_to_issuer = true\n authenticators = {\n scep = {\n \"accessor\" = vault_authbackend.scep.accessor\n \"scep_role\" = vault_scepauthbackendrole.scep_challenge.name\n }\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.ScepAuthBackendRole;\nimport com.pulumi.vault.ScepAuthBackendRoleArgs;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.BackendConfigScep;\nimport com.pulumi.vault.pkiSecret.BackendConfigScepArgs;\nimport com.pulumi.vault.pkiSecret.inputs.BackendConfigScepAuthenticatorsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var scep = new AuthBackend(\"scep\", AuthBackendArgs.builder()\n .path(\"scep-auth\")\n .type(\"scep\")\n .build());\n\n var scepChallenge = new ScepAuthBackendRole(\"scepChallenge\", ScepAuthBackendRoleArgs.builder()\n .backend(scep.id())\n .name(\"scep-auth\")\n .displayName(\"Static challenge for SCEP clients\")\n .authType(\"static-challenge\")\n .challenge(\"ac7e4ada-c8ef-4393-9098-d69d08736833\")\n .build());\n\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki_scep\")\n .type(\"pki\")\n .description(\"PKI secret engine mount\")\n .build());\n\n var test = new BackendConfigScep(\"test\", BackendConfigScepArgs.builder()\n .backend(pki.path())\n .enabled(true)\n .defaultPathPolicy(\"sign-verbatim\")\n .restrictCaChainToIssuer(true)\n .authenticators(BackendConfigScepAuthenticatorsArgs.builder()\n .scep(Map.ofEntries(\n Map.entry(\"accessor\", scep.accessor()),\n Map.entry(\"scep_role\", scepChallenge.name())\n ))\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n scep:\n type: vault:AuthBackend\n properties:\n path: scep-auth\n type: scep\n scepChallenge:\n type: vault:ScepAuthBackendRole\n name: scep_challenge\n properties:\n backend: ${scep.id}\n name: scep-auth\n displayName: Static challenge for SCEP clients\n authType: static-challenge\n challenge: ac7e4ada-c8ef-4393-9098-d69d08736833\n pki:\n type: vault:Mount\n properties:\n path: pki_scep\n type: pki\n description: PKI secret engine mount\n test:\n type: vault:pkiSecret:BackendConfigScep\n properties:\n backend: ${pki.path}\n enabled: true\n defaultPathPolicy: sign-verbatim\n restrictCaChainToIssuer: true\n authenticators:\n scep:\n accessor: ${scep.accessor}\n scep_role: ${scepChallenge.name}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe PKI config cluster can be imported using the resource's \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e.\nIn the case of the example above the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e would be `pki-root/config/scep`,\nwhere the `pki-root` component is the resource's \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/backendConfigScep:BackendConfigScep example pki-root/config/scep\n```\n\n", "properties": { "allowedDigestAlgorithms": { "type": "array", "items": { "type": "string" }, "description": "List of allowed digest algorithms for SCEP requests.\n" }, "allowedEncryptionAlgorithms": { "type": "array", "items": { "type": "string" }, "description": "List of allowed encryption algorithms for SCEP requests.\n" }, "authenticators": { "$ref": "#/types/vault:pkiSecret/BackendConfigScepAuthenticators:BackendConfigScepAuthenticators", "description": "Lists the mount accessors SCEP should delegate authentication requests towards (see below for nested schema).\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the SCEP configuration from, with no leading or trailing `/`s.\n" }, "defaultPathPolicy": { "type": "string", "description": "Specifies the policy to be used for non-role-qualified SCEP requests; valid values are 'sign-verbatim', or \"role:\u003crole_name\u003e\" to specify a role to use as this policy.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether SCEP is enabled.\n" }, "externalValidations": { "type": "array", "items": { "$ref": "#/types/vault:pkiSecret/BackendConfigScepExternalValidation:BackendConfigScepExternalValidation" }, "description": "Lists the 3rd party validation of SCEP requests (see below for nested schema).\n" }, "lastUpdated": { "type": "string", "description": "A read-only timestamp representing the last time the configuration was updated.\n" }, "logLevel": { "type": "string", "description": "The level of logging verbosity, affects only SCEP logs on this mount.\n\n\n\u003ca id=\"nestedatt--authenticators\"\u003e\u003c/a\u003e\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "restrictCaChainToIssuer": { "type": "boolean", "description": "If true, only return the issuer CA, otherwise the entire CA certificate chain will be returned if available from the PKI mount.\n" } }, "required": [ "allowedDigestAlgorithms", "allowedEncryptionAlgorithms", "authenticators", "backend", "externalValidations", "lastUpdated", "logLevel" ], "inputProperties": { "allowedDigestAlgorithms": { "type": "array", "items": { "type": "string" }, "description": "List of allowed digest algorithms for SCEP requests.\n" }, "allowedEncryptionAlgorithms": { "type": "array", "items": { "type": "string" }, "description": "List of allowed encryption algorithms for SCEP requests.\n" }, "authenticators": { "$ref": "#/types/vault:pkiSecret/BackendConfigScepAuthenticators:BackendConfigScepAuthenticators", "description": "Lists the mount accessors SCEP should delegate authentication requests towards (see below for nested schema).\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the SCEP configuration from, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "defaultPathPolicy": { "type": "string", "description": "Specifies the policy to be used for non-role-qualified SCEP requests; valid values are 'sign-verbatim', or \"role:\u003crole_name\u003e\" to specify a role to use as this policy.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether SCEP is enabled.\n" }, "externalValidations": { "type": "array", "items": { "$ref": "#/types/vault:pkiSecret/BackendConfigScepExternalValidation:BackendConfigScepExternalValidation" }, "description": "Lists the 3rd party validation of SCEP requests (see below for nested schema).\n" }, "logLevel": { "type": "string", "description": "The level of logging verbosity, affects only SCEP logs on this mount.\n\n\n\u003ca id=\"nestedatt--authenticators\"\u003e\u003c/a\u003e\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "restrictCaChainToIssuer": { "type": "boolean", "description": "If true, only return the issuer CA, otherwise the entire CA certificate chain will be returned if available from the PKI mount.\n" } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering BackendConfigScep resources.\n", "properties": { "allowedDigestAlgorithms": { "type": "array", "items": { "type": "string" }, "description": "List of allowed digest algorithms for SCEP requests.\n" }, "allowedEncryptionAlgorithms": { "type": "array", "items": { "type": "string" }, "description": "List of allowed encryption algorithms for SCEP requests.\n" }, "authenticators": { "$ref": "#/types/vault:pkiSecret/BackendConfigScepAuthenticators:BackendConfigScepAuthenticators", "description": "Lists the mount accessors SCEP should delegate authentication requests towards (see below for nested schema).\n" }, "backend": { "type": "string", "description": "The path to the PKI secret backend to\nread the SCEP configuration from, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "defaultPathPolicy": { "type": "string", "description": "Specifies the policy to be used for non-role-qualified SCEP requests; valid values are 'sign-verbatim', or \"role:\u003crole_name\u003e\" to specify a role to use as this policy.\n" }, "enabled": { "type": "boolean", "description": "Specifies whether SCEP is enabled.\n" }, "externalValidations": { "type": "array", "items": { "$ref": "#/types/vault:pkiSecret/BackendConfigScepExternalValidation:BackendConfigScepExternalValidation" }, "description": "Lists the 3rd party validation of SCEP requests (see below for nested schema).\n" }, "lastUpdated": { "type": "string", "description": "A read-only timestamp representing the last time the configuration was updated.\n" }, "logLevel": { "type": "string", "description": "The level of logging verbosity, affects only SCEP logs on this mount.\n\n\n\u003ca id=\"nestedatt--authenticators\"\u003e\u003c/a\u003e\n" }, "namespace": { "type": "string", "description": "The namespace of the target resource.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "restrictCaChainToIssuer": { "type": "boolean", "description": "If true, only return the issuer CA, otherwise the entire CA certificate chain will be returned if available from the PKI mount.\n" } }, "type": "object" } }, "vault:pkiSecret/secretBackendCert:SecretBackendCert": { "description": "Generates a certificate from the PKI Secret Backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst app = new vault.pkisecret.SecretBackendCert(\"app\", {\n backend: intermediate.path,\n name: test.name,\n commonName: \"app.my.domain\",\n}, {\n dependsOn: [admin],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\napp = vault.pkisecret.SecretBackendCert(\"app\",\n backend=intermediate[\"path\"],\n name=test[\"name\"],\n common_name=\"app.my.domain\",\n opts = pulumi.ResourceOptions(depends_on=[admin]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var app = new Vault.PkiSecret.SecretBackendCert(\"app\", new()\n {\n Backend = intermediate.Path,\n Name = test.Name,\n CommonName = \"app.my.domain\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n admin,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := pkisecret.NewSecretBackendCert(ctx, \"app\", \u0026pkisecret.SecretBackendCertArgs{\n\t\t\tBackend: pulumi.Any(intermediate.Path),\n\t\t\tName: pulumi.Any(test.Name),\n\t\t\tCommonName: pulumi.String(\"app.my.domain\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tadmin,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pkisecret_secretbackendcert\" \"app\" {\n depends_on = [admin]\n backend = intermediate.path\n name = test.name\n common_name = \"app.my.domain\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.pkiSecret.SecretBackendCert;\nimport com.pulumi.vault.pkiSecret.SecretBackendCertArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var app = new SecretBackendCert(\"app\", SecretBackendCertArgs.builder()\n .backend(intermediate.path())\n .name(test.name())\n .commonName(\"app.my.domain\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(admin)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n app:\n type: vault:pkiSecret:SecretBackendCert\n properties:\n backend: ${intermediate.path}\n name: ${test.name}\n commonName: app.my.domain\n options:\n dependsOn:\n - ${admin}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n" }, "autoRenew": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, certs will be renewed if the expiration is within \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n" }, "caChain": { "type": "string", "description": "The CA chain\n" }, "certMetadata": { "type": "string", "description": "A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's\u003cspan pulumi-lang-nodejs=\" noStoreMetadata \" pulumi-lang-dotnet=\" NoStoreMetadata \" pulumi-lang-go=\" noStoreMetadata \" pulumi-lang-python=\" no_store_metadata \" pulumi-lang-yaml=\" noStoreMetadata \" pulumi-lang-java=\" noStoreMetadata \" pulumi-lang-hcl=\" no_store_metadata \"\u003e noStoreMetadata \u003c/span\u003emust be set to false, otherwise an error is returned when specified.\n" }, "certificate": { "type": "string", "description": "The certificate\n" }, "commonName": { "type": "string", "description": "CN of certificate to create\n" }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n" }, "expiration": { "type": "integer", "description": "The expiration date of the certificate in unix epoch format\n" }, "format": { "type": "string", "description": "The format of data. Valid values are \"pem\", \u003cspan pulumi-lang-nodejs=\"\"pemBundle\"\" pulumi-lang-dotnet=\"\"PemBundle\"\" pulumi-lang-go=\"\"pemBundle\"\" pulumi-lang-python=\"\"pem_bundle\"\" pulumi-lang-yaml=\"\"pemBundle\"\" pulumi-lang-java=\"\"pemBundle\"\" pulumi-lang-hcl=\"\"pem_bundle\"\"\u003e\"pemBundle\"\u003c/span\u003e, \"der\", \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. Values \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e require Vault 2.0.5+.\n" }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n" }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request." }, "issuingCa": { "type": "string", "description": "The issuing CA\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n" }, "jksPrivateKeyAlias": { "type": "string", "description": "The entry alias in the Java keystore (JKS) when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e and bundle contains a single PrivateKeyEntry. This field is case-sensitive, but relying on case-only differences for unique aliases is not recommended. Defaults to \"1\". This parameter is ignored by endpoints that return TrustedCertificateEntry values (JKS trust stores), and entry aliases are assigned incrementing numeric strings starting at \"1\". Requires Vault 2.0.5+.\n" }, "minSecondsRemaining": { "type": "integer", "description": "Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)\n" }, "name": { "type": "string", "description": "Name of the role to create the certificate against\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n" }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n" }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided,defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n" }, "privateKey": { "type": "string", "description": "The private key\n", "secret": true }, "privateKeyFormat": { "type": "string", "description": "The private key format\n" }, "privateKeyType": { "type": "string", "description": "The private key type\n" }, "removeRootsFromChain": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the returned \u003cspan pulumi-lang-nodejs=\"`caChain`\" pulumi-lang-dotnet=\"`CaChain`\" pulumi-lang-go=\"`caChain`\" pulumi-lang-python=\"`ca_chain`\" pulumi-lang-yaml=\"`caChain`\" pulumi-lang-java=\"`caChain`\" pulumi-lang-hcl=\"`ca_chain`\"\u003e`caChain`\u003c/span\u003e field will not include any self-signed CA certificates. Useful if end-users already have the root CA in their trust store. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "renewPending": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the current time (during refresh) is after the start of the early renewal window declared by \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e otherwise; if \u003cspan pulumi-lang-nodejs=\"`autoRenew`\" pulumi-lang-dotnet=\"`AutoRenew`\" pulumi-lang-go=\"`autoRenew`\" pulumi-lang-python=\"`auto_renew`\" pulumi-lang-yaml=\"`autoRenew`\" pulumi-lang-java=\"`autoRenew`\" pulumi-lang-hcl=\"`auto_renew`\"\u003e`autoRenew`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e then the provider will plan to replace the certificate once renewal is pending.\n" }, "revoke": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the certificate will be revoked on resource destruction using the \u003cspan pulumi-lang-nodejs=\"`revoke`\" pulumi-lang-dotnet=\"`Revoke`\" pulumi-lang-go=\"`revoke`\" pulumi-lang-python=\"`revoke`\" pulumi-lang-yaml=\"`revoke`\" pulumi-lang-java=\"`revoke`\" pulumi-lang-hcl=\"`revoke`\"\u003e`revoke`\u003c/span\u003e PKI API. Conflicts with \u003cspan pulumi-lang-nodejs=\"`revokeWithKey`\" pulumi-lang-dotnet=\"`RevokeWithKey`\" pulumi-lang-go=\"`revokeWithKey`\" pulumi-lang-python=\"`revoke_with_key`\" pulumi-lang-yaml=\"`revokeWithKey`\" pulumi-lang-java=\"`revokeWithKey`\" pulumi-lang-hcl=\"`revoke_with_key`\"\u003e`revokeWithKey`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "revokeWithKey": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the certificate will be revoked on resource destruction using the `revoke-with-key` PKI API. Conflicts with \u003cspan pulumi-lang-nodejs=\"`revoke`\" pulumi-lang-dotnet=\"`Revoke`\" pulumi-lang-go=\"`revoke`\" pulumi-lang-python=\"`revoke`\" pulumi-lang-yaml=\"`revoke`\" pulumi-lang-java=\"`revoke`\" pulumi-lang-hcl=\"`revoke`\"\u003e`revoke`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "serialNumber": { "type": "string", "description": "The serial number\n" }, "ttl": { "type": "string", "description": "Time to live\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n" }, "userIds": { "type": "array", "items": { "type": "string" }, "description": "List of Subject User IDs\n" } }, "required": [ "backend", "caChain", "certificate", "commonName", "expiration", "issuingCa", "name", "privateKey", "privateKeyType", "renewPending", "serialNumber" ], "inputProperties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "autoRenew": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, certs will be renewed if the expiration is within \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "certMetadata": { "type": "string", "description": "A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's\u003cspan pulumi-lang-nodejs=\" noStoreMetadata \" pulumi-lang-dotnet=\" NoStoreMetadata \" pulumi-lang-go=\" noStoreMetadata \" pulumi-lang-python=\" no_store_metadata \" pulumi-lang-yaml=\" noStoreMetadata \" pulumi-lang-java=\" noStoreMetadata \" pulumi-lang-hcl=\" no_store_metadata \"\u003e noStoreMetadata \u003c/span\u003emust be set to false, otherwise an error is returned when specified.\n" }, "commonName": { "type": "string", "description": "CN of certificate to create\n", "willReplaceOnChanges": true }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "format": { "type": "string", "description": "The format of data. Valid values are \"pem\", \u003cspan pulumi-lang-nodejs=\"\"pemBundle\"\" pulumi-lang-dotnet=\"\"PemBundle\"\" pulumi-lang-go=\"\"pemBundle\"\" pulumi-lang-python=\"\"pem_bundle\"\" pulumi-lang-yaml=\"\"pemBundle\"\" pulumi-lang-java=\"\"pemBundle\"\" pulumi-lang-hcl=\"\"pem_bundle\"\"\u003e\"pemBundle\"\u003c/span\u003e, \"der\", \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. Values \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e require Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request." }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "jksPrivateKeyAlias": { "type": "string", "description": "The entry alias in the Java keystore (JKS) when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e and bundle contains a single PrivateKeyEntry. This field is case-sensitive, but relying on case-only differences for unique aliases is not recommended. Defaults to \"1\". This parameter is ignored by endpoints that return TrustedCertificateEntry values (JKS trust stores), and entry aliases are assigned incrementing numeric strings starting at \"1\". Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "minSecondsRemaining": { "type": "integer", "description": "Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)\n" }, "name": { "type": "string", "description": "Name of the role to create the certificate against\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided,defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "privateKeyFormat": { "type": "string", "description": "The private key format\n", "willReplaceOnChanges": true }, "removeRootsFromChain": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the returned \u003cspan pulumi-lang-nodejs=\"`caChain`\" pulumi-lang-dotnet=\"`CaChain`\" pulumi-lang-go=\"`caChain`\" pulumi-lang-python=\"`ca_chain`\" pulumi-lang-yaml=\"`caChain`\" pulumi-lang-java=\"`caChain`\" pulumi-lang-hcl=\"`ca_chain`\"\u003e`caChain`\u003c/span\u003e field will not include any self-signed CA certificates. Useful if end-users already have the root CA in their trust store. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "revoke": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the certificate will be revoked on resource destruction using the \u003cspan pulumi-lang-nodejs=\"`revoke`\" pulumi-lang-dotnet=\"`Revoke`\" pulumi-lang-go=\"`revoke`\" pulumi-lang-python=\"`revoke`\" pulumi-lang-yaml=\"`revoke`\" pulumi-lang-java=\"`revoke`\" pulumi-lang-hcl=\"`revoke`\"\u003e`revoke`\u003c/span\u003e PKI API. Conflicts with \u003cspan pulumi-lang-nodejs=\"`revokeWithKey`\" pulumi-lang-dotnet=\"`RevokeWithKey`\" pulumi-lang-go=\"`revokeWithKey`\" pulumi-lang-python=\"`revoke_with_key`\" pulumi-lang-yaml=\"`revokeWithKey`\" pulumi-lang-java=\"`revokeWithKey`\" pulumi-lang-hcl=\"`revoke_with_key`\"\u003e`revokeWithKey`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "revokeWithKey": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the certificate will be revoked on resource destruction using the `revoke-with-key` PKI API. Conflicts with \u003cspan pulumi-lang-nodejs=\"`revoke`\" pulumi-lang-dotnet=\"`Revoke`\" pulumi-lang-go=\"`revoke`\" pulumi-lang-python=\"`revoke`\" pulumi-lang-yaml=\"`revoke`\" pulumi-lang-java=\"`revoke`\" pulumi-lang-hcl=\"`revoke`\"\u003e`revoke`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "ttl": { "type": "string", "description": "Time to live\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true }, "userIds": { "type": "array", "items": { "type": "string" }, "description": "List of Subject User IDs\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "commonName" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendCert resources.\n", "properties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "autoRenew": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, certs will be renewed if the expiration is within \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "caChain": { "type": "string", "description": "The CA chain\n" }, "certMetadata": { "type": "string", "description": "A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's\u003cspan pulumi-lang-nodejs=\" noStoreMetadata \" pulumi-lang-dotnet=\" NoStoreMetadata \" pulumi-lang-go=\" noStoreMetadata \" pulumi-lang-python=\" no_store_metadata \" pulumi-lang-yaml=\" noStoreMetadata \" pulumi-lang-java=\" noStoreMetadata \" pulumi-lang-hcl=\" no_store_metadata \"\u003e noStoreMetadata \u003c/span\u003emust be set to false, otherwise an error is returned when specified.\n" }, "certificate": { "type": "string", "description": "The certificate\n" }, "commonName": { "type": "string", "description": "CN of certificate to create\n", "willReplaceOnChanges": true }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "expiration": { "type": "integer", "description": "The expiration date of the certificate in unix epoch format\n" }, "format": { "type": "string", "description": "The format of data. Valid values are \"pem\", \u003cspan pulumi-lang-nodejs=\"\"pemBundle\"\" pulumi-lang-dotnet=\"\"PemBundle\"\" pulumi-lang-go=\"\"pemBundle\"\" pulumi-lang-python=\"\"pem_bundle\"\" pulumi-lang-yaml=\"\"pemBundle\"\" pulumi-lang-java=\"\"pemBundle\"\" pulumi-lang-hcl=\"\"pem_bundle\"\"\u003e\"pemBundle\"\u003c/span\u003e, \"der\", \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. Values \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e require Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request." }, "issuingCa": { "type": "string", "description": "The issuing CA\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "jksPrivateKeyAlias": { "type": "string", "description": "The entry alias in the Java keystore (JKS) when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e and bundle contains a single PrivateKeyEntry. This field is case-sensitive, but relying on case-only differences for unique aliases is not recommended. Defaults to \"1\". This parameter is ignored by endpoints that return TrustedCertificateEntry values (JKS trust stores), and entry aliases are assigned incrementing numeric strings starting at \"1\". Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "minSecondsRemaining": { "type": "integer", "description": "Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)\n" }, "name": { "type": "string", "description": "Name of the role to create the certificate against\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided,defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "privateKey": { "type": "string", "description": "The private key\n", "secret": true }, "privateKeyFormat": { "type": "string", "description": "The private key format\n", "willReplaceOnChanges": true }, "privateKeyType": { "type": "string", "description": "The private key type\n" }, "removeRootsFromChain": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the returned \u003cspan pulumi-lang-nodejs=\"`caChain`\" pulumi-lang-dotnet=\"`CaChain`\" pulumi-lang-go=\"`caChain`\" pulumi-lang-python=\"`ca_chain`\" pulumi-lang-yaml=\"`caChain`\" pulumi-lang-java=\"`caChain`\" pulumi-lang-hcl=\"`ca_chain`\"\u003e`caChain`\u003c/span\u003e field will not include any self-signed CA certificates. Useful if end-users already have the root CA in their trust store. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "renewPending": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the current time (during refresh) is after the start of the early renewal window declared by \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e otherwise; if \u003cspan pulumi-lang-nodejs=\"`autoRenew`\" pulumi-lang-dotnet=\"`AutoRenew`\" pulumi-lang-go=\"`autoRenew`\" pulumi-lang-python=\"`auto_renew`\" pulumi-lang-yaml=\"`autoRenew`\" pulumi-lang-java=\"`autoRenew`\" pulumi-lang-hcl=\"`auto_renew`\"\u003e`autoRenew`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e then the provider will plan to replace the certificate once renewal is pending.\n" }, "revoke": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the certificate will be revoked on resource destruction using the \u003cspan pulumi-lang-nodejs=\"`revoke`\" pulumi-lang-dotnet=\"`Revoke`\" pulumi-lang-go=\"`revoke`\" pulumi-lang-python=\"`revoke`\" pulumi-lang-yaml=\"`revoke`\" pulumi-lang-java=\"`revoke`\" pulumi-lang-hcl=\"`revoke`\"\u003e`revoke`\u003c/span\u003e PKI API. Conflicts with \u003cspan pulumi-lang-nodejs=\"`revokeWithKey`\" pulumi-lang-dotnet=\"`RevokeWithKey`\" pulumi-lang-go=\"`revokeWithKey`\" pulumi-lang-python=\"`revoke_with_key`\" pulumi-lang-yaml=\"`revokeWithKey`\" pulumi-lang-java=\"`revokeWithKey`\" pulumi-lang-hcl=\"`revoke_with_key`\"\u003e`revokeWithKey`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "revokeWithKey": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the certificate will be revoked on resource destruction using the `revoke-with-key` PKI API. Conflicts with \u003cspan pulumi-lang-nodejs=\"`revoke`\" pulumi-lang-dotnet=\"`Revoke`\" pulumi-lang-go=\"`revoke`\" pulumi-lang-python=\"`revoke`\" pulumi-lang-yaml=\"`revoke`\" pulumi-lang-java=\"`revoke`\" pulumi-lang-hcl=\"`revoke`\"\u003e`revoke`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "serialNumber": { "type": "string", "description": "The serial number\n" }, "ttl": { "type": "string", "description": "Time to live\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true }, "userIds": { "type": "array", "items": { "type": "string" }, "description": "List of Subject User IDs\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/secretBackendConfigCa:SecretBackendConfigCa": { "description": "Submits the CA information to a PKI Secret Backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst intermediate = new vault.pkisecret.SecretBackendConfigCa(\"intermediate\", {\n backend: intermediateVaultMount.path,\n pemBundle: `-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAwvEHeJCXnFgi88rE1dTX6FHdBPK0wSjedh0ywVnCZxLWbBv/\n5PytjTcCPdrfW7g2sfbPwOge/WF3X2KeYSP8SxZA0czmz6QDspeG921JkZWtyp5o\n++N0leLTIUAhq339p3O1onAOUO1k4sHfmCwfrDpTn2hcx4URa5Pzzb1fHigusjIH\n1mcGdncaA6Z2CzO1w4E8kPOUukIDrcZT4faOZrWUIQZKQw2JzTyKJ+ZMDCZq2TFz\nWwpL3eG48wB7J7mibFQ/9nFvxpIflBjDAZ8QiqkwYr5N0DNsTxcfTCSeubfJDCUf\nIWwFZhLitzwOxazazUQKXX/SPMQ1l/L9o3nnHwIDAQABAoIBAAQidJQcDPsl62fc\nTxxx7TpiMhvewfKu2TkMGX18V+EzxxR364+BxHSQTB3fvIkHeTGBGJrw0WdyX8PI\nJa/NwZYeHLXWcLbKtcFd8WDiEoNh91Oq1HMzOc/MBcpYv94RSAX7MEkHs2YIAvHE\nRufFV86hVhC1d/JLYjkz5CHi+Fd9XTYjBK78tHhJd4IJPu5LYvwlmzC1zeS7s1Tg\nQW1FQuVDV8tWa4PMTrQHwfaGqn95AKc+tbg+ubpCiWl5bBNI3Ghuh4sAC9dMdAkd\nw27i29O9/Y3XJSSGUZlZqDBP4YU388RgHpzLDUxgRcaQt9vdeEz6frULPW67e9D2\nmPPDzjECgYEA4aPOwvnSwGoOKsS6vANGy4Ajsq09PR+1ltMJUR5kDlXGuZWI72eX\n3/GAnovDuCp0tbYt0r7Fmkfel0Ore7SYM18TH5QGpPddcZLvKUf7AchCIOYY0Te3\npS9+7S1lEGrLXyuox4N26Ov6wHVrmZTcQoZsDWbjYxNNsNACsiQNjGMCgYEA3SvQ\nJets9e9SgNVvao2TijX+/vcNKRfcWB71T9Xc4BuSNEu5+ZLtptlwaSnVCVu1Xilk\nsWDh+3EhByl4EteENPvE/7A2s1sfcDOprvg0r52aBZKeTp0AukrT8+Ad4hap7g1x\n2Lz11MFDkhRqt2KqQaIL+5Mq5WfptbBJ0YI7ARUCgYAD6iSfK1hlsDFYupsGwgPL\nagi0g97pHZC38idaOe3AdeqBs79xb9mpr/XsSj52Bn6J3IRFALxK5e5Nr4XdGo/9\nbCvXw2iuGgCMBOGTVMVdDY1gJr3Ne2r7Oay5Dq2PMFsg5pACDhzVA6sRBbh9LKD5\non1jaiKNyHrzk1hIoOl/QwKBgA+Ov2uLbfS2yvTpDpdOMiyss603r6NOXF+Ofe8J\nuinBhr1K/mAB59muveuH18Z6vv1KqByaFgtb39jjH+Eja9dWRns95/sh08pOuAbo\nyrv3uBfgQmaBQMXZ8aLcBv4aXgWyyGlYkWpP1fL2oLMZq6RGQ9WEeqX8c0ImjmrA\nYGopAoGBAJZPFlZi2Rfq4MfFZp/X1/zM09hphZwkxkSI+RnsjDUjTgB8CuQul5ep\nKWE98yLw4C25Cqw5fKKQ2addizLnZCAIfJKVNRjYLWlWyGQydDEUzqwXlSLS9LVX\nLxLkWDajIyjeFn21Ttb42L9pBo3TAQIxUenom/lP2SQTvCKBiPai\n-----END RSA PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUahce2sCO7Bom/Rznd5HsNAlr1NgwDQYJKoZIhvcNAQEL\nBQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\nGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODEyMDIwMTAxNDRaFw00NjEy\nMTUwMTAxNDRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\nHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQDC8Qd4kJecWCLzysTV1NfoUd0E8rTBKN52HTLBWcJn\nEtZsG//k/K2NNwI92t9buDax9s/A6B79YXdfYp5hI/xLFkDRzObPpAOyl4b3bUmR\nla3Knmj743SV4tMhQCGrff2nc7WicA5Q7WTiwd+YLB+sOlOfaFzHhRFrk/PNvV8e\nKC6yMgfWZwZ2dxoDpnYLM7XDgTyQ85S6QgOtxlPh9o5mtZQhBkpDDYnNPIon5kwM\nJmrZMXNbCkvd4bjzAHsnuaJsVD/2cW/Gkh+UGMMBnxCKqTBivk3QM2xPFx9MJJ65\nt8kMJR8hbAVmEuK3PA7FrNrNRApdf9I8xDWX8v2jeecfAgMBAAGjUzBRMB0GA1Ud\nDgQWBBQXGfrns8OqxTGKsXG5pDZS/WyyYDAfBgNVHSMEGDAWgBQXGfrns8OqxTGK\nsXG5pDZS/WyyYDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCt\n8aUX26cl2PgdIEByZSHAX5G+2b0IEtTclPkl4uDyyKRY4dVq6gK3ueVSU5eUmBip\nJbV5aRetovGOcV//8vbxkZm/ntQ8Oo+2sfGR5lIzd0UdlOr5pkD6g3bFy/zJ+4DR\nDAe8fklUacfz6CFmD+H8GyHm+fKmF+mjr4oOGQW6OegRDJHuiipUk2lJyuXdlPSa\nFpNRO2sGbjn000ANinFgnFiVzGDnx0/G1Kii/6GWrI6rrdVmXioQzF+8AloWckeB\n+hbmbwkwQa/JrLb5SWcBDOXSgtn1Li3XF5AQQBBjA3pOlyBXqnI94Irw89Lv9uPT\nMUR4qFxeUOW/GJGccMUd\n-----END CERTIFICATE-----\n`,\n}, {\n dependsOn: [intermediateVaultMount],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nintermediate = vault.pkisecret.SecretBackendConfigCa(\"intermediate\",\n backend=intermediate_vault_mount[\"path\"],\n pem_bundle=\"\"\"-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAwvEHeJCXnFgi88rE1dTX6FHdBPK0wSjedh0ywVnCZxLWbBv/\n5PytjTcCPdrfW7g2sfbPwOge/WF3X2KeYSP8SxZA0czmz6QDspeG921JkZWtyp5o\n++N0leLTIUAhq339p3O1onAOUO1k4sHfmCwfrDpTn2hcx4URa5Pzzb1fHigusjIH\n1mcGdncaA6Z2CzO1w4E8kPOUukIDrcZT4faOZrWUIQZKQw2JzTyKJ+ZMDCZq2TFz\nWwpL3eG48wB7J7mibFQ/9nFvxpIflBjDAZ8QiqkwYr5N0DNsTxcfTCSeubfJDCUf\nIWwFZhLitzwOxazazUQKXX/SPMQ1l/L9o3nnHwIDAQABAoIBAAQidJQcDPsl62fc\nTxxx7TpiMhvewfKu2TkMGX18V+EzxxR364+BxHSQTB3fvIkHeTGBGJrw0WdyX8PI\nJa/NwZYeHLXWcLbKtcFd8WDiEoNh91Oq1HMzOc/MBcpYv94RSAX7MEkHs2YIAvHE\nRufFV86hVhC1d/JLYjkz5CHi+Fd9XTYjBK78tHhJd4IJPu5LYvwlmzC1zeS7s1Tg\nQW1FQuVDV8tWa4PMTrQHwfaGqn95AKc+tbg+ubpCiWl5bBNI3Ghuh4sAC9dMdAkd\nw27i29O9/Y3XJSSGUZlZqDBP4YU388RgHpzLDUxgRcaQt9vdeEz6frULPW67e9D2\nmPPDzjECgYEA4aPOwvnSwGoOKsS6vANGy4Ajsq09PR+1ltMJUR5kDlXGuZWI72eX\n3/GAnovDuCp0tbYt0r7Fmkfel0Ore7SYM18TH5QGpPddcZLvKUf7AchCIOYY0Te3\npS9+7S1lEGrLXyuox4N26Ov6wHVrmZTcQoZsDWbjYxNNsNACsiQNjGMCgYEA3SvQ\nJets9e9SgNVvao2TijX+/vcNKRfcWB71T9Xc4BuSNEu5+ZLtptlwaSnVCVu1Xilk\nsWDh+3EhByl4EteENPvE/7A2s1sfcDOprvg0r52aBZKeTp0AukrT8+Ad4hap7g1x\n2Lz11MFDkhRqt2KqQaIL+5Mq5WfptbBJ0YI7ARUCgYAD6iSfK1hlsDFYupsGwgPL\nagi0g97pHZC38idaOe3AdeqBs79xb9mpr/XsSj52Bn6J3IRFALxK5e5Nr4XdGo/9\nbCvXw2iuGgCMBOGTVMVdDY1gJr3Ne2r7Oay5Dq2PMFsg5pACDhzVA6sRBbh9LKD5\non1jaiKNyHrzk1hIoOl/QwKBgA+Ov2uLbfS2yvTpDpdOMiyss603r6NOXF+Ofe8J\nuinBhr1K/mAB59muveuH18Z6vv1KqByaFgtb39jjH+Eja9dWRns95/sh08pOuAbo\nyrv3uBfgQmaBQMXZ8aLcBv4aXgWyyGlYkWpP1fL2oLMZq6RGQ9WEeqX8c0ImjmrA\nYGopAoGBAJZPFlZi2Rfq4MfFZp/X1/zM09hphZwkxkSI+RnsjDUjTgB8CuQul5ep\nKWE98yLw4C25Cqw5fKKQ2addizLnZCAIfJKVNRjYLWlWyGQydDEUzqwXlSLS9LVX\nLxLkWDajIyjeFn21Ttb42L9pBo3TAQIxUenom/lP2SQTvCKBiPai\n-----END RSA PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUahce2sCO7Bom/Rznd5HsNAlr1NgwDQYJKoZIhvcNAQEL\nBQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\nGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODEyMDIwMTAxNDRaFw00NjEy\nMTUwMTAxNDRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\nHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQDC8Qd4kJecWCLzysTV1NfoUd0E8rTBKN52HTLBWcJn\nEtZsG//k/K2NNwI92t9buDax9s/A6B79YXdfYp5hI/xLFkDRzObPpAOyl4b3bUmR\nla3Knmj743SV4tMhQCGrff2nc7WicA5Q7WTiwd+YLB+sOlOfaFzHhRFrk/PNvV8e\nKC6yMgfWZwZ2dxoDpnYLM7XDgTyQ85S6QgOtxlPh9o5mtZQhBkpDDYnNPIon5kwM\nJmrZMXNbCkvd4bjzAHsnuaJsVD/2cW/Gkh+UGMMBnxCKqTBivk3QM2xPFx9MJJ65\nt8kMJR8hbAVmEuK3PA7FrNrNRApdf9I8xDWX8v2jeecfAgMBAAGjUzBRMB0GA1Ud\nDgQWBBQXGfrns8OqxTGKsXG5pDZS/WyyYDAfBgNVHSMEGDAWgBQXGfrns8OqxTGK\nsXG5pDZS/WyyYDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCt\n8aUX26cl2PgdIEByZSHAX5G+2b0IEtTclPkl4uDyyKRY4dVq6gK3ueVSU5eUmBip\nJbV5aRetovGOcV//8vbxkZm/ntQ8Oo+2sfGR5lIzd0UdlOr5pkD6g3bFy/zJ+4DR\nDAe8fklUacfz6CFmD+H8GyHm+fKmF+mjr4oOGQW6OegRDJHuiipUk2lJyuXdlPSa\nFpNRO2sGbjn000ANinFgnFiVzGDnx0/G1Kii/6GWrI6rrdVmXioQzF+8AloWckeB\n+hbmbwkwQa/JrLb5SWcBDOXSgtn1Li3XF5AQQBBjA3pOlyBXqnI94Irw89Lv9uPT\nMUR4qFxeUOW/GJGccMUd\n-----END CERTIFICATE-----\n\"\"\",\n opts = pulumi.ResourceOptions(depends_on=[intermediate_vault_mount]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var intermediate = new Vault.PkiSecret.SecretBackendConfigCa(\"intermediate\", new()\n {\n Backend = intermediateVaultMount.Path,\n PemBundle = @\"-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAwvEHeJCXnFgi88rE1dTX6FHdBPK0wSjedh0ywVnCZxLWbBv/\n5PytjTcCPdrfW7g2sfbPwOge/WF3X2KeYSP8SxZA0czmz6QDspeG921JkZWtyp5o\n++N0leLTIUAhq339p3O1onAOUO1k4sHfmCwfrDpTn2hcx4URa5Pzzb1fHigusjIH\n1mcGdncaA6Z2CzO1w4E8kPOUukIDrcZT4faOZrWUIQZKQw2JzTyKJ+ZMDCZq2TFz\nWwpL3eG48wB7J7mibFQ/9nFvxpIflBjDAZ8QiqkwYr5N0DNsTxcfTCSeubfJDCUf\nIWwFZhLitzwOxazazUQKXX/SPMQ1l/L9o3nnHwIDAQABAoIBAAQidJQcDPsl62fc\nTxxx7TpiMhvewfKu2TkMGX18V+EzxxR364+BxHSQTB3fvIkHeTGBGJrw0WdyX8PI\nJa/NwZYeHLXWcLbKtcFd8WDiEoNh91Oq1HMzOc/MBcpYv94RSAX7MEkHs2YIAvHE\nRufFV86hVhC1d/JLYjkz5CHi+Fd9XTYjBK78tHhJd4IJPu5LYvwlmzC1zeS7s1Tg\nQW1FQuVDV8tWa4PMTrQHwfaGqn95AKc+tbg+ubpCiWl5bBNI3Ghuh4sAC9dMdAkd\nw27i29O9/Y3XJSSGUZlZqDBP4YU388RgHpzLDUxgRcaQt9vdeEz6frULPW67e9D2\nmPPDzjECgYEA4aPOwvnSwGoOKsS6vANGy4Ajsq09PR+1ltMJUR5kDlXGuZWI72eX\n3/GAnovDuCp0tbYt0r7Fmkfel0Ore7SYM18TH5QGpPddcZLvKUf7AchCIOYY0Te3\npS9+7S1lEGrLXyuox4N26Ov6wHVrmZTcQoZsDWbjYxNNsNACsiQNjGMCgYEA3SvQ\nJets9e9SgNVvao2TijX+/vcNKRfcWB71T9Xc4BuSNEu5+ZLtptlwaSnVCVu1Xilk\nsWDh+3EhByl4EteENPvE/7A2s1sfcDOprvg0r52aBZKeTp0AukrT8+Ad4hap7g1x\n2Lz11MFDkhRqt2KqQaIL+5Mq5WfptbBJ0YI7ARUCgYAD6iSfK1hlsDFYupsGwgPL\nagi0g97pHZC38idaOe3AdeqBs79xb9mpr/XsSj52Bn6J3IRFALxK5e5Nr4XdGo/9\nbCvXw2iuGgCMBOGTVMVdDY1gJr3Ne2r7Oay5Dq2PMFsg5pACDhzVA6sRBbh9LKD5\non1jaiKNyHrzk1hIoOl/QwKBgA+Ov2uLbfS2yvTpDpdOMiyss603r6NOXF+Ofe8J\nuinBhr1K/mAB59muveuH18Z6vv1KqByaFgtb39jjH+Eja9dWRns95/sh08pOuAbo\nyrv3uBfgQmaBQMXZ8aLcBv4aXgWyyGlYkWpP1fL2oLMZq6RGQ9WEeqX8c0ImjmrA\nYGopAoGBAJZPFlZi2Rfq4MfFZp/X1/zM09hphZwkxkSI+RnsjDUjTgB8CuQul5ep\nKWE98yLw4C25Cqw5fKKQ2addizLnZCAIfJKVNRjYLWlWyGQydDEUzqwXlSLS9LVX\nLxLkWDajIyjeFn21Ttb42L9pBo3TAQIxUenom/lP2SQTvCKBiPai\n-----END RSA PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUahce2sCO7Bom/Rznd5HsNAlr1NgwDQYJKoZIhvcNAQEL\nBQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\nGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODEyMDIwMTAxNDRaFw00NjEy\nMTUwMTAxNDRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\nHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQDC8Qd4kJecWCLzysTV1NfoUd0E8rTBKN52HTLBWcJn\nEtZsG//k/K2NNwI92t9buDax9s/A6B79YXdfYp5hI/xLFkDRzObPpAOyl4b3bUmR\nla3Knmj743SV4tMhQCGrff2nc7WicA5Q7WTiwd+YLB+sOlOfaFzHhRFrk/PNvV8e\nKC6yMgfWZwZ2dxoDpnYLM7XDgTyQ85S6QgOtxlPh9o5mtZQhBkpDDYnNPIon5kwM\nJmrZMXNbCkvd4bjzAHsnuaJsVD/2cW/Gkh+UGMMBnxCKqTBivk3QM2xPFx9MJJ65\nt8kMJR8hbAVmEuK3PA7FrNrNRApdf9I8xDWX8v2jeecfAgMBAAGjUzBRMB0GA1Ud\nDgQWBBQXGfrns8OqxTGKsXG5pDZS/WyyYDAfBgNVHSMEGDAWgBQXGfrns8OqxTGK\nsXG5pDZS/WyyYDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCt\n8aUX26cl2PgdIEByZSHAX5G+2b0IEtTclPkl4uDyyKRY4dVq6gK3ueVSU5eUmBip\nJbV5aRetovGOcV//8vbxkZm/ntQ8Oo+2sfGR5lIzd0UdlOr5pkD6g3bFy/zJ+4DR\nDAe8fklUacfz6CFmD+H8GyHm+fKmF+mjr4oOGQW6OegRDJHuiipUk2lJyuXdlPSa\nFpNRO2sGbjn000ANinFgnFiVzGDnx0/G1Kii/6GWrI6rrdVmXioQzF+8AloWckeB\n+hbmbwkwQa/JrLb5SWcBDOXSgtn1Li3XF5AQQBBjA3pOlyBXqnI94Irw89Lv9uPT\nMUR4qFxeUOW/GJGccMUd\n-----END CERTIFICATE-----\n\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n intermediateVaultMount,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := pkisecret.NewSecretBackendConfigCa(ctx, \"intermediate\", \u0026pkisecret.SecretBackendConfigCaArgs{\n\t\t\tBackend: pulumi.Any(intermediateVaultMount.Path),\n\t\t\tPemBundle: pulumi.String(`-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAwvEHeJCXnFgi88rE1dTX6FHdBPK0wSjedh0ywVnCZxLWbBv/\n5PytjTcCPdrfW7g2sfbPwOge/WF3X2KeYSP8SxZA0czmz6QDspeG921JkZWtyp5o\n++N0leLTIUAhq339p3O1onAOUO1k4sHfmCwfrDpTn2hcx4URa5Pzzb1fHigusjIH\n1mcGdncaA6Z2CzO1w4E8kPOUukIDrcZT4faOZrWUIQZKQw2JzTyKJ+ZMDCZq2TFz\nWwpL3eG48wB7J7mibFQ/9nFvxpIflBjDAZ8QiqkwYr5N0DNsTxcfTCSeubfJDCUf\nIWwFZhLitzwOxazazUQKXX/SPMQ1l/L9o3nnHwIDAQABAoIBAAQidJQcDPsl62fc\nTxxx7TpiMhvewfKu2TkMGX18V+EzxxR364+BxHSQTB3fvIkHeTGBGJrw0WdyX8PI\nJa/NwZYeHLXWcLbKtcFd8WDiEoNh91Oq1HMzOc/MBcpYv94RSAX7MEkHs2YIAvHE\nRufFV86hVhC1d/JLYjkz5CHi+Fd9XTYjBK78tHhJd4IJPu5LYvwlmzC1zeS7s1Tg\nQW1FQuVDV8tWa4PMTrQHwfaGqn95AKc+tbg+ubpCiWl5bBNI3Ghuh4sAC9dMdAkd\nw27i29O9/Y3XJSSGUZlZqDBP4YU388RgHpzLDUxgRcaQt9vdeEz6frULPW67e9D2\nmPPDzjECgYEA4aPOwvnSwGoOKsS6vANGy4Ajsq09PR+1ltMJUR5kDlXGuZWI72eX\n3/GAnovDuCp0tbYt0r7Fmkfel0Ore7SYM18TH5QGpPddcZLvKUf7AchCIOYY0Te3\npS9+7S1lEGrLXyuox4N26Ov6wHVrmZTcQoZsDWbjYxNNsNACsiQNjGMCgYEA3SvQ\nJets9e9SgNVvao2TijX+/vcNKRfcWB71T9Xc4BuSNEu5+ZLtptlwaSnVCVu1Xilk\nsWDh+3EhByl4EteENPvE/7A2s1sfcDOprvg0r52aBZKeTp0AukrT8+Ad4hap7g1x\n2Lz11MFDkhRqt2KqQaIL+5Mq5WfptbBJ0YI7ARUCgYAD6iSfK1hlsDFYupsGwgPL\nagi0g97pHZC38idaOe3AdeqBs79xb9mpr/XsSj52Bn6J3IRFALxK5e5Nr4XdGo/9\nbCvXw2iuGgCMBOGTVMVdDY1gJr3Ne2r7Oay5Dq2PMFsg5pACDhzVA6sRBbh9LKD5\non1jaiKNyHrzk1hIoOl/QwKBgA+Ov2uLbfS2yvTpDpdOMiyss603r6NOXF+Ofe8J\nuinBhr1K/mAB59muveuH18Z6vv1KqByaFgtb39jjH+Eja9dWRns95/sh08pOuAbo\nyrv3uBfgQmaBQMXZ8aLcBv4aXgWyyGlYkWpP1fL2oLMZq6RGQ9WEeqX8c0ImjmrA\nYGopAoGBAJZPFlZi2Rfq4MfFZp/X1/zM09hphZwkxkSI+RnsjDUjTgB8CuQul5ep\nKWE98yLw4C25Cqw5fKKQ2addizLnZCAIfJKVNRjYLWlWyGQydDEUzqwXlSLS9LVX\nLxLkWDajIyjeFn21Ttb42L9pBo3TAQIxUenom/lP2SQTvCKBiPai\n-----END RSA PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUahce2sCO7Bom/Rznd5HsNAlr1NgwDQYJKoZIhvcNAQEL\nBQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\nGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODEyMDIwMTAxNDRaFw00NjEy\nMTUwMTAxNDRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\nHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQDC8Qd4kJecWCLzysTV1NfoUd0E8rTBKN52HTLBWcJn\nEtZsG//k/K2NNwI92t9buDax9s/A6B79YXdfYp5hI/xLFkDRzObPpAOyl4b3bUmR\nla3Knmj743SV4tMhQCGrff2nc7WicA5Q7WTiwd+YLB+sOlOfaFzHhRFrk/PNvV8e\nKC6yMgfWZwZ2dxoDpnYLM7XDgTyQ85S6QgOtxlPh9o5mtZQhBkpDDYnNPIon5kwM\nJmrZMXNbCkvd4bjzAHsnuaJsVD/2cW/Gkh+UGMMBnxCKqTBivk3QM2xPFx9MJJ65\nt8kMJR8hbAVmEuK3PA7FrNrNRApdf9I8xDWX8v2jeecfAgMBAAGjUzBRMB0GA1Ud\nDgQWBBQXGfrns8OqxTGKsXG5pDZS/WyyYDAfBgNVHSMEGDAWgBQXGfrns8OqxTGK\nsXG5pDZS/WyyYDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCt\n8aUX26cl2PgdIEByZSHAX5G+2b0IEtTclPkl4uDyyKRY4dVq6gK3ueVSU5eUmBip\nJbV5aRetovGOcV//8vbxkZm/ntQ8Oo+2sfGR5lIzd0UdlOr5pkD6g3bFy/zJ+4DR\nDAe8fklUacfz6CFmD+H8GyHm+fKmF+mjr4oOGQW6OegRDJHuiipUk2lJyuXdlPSa\nFpNRO2sGbjn000ANinFgnFiVzGDnx0/G1Kii/6GWrI6rrdVmXioQzF+8AloWckeB\n+hbmbwkwQa/JrLb5SWcBDOXSgtn1Li3XF5AQQBBjA3pOlyBXqnI94Irw89Lv9uPT\nMUR4qFxeUOW/GJGccMUd\n-----END CERTIFICATE-----\n`),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tintermediateVaultMount,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pkisecret_secretbackendconfigca\" \"intermediate\" {\n depends_on = [intermediateVaultMount]\n backend = intermediateVaultMount.path\n pem_bundle = \"-----BEGIN RSA PRIVATE KEY-----\\nMIIEowIBAAKCAQEAwvEHeJCXnFgi88rE1dTX6FHdBPK0wSjedh0ywVnCZxLWbBv/\\n5PytjTcCPdrfW7g2sfbPwOge/WF3X2KeYSP8SxZA0czmz6QDspeG921JkZWtyp5o\\n++N0leLTIUAhq339p3O1onAOUO1k4sHfmCwfrDpTn2hcx4URa5Pzzb1fHigusjIH\\n1mcGdncaA6Z2CzO1w4E8kPOUukIDrcZT4faOZrWUIQZKQw2JzTyKJ+ZMDCZq2TFz\\nWwpL3eG48wB7J7mibFQ/9nFvxpIflBjDAZ8QiqkwYr5N0DNsTxcfTCSeubfJDCUf\\nIWwFZhLitzwOxazazUQKXX/SPMQ1l/L9o3nnHwIDAQABAoIBAAQidJQcDPsl62fc\\nTxxx7TpiMhvewfKu2TkMGX18V+EzxxR364+BxHSQTB3fvIkHeTGBGJrw0WdyX8PI\\nJa/NwZYeHLXWcLbKtcFd8WDiEoNh91Oq1HMzOc/MBcpYv94RSAX7MEkHs2YIAvHE\\nRufFV86hVhC1d/JLYjkz5CHi+Fd9XTYjBK78tHhJd4IJPu5LYvwlmzC1zeS7s1Tg\\nQW1FQuVDV8tWa4PMTrQHwfaGqn95AKc+tbg+ubpCiWl5bBNI3Ghuh4sAC9dMdAkd\\nw27i29O9/Y3XJSSGUZlZqDBP4YU388RgHpzLDUxgRcaQt9vdeEz6frULPW67e9D2\\nmPPDzjECgYEA4aPOwvnSwGoOKsS6vANGy4Ajsq09PR+1ltMJUR5kDlXGuZWI72eX\\n3/GAnovDuCp0tbYt0r7Fmkfel0Ore7SYM18TH5QGpPddcZLvKUf7AchCIOYY0Te3\\npS9+7S1lEGrLXyuox4N26Ov6wHVrmZTcQoZsDWbjYxNNsNACsiQNjGMCgYEA3SvQ\\nJets9e9SgNVvao2TijX+/vcNKRfcWB71T9Xc4BuSNEu5+ZLtptlwaSnVCVu1Xilk\\nsWDh+3EhByl4EteENPvE/7A2s1sfcDOprvg0r52aBZKeTp0AukrT8+Ad4hap7g1x\\n2Lz11MFDkhRqt2KqQaIL+5Mq5WfptbBJ0YI7ARUCgYAD6iSfK1hlsDFYupsGwgPL\\nagi0g97pHZC38idaOe3AdeqBs79xb9mpr/XsSj52Bn6J3IRFALxK5e5Nr4XdGo/9\\nbCvXw2iuGgCMBOGTVMVdDY1gJr3Ne2r7Oay5Dq2PMFsg5pACDhzVA6sRBbh9LKD5\\non1jaiKNyHrzk1hIoOl/QwKBgA+Ov2uLbfS2yvTpDpdOMiyss603r6NOXF+Ofe8J\\nuinBhr1K/mAB59muveuH18Z6vv1KqByaFgtb39jjH+Eja9dWRns95/sh08pOuAbo\\nyrv3uBfgQmaBQMXZ8aLcBv4aXgWyyGlYkWpP1fL2oLMZq6RGQ9WEeqX8c0ImjmrA\\nYGopAoGBAJZPFlZi2Rfq4MfFZp/X1/zM09hphZwkxkSI+RnsjDUjTgB8CuQul5ep\\nKWE98yLw4C25Cqw5fKKQ2addizLnZCAIfJKVNRjYLWlWyGQydDEUzqwXlSLS9LVX\\nLxLkWDajIyjeFn21Ttb42L9pBo3TAQIxUenom/lP2SQTvCKBiPai\\n-----END RSA PRIVATE KEY-----\\n-----BEGIN CERTIFICATE-----\\nMIIDazCCAlOgAwIBAgIUahce2sCO7Bom/Rznd5HsNAlr1NgwDQYJKoZIhvcNAQEL\\nBQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\\nGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODEyMDIwMTAxNDRaFw00NjEy\\nMTUwMTAxNDRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\\nHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB\\nAQUAA4IBDwAwggEKAoIBAQDC8Qd4kJecWCLzysTV1NfoUd0E8rTBKN52HTLBWcJn\\nEtZsG//k/K2NNwI92t9buDax9s/A6B79YXdfYp5hI/xLFkDRzObPpAOyl4b3bUmR\\nla3Knmj743SV4tMhQCGrff2nc7WicA5Q7WTiwd+YLB+sOlOfaFzHhRFrk/PNvV8e\\nKC6yMgfWZwZ2dxoDpnYLM7XDgTyQ85S6QgOtxlPh9o5mtZQhBkpDDYnNPIon5kwM\\nJmrZMXNbCkvd4bjzAHsnuaJsVD/2cW/Gkh+UGMMBnxCKqTBivk3QM2xPFx9MJJ65\\nt8kMJR8hbAVmEuK3PA7FrNrNRApdf9I8xDWX8v2jeecfAgMBAAGjUzBRMB0GA1Ud\\nDgQWBBQXGfrns8OqxTGKsXG5pDZS/WyyYDAfBgNVHSMEGDAWgBQXGfrns8OqxTGK\\nsXG5pDZS/WyyYDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCt\\n8aUX26cl2PgdIEByZSHAX5G+2b0IEtTclPkl4uDyyKRY4dVq6gK3ueVSU5eUmBip\\nJbV5aRetovGOcV//8vbxkZm/ntQ8Oo+2sfGR5lIzd0UdlOr5pkD6g3bFy/zJ+4DR\\nDAe8fklUacfz6CFmD+H8GyHm+fKmF+mjr4oOGQW6OegRDJHuiipUk2lJyuXdlPSa\\nFpNRO2sGbjn000ANinFgnFiVzGDnx0/G1Kii/6GWrI6rrdVmXioQzF+8AloWckeB\\n+hbmbwkwQa/JrLb5SWcBDOXSgtn1Li3XF5AQQBBjA3pOlyBXqnI94Irw89Lv9uPT\\nMUR4qFxeUOW/GJGccMUd\\n-----END CERTIFICATE-----\\n\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.pkiSecret.SecretBackendConfigCa;\nimport com.pulumi.vault.pkiSecret.SecretBackendConfigCaArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var intermediate = new SecretBackendConfigCa(\"intermediate\", SecretBackendConfigCaArgs.builder()\n .backend(intermediateVaultMount.path())\n .pemBundle(\"\"\"\n-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAwvEHeJCXnFgi88rE1dTX6FHdBPK0wSjedh0ywVnCZxLWbBv/\n5PytjTcCPdrfW7g2sfbPwOge/WF3X2KeYSP8SxZA0czmz6QDspeG921JkZWtyp5o\n++N0leLTIUAhq339p3O1onAOUO1k4sHfmCwfrDpTn2hcx4URa5Pzzb1fHigusjIH\n1mcGdncaA6Z2CzO1w4E8kPOUukIDrcZT4faOZrWUIQZKQw2JzTyKJ+ZMDCZq2TFz\nWwpL3eG48wB7J7mibFQ/9nFvxpIflBjDAZ8QiqkwYr5N0DNsTxcfTCSeubfJDCUf\nIWwFZhLitzwOxazazUQKXX/SPMQ1l/L9o3nnHwIDAQABAoIBAAQidJQcDPsl62fc\nTxxx7TpiMhvewfKu2TkMGX18V+EzxxR364+BxHSQTB3fvIkHeTGBGJrw0WdyX8PI\nJa/NwZYeHLXWcLbKtcFd8WDiEoNh91Oq1HMzOc/MBcpYv94RSAX7MEkHs2YIAvHE\nRufFV86hVhC1d/JLYjkz5CHi+Fd9XTYjBK78tHhJd4IJPu5LYvwlmzC1zeS7s1Tg\nQW1FQuVDV8tWa4PMTrQHwfaGqn95AKc+tbg+ubpCiWl5bBNI3Ghuh4sAC9dMdAkd\nw27i29O9/Y3XJSSGUZlZqDBP4YU388RgHpzLDUxgRcaQt9vdeEz6frULPW67e9D2\nmPPDzjECgYEA4aPOwvnSwGoOKsS6vANGy4Ajsq09PR+1ltMJUR5kDlXGuZWI72eX\n3/GAnovDuCp0tbYt0r7Fmkfel0Ore7SYM18TH5QGpPddcZLvKUf7AchCIOYY0Te3\npS9+7S1lEGrLXyuox4N26Ov6wHVrmZTcQoZsDWbjYxNNsNACsiQNjGMCgYEA3SvQ\nJets9e9SgNVvao2TijX+/vcNKRfcWB71T9Xc4BuSNEu5+ZLtptlwaSnVCVu1Xilk\nsWDh+3EhByl4EteENPvE/7A2s1sfcDOprvg0r52aBZKeTp0AukrT8+Ad4hap7g1x\n2Lz11MFDkhRqt2KqQaIL+5Mq5WfptbBJ0YI7ARUCgYAD6iSfK1hlsDFYupsGwgPL\nagi0g97pHZC38idaOe3AdeqBs79xb9mpr/XsSj52Bn6J3IRFALxK5e5Nr4XdGo/9\nbCvXw2iuGgCMBOGTVMVdDY1gJr3Ne2r7Oay5Dq2PMFsg5pACDhzVA6sRBbh9LKD5\non1jaiKNyHrzk1hIoOl/QwKBgA+Ov2uLbfS2yvTpDpdOMiyss603r6NOXF+Ofe8J\nuinBhr1K/mAB59muveuH18Z6vv1KqByaFgtb39jjH+Eja9dWRns95/sh08pOuAbo\nyrv3uBfgQmaBQMXZ8aLcBv4aXgWyyGlYkWpP1fL2oLMZq6RGQ9WEeqX8c0ImjmrA\nYGopAoGBAJZPFlZi2Rfq4MfFZp/X1/zM09hphZwkxkSI+RnsjDUjTgB8CuQul5ep\nKWE98yLw4C25Cqw5fKKQ2addizLnZCAIfJKVNRjYLWlWyGQydDEUzqwXlSLS9LVX\nLxLkWDajIyjeFn21Ttb42L9pBo3TAQIxUenom/lP2SQTvCKBiPai\n-----END RSA PRIVATE KEY-----\n-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUahce2sCO7Bom/Rznd5HsNAlr1NgwDQYJKoZIhvcNAQEL\nBQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\nGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODEyMDIwMTAxNDRaFw00NjEy\nMTUwMTAxNDRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\nHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQDC8Qd4kJecWCLzysTV1NfoUd0E8rTBKN52HTLBWcJn\nEtZsG//k/K2NNwI92t9buDax9s/A6B79YXdfYp5hI/xLFkDRzObPpAOyl4b3bUmR\nla3Knmj743SV4tMhQCGrff2nc7WicA5Q7WTiwd+YLB+sOlOfaFzHhRFrk/PNvV8e\nKC6yMgfWZwZ2dxoDpnYLM7XDgTyQ85S6QgOtxlPh9o5mtZQhBkpDDYnNPIon5kwM\nJmrZMXNbCkvd4bjzAHsnuaJsVD/2cW/Gkh+UGMMBnxCKqTBivk3QM2xPFx9MJJ65\nt8kMJR8hbAVmEuK3PA7FrNrNRApdf9I8xDWX8v2jeecfAgMBAAGjUzBRMB0GA1Ud\nDgQWBBQXGfrns8OqxTGKsXG5pDZS/WyyYDAfBgNVHSMEGDAWgBQXGfrns8OqxTGK\nsXG5pDZS/WyyYDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCt\n8aUX26cl2PgdIEByZSHAX5G+2b0IEtTclPkl4uDyyKRY4dVq6gK3ueVSU5eUmBip\nJbV5aRetovGOcV//8vbxkZm/ntQ8Oo+2sfGR5lIzd0UdlOr5pkD6g3bFy/zJ+4DR\nDAe8fklUacfz6CFmD+H8GyHm+fKmF+mjr4oOGQW6OegRDJHuiipUk2lJyuXdlPSa\nFpNRO2sGbjn000ANinFgnFiVzGDnx0/G1Kii/6GWrI6rrdVmXioQzF+8AloWckeB\n+hbmbwkwQa/JrLb5SWcBDOXSgtn1Li3XF5AQQBBjA3pOlyBXqnI94Irw89Lv9uPT\nMUR4qFxeUOW/GJGccMUd\n-----END CERTIFICATE-----\n \"\"\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(intermediateVaultMount)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n intermediate:\n type: vault:pkiSecret:SecretBackendConfigCa\n properties:\n backend: ${intermediateVaultMount.path}\n pemBundle: |\n -----BEGIN RSA PRIVATE KEY-----\n MIIEowIBAAKCAQEAwvEHeJCXnFgi88rE1dTX6FHdBPK0wSjedh0ywVnCZxLWbBv/\n 5PytjTcCPdrfW7g2sfbPwOge/WF3X2KeYSP8SxZA0czmz6QDspeG921JkZWtyp5o\n ++N0leLTIUAhq339p3O1onAOUO1k4sHfmCwfrDpTn2hcx4URa5Pzzb1fHigusjIH\n 1mcGdncaA6Z2CzO1w4E8kPOUukIDrcZT4faOZrWUIQZKQw2JzTyKJ+ZMDCZq2TFz\n WwpL3eG48wB7J7mibFQ/9nFvxpIflBjDAZ8QiqkwYr5N0DNsTxcfTCSeubfJDCUf\n IWwFZhLitzwOxazazUQKXX/SPMQ1l/L9o3nnHwIDAQABAoIBAAQidJQcDPsl62fc\n Txxx7TpiMhvewfKu2TkMGX18V+EzxxR364+BxHSQTB3fvIkHeTGBGJrw0WdyX8PI\n Ja/NwZYeHLXWcLbKtcFd8WDiEoNh91Oq1HMzOc/MBcpYv94RSAX7MEkHs2YIAvHE\n RufFV86hVhC1d/JLYjkz5CHi+Fd9XTYjBK78tHhJd4IJPu5LYvwlmzC1zeS7s1Tg\n QW1FQuVDV8tWa4PMTrQHwfaGqn95AKc+tbg+ubpCiWl5bBNI3Ghuh4sAC9dMdAkd\n w27i29O9/Y3XJSSGUZlZqDBP4YU388RgHpzLDUxgRcaQt9vdeEz6frULPW67e9D2\n mPPDzjECgYEA4aPOwvnSwGoOKsS6vANGy4Ajsq09PR+1ltMJUR5kDlXGuZWI72eX\n 3/GAnovDuCp0tbYt0r7Fmkfel0Ore7SYM18TH5QGpPddcZLvKUf7AchCIOYY0Te3\n pS9+7S1lEGrLXyuox4N26Ov6wHVrmZTcQoZsDWbjYxNNsNACsiQNjGMCgYEA3SvQ\n Jets9e9SgNVvao2TijX+/vcNKRfcWB71T9Xc4BuSNEu5+ZLtptlwaSnVCVu1Xilk\n sWDh+3EhByl4EteENPvE/7A2s1sfcDOprvg0r52aBZKeTp0AukrT8+Ad4hap7g1x\n 2Lz11MFDkhRqt2KqQaIL+5Mq5WfptbBJ0YI7ARUCgYAD6iSfK1hlsDFYupsGwgPL\n agi0g97pHZC38idaOe3AdeqBs79xb9mpr/XsSj52Bn6J3IRFALxK5e5Nr4XdGo/9\n bCvXw2iuGgCMBOGTVMVdDY1gJr3Ne2r7Oay5Dq2PMFsg5pACDhzVA6sRBbh9LKD5\n on1jaiKNyHrzk1hIoOl/QwKBgA+Ov2uLbfS2yvTpDpdOMiyss603r6NOXF+Ofe8J\n uinBhr1K/mAB59muveuH18Z6vv1KqByaFgtb39jjH+Eja9dWRns95/sh08pOuAbo\n yrv3uBfgQmaBQMXZ8aLcBv4aXgWyyGlYkWpP1fL2oLMZq6RGQ9WEeqX8c0ImjmrA\n YGopAoGBAJZPFlZi2Rfq4MfFZp/X1/zM09hphZwkxkSI+RnsjDUjTgB8CuQul5ep\n KWE98yLw4C25Cqw5fKKQ2addizLnZCAIfJKVNRjYLWlWyGQydDEUzqwXlSLS9LVX\n LxLkWDajIyjeFn21Ttb42L9pBo3TAQIxUenom/lP2SQTvCKBiPai\n -----END RSA PRIVATE KEY-----\n -----BEGIN CERTIFICATE-----\n MIIDazCCAlOgAwIBAgIUahce2sCO7Bom/Rznd5HsNAlr1NgwDQYJKoZIhvcNAQEL\n BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\n GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODEyMDIwMTAxNDRaFw00NjEy\n MTUwMTAxNDRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\n HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB\n AQUAA4IBDwAwggEKAoIBAQDC8Qd4kJecWCLzysTV1NfoUd0E8rTBKN52HTLBWcJn\n EtZsG//k/K2NNwI92t9buDax9s/A6B79YXdfYp5hI/xLFkDRzObPpAOyl4b3bUmR\n la3Knmj743SV4tMhQCGrff2nc7WicA5Q7WTiwd+YLB+sOlOfaFzHhRFrk/PNvV8e\n KC6yMgfWZwZ2dxoDpnYLM7XDgTyQ85S6QgOtxlPh9o5mtZQhBkpDDYnNPIon5kwM\n JmrZMXNbCkvd4bjzAHsnuaJsVD/2cW/Gkh+UGMMBnxCKqTBivk3QM2xPFx9MJJ65\n t8kMJR8hbAVmEuK3PA7FrNrNRApdf9I8xDWX8v2jeecfAgMBAAGjUzBRMB0GA1Ud\n DgQWBBQXGfrns8OqxTGKsXG5pDZS/WyyYDAfBgNVHSMEGDAWgBQXGfrns8OqxTGK\n sXG5pDZS/WyyYDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCt\n 8aUX26cl2PgdIEByZSHAX5G+2b0IEtTclPkl4uDyyKRY4dVq6gK3ueVSU5eUmBip\n JbV5aRetovGOcV//8vbxkZm/ntQ8Oo+2sfGR5lIzd0UdlOr5pkD6g3bFy/zJ+4DR\n DAe8fklUacfz6CFmD+H8GyHm+fKmF+mjr4oOGQW6OegRDJHuiipUk2lJyuXdlPSa\n FpNRO2sGbjn000ANinFgnFiVzGDnx0/G1Kii/6GWrI6rrdVmXioQzF+8AloWckeB\n +hbmbwkwQa/JrLb5SWcBDOXSgtn1Li3XF5AQQBBjA3pOlyBXqnI94Irw89Lv9uPT\n MUR4qFxeUOW/GJGccMUd\n -----END CERTIFICATE-----\n options:\n dependsOn:\n - ${intermediateVaultMount}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "pemBundle": { "type": "string", "description": "The key and certificate PEM bundle\n", "secret": true } }, "required": [ "backend", "pemBundle" ], "inputProperties": { "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "pemBundle": { "type": "string", "description": "The key and certificate PEM bundle\n", "secret": true, "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "pemBundle" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendConfigCa resources.\n", "properties": { "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "pemBundle": { "type": "string", "description": "The key and certificate PEM bundle\n", "secret": true, "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/secretBackendConfigIssuers:SecretBackendConfigIssuers": { "description": "Allows setting the value of the default issuer. For more information, see the\n[Vault documentation](https://developer.hashicorp.com/vault/api-docs/secret/pki#set-issuers-configuration)\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki\",\n type: \"pki\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 86400,\n});\nconst root = new vault.pkisecret.SecretBackendRootCert(\"root\", {\n backend: pki.path,\n type: \"internal\",\n commonName: \"test\",\n ttl: \"86400\",\n});\nconst example = new vault.pkisecret.SecretBackendIssuer(\"example\", {\n backend: root.backend,\n issuerRef: root.issuerId,\n issuerName: \"example-issuer\",\n});\nconst config = new vault.pkisecret.SecretBackendConfigIssuers(\"config\", {\n backend: pki.path,\n \"default\": example.issuerId,\n defaultFollowsLatestIssuer: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki = vault.Mount(\"pki\",\n path=\"pki\",\n type=\"pki\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=86400)\nroot = vault.pkisecret.SecretBackendRootCert(\"root\",\n backend=pki.path,\n type=\"internal\",\n common_name=\"test\",\n ttl=\"86400\")\nexample = vault.pkisecret.SecretBackendIssuer(\"example\",\n backend=root.backend,\n issuer_ref=root.issuer_id,\n issuer_name=\"example-issuer\")\nconfig = vault.pkisecret.SecretBackendConfigIssuers(\"config\",\n backend=pki.path,\n default=example.issuer_id,\n default_follows_latest_issuer=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki\",\n Type = \"pki\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 86400,\n });\n\n var root = new Vault.PkiSecret.SecretBackendRootCert(\"root\", new()\n {\n Backend = pki.Path,\n Type = \"internal\",\n CommonName = \"test\",\n Ttl = \"86400\",\n });\n\n var example = new Vault.PkiSecret.SecretBackendIssuer(\"example\", new()\n {\n Backend = root.Backend,\n IssuerRef = root.IssuerId,\n IssuerName = \"example-issuer\",\n });\n\n var config = new Vault.PkiSecret.SecretBackendConfigIssuers(\"config\", new()\n {\n Backend = pki.Path,\n Default = example.IssuerId,\n DefaultFollowsLatestIssuer = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\troot, err := pkisecret.NewSecretBackendRootCert(ctx, \"root\", \u0026pkisecret.SecretBackendRootCertArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tCommonName: pulumi.String(\"test\"),\n\t\t\tTtl: pulumi.String(\"86400\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texample, err := pkisecret.NewSecretBackendIssuer(ctx, \"example\", \u0026pkisecret.SecretBackendIssuerArgs{\n\t\t\tBackend: root.Backend,\n\t\t\tIssuerRef: root.IssuerId,\n\t\t\tIssuerName: pulumi.String(\"example-issuer\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewSecretBackendConfigIssuers(ctx, \"config\", \u0026pkisecret.SecretBackendConfigIssuersArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tDefault: example.IssuerId,\n\t\t\tDefaultFollowsLatestIssuer: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_secretbackendrootcert\" \"root\" {\n backend = vault_mount.pki.path\n type = \"internal\"\n common_name = \"test\"\n ttl = \"86400\"\n}\nresource \"vault_pkisecret_secretbackendissuer\" \"example\" {\n backend = vault_pkisecret_secretbackendrootcert.root.backend\n issuer_ref = vault_pkisecret_secretbackendrootcert.root.issuer_id\n issuer_name = \"example-issuer\"\n}\nresource \"vault_pkisecret_secretbackendconfigissuers\" \"config\" {\n backend = vault_mount.pki.path\n default = vault_pkisecret_secretbackendissuer.example.issuer_id\n default_follows_latest_issuer = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootCert;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootCertArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendIssuer;\nimport com.pulumi.vault.pkiSecret.SecretBackendIssuerArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendConfigIssuers;\nimport com.pulumi.vault.pkiSecret.SecretBackendConfigIssuersArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki\")\n .type(\"pki\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(86400)\n .build());\n\n var root = new SecretBackendRootCert(\"root\", SecretBackendRootCertArgs.builder()\n .backend(pki.path())\n .type(\"internal\")\n .commonName(\"test\")\n .ttl(\"86400\")\n .build());\n\n var example = new SecretBackendIssuer(\"example\", SecretBackendIssuerArgs.builder()\n .backend(root.backend())\n .issuerRef(root.issuerId())\n .issuerName(\"example-issuer\")\n .build());\n\n var config = new SecretBackendConfigIssuers(\"config\", SecretBackendConfigIssuersArgs.builder()\n .backend(pki.path())\n .default_(example.issuerId())\n .defaultFollowsLatestIssuer(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n root:\n type: vault:pkiSecret:SecretBackendRootCert\n properties:\n backend: ${pki.path}\n type: internal\n commonName: test\n ttl: '86400'\n example:\n type: vault:pkiSecret:SecretBackendIssuer\n properties:\n backend: ${root.backend}\n issuerRef: ${root.issuerId}\n issuerName: example-issuer\n config:\n type: vault:pkiSecret:SecretBackendConfigIssuers\n properties:\n backend: ${pki.path}\n default: ${example.issuerId}\n defaultFollowsLatestIssuer: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPKI secret backend config issuers can be imported using the path, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/secretBackendConfigIssuers:SecretBackendConfigIssuers config pki/config/issuers\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no\nleading or trailing `/`s.\n" }, "default": { "type": "string", "description": "Specifies the default issuer using the issuer ID.\n**NOTE:** It is recommended to only set the default issuer using the ID.\nWhile Vault does allow passing in the issuer name, this can lead to possible drifts in the Terraform state.\n" }, "defaultFollowsLatestIssuer": { "type": "boolean", "description": "Specifies whether a root creation\nor an issuer import operation updates the default issuer to the newly added issuer.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "backend", "defaultFollowsLatestIssuer" ], "inputProperties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no\nleading or trailing `/`s.\n" }, "default": { "type": "string", "description": "Specifies the default issuer using the issuer ID.\n**NOTE:** It is recommended to only set the default issuer using the ID.\nWhile Vault does allow passing in the issuer name, this can lead to possible drifts in the Terraform state.\n" }, "defaultFollowsLatestIssuer": { "type": "boolean", "description": "Specifies whether a root creation\nor an issuer import operation updates the default issuer to the newly added issuer.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendConfigIssuers resources.\n", "properties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no\nleading or trailing `/`s.\n" }, "default": { "type": "string", "description": "Specifies the default issuer using the issuer ID.\n**NOTE:** It is recommended to only set the default issuer using the ID.\nWhile Vault does allow passing in the issuer name, this can lead to possible drifts in the Terraform state.\n" }, "defaultFollowsLatestIssuer": { "type": "boolean", "description": "Specifies whether a root creation\nor an issuer import operation updates the default issuer to the newly added issuer.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/secretBackendConfigUrls:SecretBackendConfigUrls": { "description": "Allows setting the issuing certificate endpoints, CRL distribution points, and OCSP server endpoints that will be encoded into issued certificates.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst root = new vault.Mount(\"root\", {\n path: \"pki-root\",\n type: \"pki\",\n description: \"root PKI\",\n defaultLeaseTtlSeconds: 8640000,\n maxLeaseTtlSeconds: 8640000,\n});\nconst example = new vault.pkisecret.SecretBackendConfigUrls(\"example\", {\n backend: root.path,\n issuingCertificates: [\"http://127.0.0.1:8200/v1/pki/ca\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nroot = vault.Mount(\"root\",\n path=\"pki-root\",\n type=\"pki\",\n description=\"root PKI\",\n default_lease_ttl_seconds=8640000,\n max_lease_ttl_seconds=8640000)\nexample = vault.pkisecret.SecretBackendConfigUrls(\"example\",\n backend=root.path,\n issuing_certificates=[\"http://127.0.0.1:8200/v1/pki/ca\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var root = new Vault.Mount(\"root\", new()\n {\n Path = \"pki-root\",\n Type = \"pki\",\n Description = \"root PKI\",\n DefaultLeaseTtlSeconds = 8640000,\n MaxLeaseTtlSeconds = 8640000,\n });\n\n var example = new Vault.PkiSecret.SecretBackendConfigUrls(\"example\", new()\n {\n Backend = root.Path,\n IssuingCertificates = new[]\n {\n \"http://127.0.0.1:8200/v1/pki/ca\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\troot, err := vault.NewMount(ctx, \"root\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-root\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"root PKI\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(8640000),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(8640000),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewSecretBackendConfigUrls(ctx, \"example\", \u0026pkisecret.SecretBackendConfigUrlsArgs{\n\t\t\tBackend: root.Path,\n\t\t\tIssuingCertificates: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"http://127.0.0.1:8200/v1/pki/ca\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"root\" {\n path = \"pki-root\"\n type = \"pki\"\n description = \"root PKI\"\n default_lease_ttl_seconds = 8640000\n max_lease_ttl_seconds = 8640000\n}\nresource \"vault_pkisecret_secretbackendconfigurls\" \"example\" {\n backend = vault_mount.root.path\n issuing_certificates = [\"http://127.0.0.1:8200/v1/pki/ca\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendConfigUrls;\nimport com.pulumi.vault.pkiSecret.SecretBackendConfigUrlsArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var root = new Mount(\"root\", MountArgs.builder()\n .path(\"pki-root\")\n .type(\"pki\")\n .description(\"root PKI\")\n .defaultLeaseTtlSeconds(8640000)\n .maxLeaseTtlSeconds(8640000)\n .build());\n\n var example = new SecretBackendConfigUrls(\"example\", SecretBackendConfigUrlsArgs.builder()\n .backend(root.path())\n .issuingCertificates(\"http://127.0.0.1:8200/v1/pki/ca\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n root:\n type: vault:Mount\n properties:\n path: pki-root\n type: pki\n description: root PKI\n defaultLeaseTtlSeconds: 8.64e+06\n maxLeaseTtlSeconds: 8.64e+06\n example:\n type: vault:pkiSecret:SecretBackendConfigUrls\n properties:\n backend: ${root.path}\n issuingCertificates:\n - http://127.0.0.1:8200/v1/pki/ca\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nThe PKI config URLs can be imported using the resource's \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e. \nIn the case of the example above the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e would be `pki-root/config/urls`, \nwhere the `pki-root` component is the resource's \u003cspan pulumi-lang-nodejs=\"`backend`\" pulumi-lang-dotnet=\"`Backend`\" pulumi-lang-go=\"`backend`\" pulumi-lang-python=\"`backend`\" pulumi-lang-yaml=\"`backend`\" pulumi-lang-java=\"`backend`\" pulumi-lang-hcl=\"`backend`\"\u003e`backend`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/secretBackendConfigUrls:SecretBackendConfigUrls example pki-root/config/urls\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n" }, "crlDistributionPoints": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the CRL Distribution Points field.\n" }, "enableTemplating": { "type": "boolean", "description": "Specifies that templating of AIA fields is allowed.\n" }, "issuingCertificates": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the Issuing Certificate field.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "ocspServers": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the OCSP Servers field.\n" } }, "required": [ "backend" ], "inputProperties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n" }, "crlDistributionPoints": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the CRL Distribution Points field.\n" }, "enableTemplating": { "type": "boolean", "description": "Specifies that templating of AIA fields is allowed.\n" }, "issuingCertificates": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the Issuing Certificate field.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocspServers": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the OCSP Servers field.\n" } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendConfigUrls resources.\n", "properties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n" }, "crlDistributionPoints": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the CRL Distribution Points field.\n" }, "enableTemplating": { "type": "boolean", "description": "Specifies that templating of AIA fields is allowed.\n" }, "issuingCertificates": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the Issuing Certificate field.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocspServers": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the OCSP Servers field.\n" } }, "type": "object" } }, "vault:pkiSecret/secretBackendCrlConfig:SecretBackendCrlConfig": { "description": "Allows setting the duration for which the generated CRL should be marked valid. If the CRL is disabled, it will return a signed but zero-length CRL for any request. If enabled, it will re-build the CRL.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki = new vault.Mount(\"pki\", {\n path: \"%s\",\n type: \"pki\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 86400,\n});\nconst crlConfig = new vault.pkisecret.SecretBackendCrlConfig(\"crl_config\", {\n backend: pki.path,\n expiry: \"72h\",\n disable: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki = vault.Mount(\"pki\",\n path=\"%s\",\n type=\"pki\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=86400)\ncrl_config = vault.pkisecret.SecretBackendCrlConfig(\"crl_config\",\n backend=pki.path,\n expiry=\"72h\",\n disable=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"%s\",\n Type = \"pki\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 86400,\n });\n\n var crlConfig = new Vault.PkiSecret.SecretBackendCrlConfig(\"crl_config\", new()\n {\n Backend = pki.Path,\n Expiry = \"72h\",\n Disable = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"%s\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewSecretBackendCrlConfig(ctx, \"crl_config\", \u0026pkisecret.SecretBackendCrlConfigArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tExpiry: pulumi.String(\"72h\"),\n\t\t\tDisable: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"%s\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_secretbackendcrlconfig\" \"crl_config\" {\n backend = vault_mount.pki.path\n expiry = \"72h\"\n disable = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendCrlConfig;\nimport com.pulumi.vault.pkiSecret.SecretBackendCrlConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"%s\")\n .type(\"pki\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(86400)\n .build());\n\n var crlConfig = new SecretBackendCrlConfig(\"crlConfig\", SecretBackendCrlConfigArgs.builder()\n .backend(pki.path())\n .expiry(\"72h\")\n .disable(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: '%s'\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n crlConfig:\n type: vault:pkiSecret:SecretBackendCrlConfig\n name: crl_config\n properties:\n backend: ${pki.path}\n expiry: 72h\n disable: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "autoRebuild": { "type": "boolean", "description": "Enables periodic rebuilding of the CRL upon expiry. **Vault 1.12+**\n" }, "autoRebuildGracePeriod": { "type": "string", "description": "Grace period before CRL expiry to attempt rebuild of CRL. **Vault 1.12+**\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n" }, "crossClusterRevocation": { "type": "boolean", "description": "Enable cross-cluster revocation request queues. **Vault 1.13+**\n" }, "deltaRebuildInterval": { "type": "string", "description": "Interval to check for new revocations on, to regenerate the delta CRL.\n" }, "disable": { "type": "boolean", "description": "Disables or enables CRL building.\n" }, "enableDelta": { "type": "boolean", "description": "Enables building of delta CRLs with up-to-date revocation information, \naugmenting the last complete CRL. **Vault 1.12+**\n" }, "expiry": { "type": "string", "description": "Specifies the time until expiration.\n" }, "maxCrlEntries": { "type": "integer", "description": "The maximum number of entries a CRL can contain. This option exists to prevent \naccidental runaway issuance/revocation from overloading Vault. If set to -1, the limit is disabled. **Vault 1.19**\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "ocspDisable": { "type": "boolean", "description": "Disables the OCSP responder in Vault. **Vault 1.12+**\n" }, "ocspExpiry": { "type": "string", "description": "The amount of time an OCSP response can be cached for, useful for OCSP stapling \nrefresh durations. **Vault 1.12+**\n" }, "unifiedCrl": { "type": "boolean", "description": "Enables unified CRL and OCSP building. **Vault 1.13+**\n" }, "unifiedCrlOnExistingPaths": { "type": "boolean", "description": "Enables serving the unified CRL and OCSP on the existing, previously\ncluster-local paths. **Vault 1.13+**\n" } }, "required": [ "autoRebuildGracePeriod", "backend", "crossClusterRevocation", "deltaRebuildInterval", "maxCrlEntries", "ocspExpiry", "unifiedCrl", "unifiedCrlOnExistingPaths" ], "inputProperties": { "autoRebuild": { "type": "boolean", "description": "Enables periodic rebuilding of the CRL upon expiry. **Vault 1.12+**\n" }, "autoRebuildGracePeriod": { "type": "string", "description": "Grace period before CRL expiry to attempt rebuild of CRL. **Vault 1.12+**\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "crossClusterRevocation": { "type": "boolean", "description": "Enable cross-cluster revocation request queues. **Vault 1.13+**\n" }, "deltaRebuildInterval": { "type": "string", "description": "Interval to check for new revocations on, to regenerate the delta CRL.\n" }, "disable": { "type": "boolean", "description": "Disables or enables CRL building.\n" }, "enableDelta": { "type": "boolean", "description": "Enables building of delta CRLs with up-to-date revocation information, \naugmenting the last complete CRL. **Vault 1.12+**\n" }, "expiry": { "type": "string", "description": "Specifies the time until expiration.\n" }, "maxCrlEntries": { "type": "integer", "description": "The maximum number of entries a CRL can contain. This option exists to prevent \naccidental runaway issuance/revocation from overloading Vault. If set to -1, the limit is disabled. **Vault 1.19**\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocspDisable": { "type": "boolean", "description": "Disables the OCSP responder in Vault. **Vault 1.12+**\n" }, "ocspExpiry": { "type": "string", "description": "The amount of time an OCSP response can be cached for, useful for OCSP stapling \nrefresh durations. **Vault 1.12+**\n" }, "unifiedCrl": { "type": "boolean", "description": "Enables unified CRL and OCSP building. **Vault 1.13+**\n" }, "unifiedCrlOnExistingPaths": { "type": "boolean", "description": "Enables serving the unified CRL and OCSP on the existing, previously\ncluster-local paths. **Vault 1.13+**\n" } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendCrlConfig resources.\n", "properties": { "autoRebuild": { "type": "boolean", "description": "Enables periodic rebuilding of the CRL upon expiry. **Vault 1.12+**\n" }, "autoRebuildGracePeriod": { "type": "string", "description": "Grace period before CRL expiry to attempt rebuild of CRL. **Vault 1.12+**\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "crossClusterRevocation": { "type": "boolean", "description": "Enable cross-cluster revocation request queues. **Vault 1.13+**\n" }, "deltaRebuildInterval": { "type": "string", "description": "Interval to check for new revocations on, to regenerate the delta CRL.\n" }, "disable": { "type": "boolean", "description": "Disables or enables CRL building.\n" }, "enableDelta": { "type": "boolean", "description": "Enables building of delta CRLs with up-to-date revocation information, \naugmenting the last complete CRL. **Vault 1.12+**\n" }, "expiry": { "type": "string", "description": "Specifies the time until expiration.\n" }, "maxCrlEntries": { "type": "integer", "description": "The maximum number of entries a CRL can contain. This option exists to prevent \naccidental runaway issuance/revocation from overloading Vault. If set to -1, the limit is disabled. **Vault 1.19**\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocspDisable": { "type": "boolean", "description": "Disables the OCSP responder in Vault. **Vault 1.12+**\n" }, "ocspExpiry": { "type": "string", "description": "The amount of time an OCSP response can be cached for, useful for OCSP stapling \nrefresh durations. **Vault 1.12+**\n" }, "unifiedCrl": { "type": "boolean", "description": "Enables unified CRL and OCSP building. **Vault 1.13+**\n" }, "unifiedCrlOnExistingPaths": { "type": "boolean", "description": "Enables serving the unified CRL and OCSP on the existing, previously\ncluster-local paths. **Vault 1.13+**\n" } }, "type": "object" } }, "vault:pkiSecret/secretBackendIntermediateCertRequest:SecretBackendIntermediateCertRequest": { "description": "Generates a new private key and a CSR for signing the PKI Secret Backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n\u003e **Important** Multi-Issuer Functionality is enabled on this version\nof the Provider. If migrating from an older version of Vault or the Provider,\nplease refer to the PKI Multi-Issuer Upgrade Guide\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.pkisecret.SecretBackendIntermediateCertRequest(\"test\", {\n backend: pki.path,\n type: \"internal\",\n commonName: \"app.my.domain\",\n}, {\n dependsOn: [pki],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.pkisecret.SecretBackendIntermediateCertRequest(\"test\",\n backend=pki[\"path\"],\n type=\"internal\",\n common_name=\"app.my.domain\",\n opts = pulumi.ResourceOptions(depends_on=[pki]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.PkiSecret.SecretBackendIntermediateCertRequest(\"test\", new()\n {\n Backend = pki.Path,\n Type = \"internal\",\n CommonName = \"app.my.domain\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n pki,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := pkisecret.NewSecretBackendIntermediateCertRequest(ctx, \"test\", \u0026pkisecret.SecretBackendIntermediateCertRequestArgs{\n\t\t\tBackend: pulumi.Any(pki.Path),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tCommonName: pulumi.String(\"app.my.domain\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tpki,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pkisecret_secretbackendintermediatecertrequest\" \"test\" {\n depends_on = [pki]\n backend = pki.path\n type = \"internal\"\n common_name = \"app.my.domain\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.pkiSecret.SecretBackendIntermediateCertRequest;\nimport com.pulumi.vault.pkiSecret.SecretBackendIntermediateCertRequestArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new SecretBackendIntermediateCertRequest(\"test\", SecretBackendIntermediateCertRequestArgs.builder()\n .backend(pki.path())\n .type(\"internal\")\n .commonName(\"app.my.domain\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(pki)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:pkiSecret:SecretBackendIntermediateCertRequest\n properties:\n backend: ${pki.path}\n type: internal\n commonName: app.my.domain\n options:\n dependsOn:\n - ${pki}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "addBasicConstraints": { "type": "boolean", "description": "Adds a Basic Constraints extension with 'CA: true'.\nOnly needed as a workaround in some compatibility scenarios with Active Directory\nCertificate Services\n" }, "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n" }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n" }, "commonName": { "type": "string", "description": "CN of intermediate to create\n" }, "country": { "type": "string", "description": "The country\n" }, "csr": { "type": "string", "description": "The CSR\n" }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n" }, "format": { "type": "string", "description": "The format of data\n" }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n" }, "keyBits": { "type": "integer", "description": "The number of bits to use\n" }, "keyId": { "type": "string", "description": "The ID of the generated key.\n" }, "keyName": { "type": "string", "description": "When a new key is created with this request, optionally specifies\nthe name for this. The global ref \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e may not be used as a name.\n" }, "keyRef": { "type": "string", "description": "Specifies the key (either default, by name, or by identifier) to use\nfor generating this request. Only suitable for `type=existing` requests.\n" }, "keyType": { "type": "string", "description": "The desired key type\n" }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specifies\u003cspan pulumi-lang-nodejs=\" keyUsage \" pulumi-lang-dotnet=\" KeyUsage \" pulumi-lang-go=\" keyUsage \" pulumi-lang-python=\" key_usage \" pulumi-lang-yaml=\" keyUsage \" pulumi-lang-java=\" keyUsage \" pulumi-lang-hcl=\" key_usage \"\u003e keyUsage \u003c/span\u003eto encode in the generated certificate.\n" }, "locality": { "type": "string", "description": "The locality\n" }, "managedKeyId": { "type": "string", "description": "The ID of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyName`\" pulumi-lang-dotnet=\"`ManagedKeyName`\" pulumi-lang-go=\"`managedKeyName`\" pulumi-lang-python=\"`managed_key_name`\" pulumi-lang-yaml=\"`managedKeyName`\" pulumi-lang-java=\"`managedKeyName`\" pulumi-lang-hcl=\"`managed_key_name`\"\u003e`managedKeyName`\u003c/span\u003e\n" }, "managedKeyName": { "type": "string", "description": "The name of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyId`\" pulumi-lang-dotnet=\"`ManagedKeyId`\" pulumi-lang-go=\"`managedKeyId`\" pulumi-lang-python=\"`managed_key_id`\" pulumi-lang-yaml=\"`managedKeyId`\" pulumi-lang-java=\"`managedKeyId`\" pulumi-lang-hcl=\"`managed_key_id`\"\u003e`managedKeyId`\u003c/span\u003e\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "organization": { "type": "string", "description": "The organization\n" }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n" }, "ou": { "type": "string", "description": "The organization unit\n" }, "postalCode": { "type": "string", "description": "The postal code\n" }, "privateKey": { "type": "string", "description": "The private key\n", "secret": true }, "privateKeyFormat": { "type": "string", "description": "The private key format\n" }, "privateKeyType": { "type": "string", "description": "The private key type\n" }, "province": { "type": "string", "description": "The province\n" }, "serialNumber": { "type": "string", "description": "The requested Subject's named Serial Number\n" }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n" }, "streetAddress": { "type": "string", "description": "The street address\n" }, "type": { "type": "string", "description": "Type of intermediate to create. Must be either \\\"exported\\\" or \\\"internal\\\"\nor \\\"kms\\\"\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n" } }, "required": [ "backend", "commonName", "csr", "keyId", "keyName", "keyRef", "privateKey", "privateKeyType", "type" ], "inputProperties": { "addBasicConstraints": { "type": "boolean", "description": "Adds a Basic Constraints extension with 'CA: true'.\nOnly needed as a workaround in some compatibility scenarios with Active Directory\nCertificate Services\n", "willReplaceOnChanges": true }, "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "commonName": { "type": "string", "description": "CN of intermediate to create\n", "willReplaceOnChanges": true }, "country": { "type": "string", "description": "The country\n", "willReplaceOnChanges": true }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "format": { "type": "string", "description": "The format of data\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "keyBits": { "type": "integer", "description": "The number of bits to use\n", "willReplaceOnChanges": true }, "keyName": { "type": "string", "description": "When a new key is created with this request, optionally specifies\nthe name for this. The global ref \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e may not be used as a name.\n", "willReplaceOnChanges": true }, "keyRef": { "type": "string", "description": "Specifies the key (either default, by name, or by identifier) to use\nfor generating this request. Only suitable for `type=existing` requests.\n", "willReplaceOnChanges": true }, "keyType": { "type": "string", "description": "The desired key type\n", "willReplaceOnChanges": true }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specifies\u003cspan pulumi-lang-nodejs=\" keyUsage \" pulumi-lang-dotnet=\" KeyUsage \" pulumi-lang-go=\" keyUsage \" pulumi-lang-python=\" key_usage \" pulumi-lang-yaml=\" keyUsage \" pulumi-lang-java=\" keyUsage \" pulumi-lang-hcl=\" key_usage \"\u003e keyUsage \u003c/span\u003eto encode in the generated certificate.\n", "willReplaceOnChanges": true }, "locality": { "type": "string", "description": "The locality\n", "willReplaceOnChanges": true }, "managedKeyId": { "type": "string", "description": "The ID of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyName`\" pulumi-lang-dotnet=\"`ManagedKeyName`\" pulumi-lang-go=\"`managedKeyName`\" pulumi-lang-python=\"`managed_key_name`\" pulumi-lang-yaml=\"`managedKeyName`\" pulumi-lang-java=\"`managedKeyName`\" pulumi-lang-hcl=\"`managed_key_name`\"\u003e`managedKeyName`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "managedKeyName": { "type": "string", "description": "The name of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyId`\" pulumi-lang-dotnet=\"`ManagedKeyId`\" pulumi-lang-go=\"`managedKeyId`\" pulumi-lang-python=\"`managed_key_id`\" pulumi-lang-yaml=\"`managedKeyId`\" pulumi-lang-java=\"`managedKeyId`\" pulumi-lang-hcl=\"`managed_key_id`\"\u003e`managedKeyId`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "organization": { "type": "string", "description": "The organization\n", "willReplaceOnChanges": true }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "ou": { "type": "string", "description": "The organization unit\n", "willReplaceOnChanges": true }, "postalCode": { "type": "string", "description": "The postal code\n", "willReplaceOnChanges": true }, "privateKeyFormat": { "type": "string", "description": "The private key format\n", "willReplaceOnChanges": true }, "province": { "type": "string", "description": "The province\n", "willReplaceOnChanges": true }, "serialNumber": { "type": "string", "description": "The requested Subject's named Serial Number\n", "willReplaceOnChanges": true }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n", "willReplaceOnChanges": true }, "streetAddress": { "type": "string", "description": "The street address\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Type of intermediate to create. Must be either \\\"exported\\\" or \\\"internal\\\"\nor \\\"kms\\\"\n", "willReplaceOnChanges": true }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "commonName", "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendIntermediateCertRequest resources.\n", "properties": { "addBasicConstraints": { "type": "boolean", "description": "Adds a Basic Constraints extension with 'CA: true'.\nOnly needed as a workaround in some compatibility scenarios with Active Directory\nCertificate Services\n", "willReplaceOnChanges": true }, "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "commonName": { "type": "string", "description": "CN of intermediate to create\n", "willReplaceOnChanges": true }, "country": { "type": "string", "description": "The country\n", "willReplaceOnChanges": true }, "csr": { "type": "string", "description": "The CSR\n" }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "format": { "type": "string", "description": "The format of data\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "keyBits": { "type": "integer", "description": "The number of bits to use\n", "willReplaceOnChanges": true }, "keyId": { "type": "string", "description": "The ID of the generated key.\n", "willReplaceOnChanges": true }, "keyName": { "type": "string", "description": "When a new key is created with this request, optionally specifies\nthe name for this. The global ref \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e may not be used as a name.\n", "willReplaceOnChanges": true }, "keyRef": { "type": "string", "description": "Specifies the key (either default, by name, or by identifier) to use\nfor generating this request. Only suitable for `type=existing` requests.\n", "willReplaceOnChanges": true }, "keyType": { "type": "string", "description": "The desired key type\n", "willReplaceOnChanges": true }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specifies\u003cspan pulumi-lang-nodejs=\" keyUsage \" pulumi-lang-dotnet=\" KeyUsage \" pulumi-lang-go=\" keyUsage \" pulumi-lang-python=\" key_usage \" pulumi-lang-yaml=\" keyUsage \" pulumi-lang-java=\" keyUsage \" pulumi-lang-hcl=\" key_usage \"\u003e keyUsage \u003c/span\u003eto encode in the generated certificate.\n", "willReplaceOnChanges": true }, "locality": { "type": "string", "description": "The locality\n", "willReplaceOnChanges": true }, "managedKeyId": { "type": "string", "description": "The ID of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyName`\" pulumi-lang-dotnet=\"`ManagedKeyName`\" pulumi-lang-go=\"`managedKeyName`\" pulumi-lang-python=\"`managed_key_name`\" pulumi-lang-yaml=\"`managedKeyName`\" pulumi-lang-java=\"`managedKeyName`\" pulumi-lang-hcl=\"`managed_key_name`\"\u003e`managedKeyName`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "managedKeyName": { "type": "string", "description": "The name of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyId`\" pulumi-lang-dotnet=\"`ManagedKeyId`\" pulumi-lang-go=\"`managedKeyId`\" pulumi-lang-python=\"`managed_key_id`\" pulumi-lang-yaml=\"`managedKeyId`\" pulumi-lang-java=\"`managedKeyId`\" pulumi-lang-hcl=\"`managed_key_id`\"\u003e`managedKeyId`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "organization": { "type": "string", "description": "The organization\n", "willReplaceOnChanges": true }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "ou": { "type": "string", "description": "The organization unit\n", "willReplaceOnChanges": true }, "postalCode": { "type": "string", "description": "The postal code\n", "willReplaceOnChanges": true }, "privateKey": { "type": "string", "description": "The private key\n", "secret": true }, "privateKeyFormat": { "type": "string", "description": "The private key format\n", "willReplaceOnChanges": true }, "privateKeyType": { "type": "string", "description": "The private key type\n" }, "province": { "type": "string", "description": "The province\n", "willReplaceOnChanges": true }, "serialNumber": { "type": "string", "description": "The requested Subject's named Serial Number\n", "willReplaceOnChanges": true }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n", "willReplaceOnChanges": true }, "streetAddress": { "type": "string", "description": "The street address\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Type of intermediate to create. Must be either \\\"exported\\\" or \\\"internal\\\"\nor \\\"kms\\\"\n", "willReplaceOnChanges": true }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/secretBackendIntermediateSetSigned:SecretBackendIntermediateSetSigned": { "description": "Submits the CA certificate to the PKI Secret Backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n\u003e **Important** Multi-Issuer Functionality is enabled on this version\nof the Provider. If migrating from an older version of Vault or the Provider,\nplease refer to the PKI Multi-Issuer Upgrade Guide\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst root = new vault.Mount(\"root\", {\n path: \"pki-root\",\n type: \"pki\",\n description: \"root\",\n defaultLeaseTtlSeconds: 8640000,\n maxLeaseTtlSeconds: 8640000,\n});\nconst intermediate = new vault.Mount(\"intermediate\", {\n path: \"pki-int\",\n type: root.type,\n description: \"intermediate\",\n defaultLeaseTtlSeconds: 86400,\n maxLeaseTtlSeconds: 86400,\n});\nconst example = new vault.pkisecret.SecretBackendRootCert(\"example\", {\n backend: root.path,\n type: \"internal\",\n commonName: \"RootOrg Root CA\",\n ttl: \"86400\",\n format: \"pem\",\n privateKeyFormat: \"der\",\n keyType: \"rsa\",\n keyBits: 4096,\n excludeCnFromSans: true,\n ou: \"Organizational Unit\",\n organization: \"RootOrg\",\n country: \"US\",\n locality: \"San Francisco\",\n province: \"CA\",\n});\nconst exampleSecretBackendIntermediateCertRequest = new vault.pkisecret.SecretBackendIntermediateCertRequest(\"example\", {\n backend: intermediate.path,\n type: example.type,\n commonName: \"SubOrg Intermediate CA\",\n});\nconst exampleSecretBackendRootSignIntermediate = new vault.pkisecret.SecretBackendRootSignIntermediate(\"example\", {\n backend: root.path,\n csr: exampleSecretBackendIntermediateCertRequest.csr,\n commonName: \"SubOrg Intermediate CA\",\n excludeCnFromSans: true,\n ou: \"SubUnit\",\n organization: \"SubOrg\",\n country: \"US\",\n locality: \"San Francisco\",\n province: \"CA\",\n revoke: true,\n});\nconst exampleSecretBackendIntermediateSetSigned = new vault.pkisecret.SecretBackendIntermediateSetSigned(\"example\", {\n backend: intermediate.path,\n certificate: exampleSecretBackendRootSignIntermediate.certificate,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nroot = vault.Mount(\"root\",\n path=\"pki-root\",\n type=\"pki\",\n description=\"root\",\n default_lease_ttl_seconds=8640000,\n max_lease_ttl_seconds=8640000)\nintermediate = vault.Mount(\"intermediate\",\n path=\"pki-int\",\n type=root.type,\n description=\"intermediate\",\n default_lease_ttl_seconds=86400,\n max_lease_ttl_seconds=86400)\nexample = vault.pkisecret.SecretBackendRootCert(\"example\",\n backend=root.path,\n type=\"internal\",\n common_name=\"RootOrg Root CA\",\n ttl=\"86400\",\n format=\"pem\",\n private_key_format=\"der\",\n key_type=\"rsa\",\n key_bits=4096,\n exclude_cn_from_sans=True,\n ou=\"Organizational Unit\",\n organization=\"RootOrg\",\n country=\"US\",\n locality=\"San Francisco\",\n province=\"CA\")\nexample_secret_backend_intermediate_cert_request = vault.pkisecret.SecretBackendIntermediateCertRequest(\"example\",\n backend=intermediate.path,\n type=example.type,\n common_name=\"SubOrg Intermediate CA\")\nexample_secret_backend_root_sign_intermediate = vault.pkisecret.SecretBackendRootSignIntermediate(\"example\",\n backend=root.path,\n csr=example_secret_backend_intermediate_cert_request.csr,\n common_name=\"SubOrg Intermediate CA\",\n exclude_cn_from_sans=True,\n ou=\"SubUnit\",\n organization=\"SubOrg\",\n country=\"US\",\n locality=\"San Francisco\",\n province=\"CA\",\n revoke=True)\nexample_secret_backend_intermediate_set_signed = vault.pkisecret.SecretBackendIntermediateSetSigned(\"example\",\n backend=intermediate.path,\n certificate=example_secret_backend_root_sign_intermediate.certificate)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var root = new Vault.Mount(\"root\", new()\n {\n Path = \"pki-root\",\n Type = \"pki\",\n Description = \"root\",\n DefaultLeaseTtlSeconds = 8640000,\n MaxLeaseTtlSeconds = 8640000,\n });\n\n var intermediate = new Vault.Mount(\"intermediate\", new()\n {\n Path = \"pki-int\",\n Type = root.Type,\n Description = \"intermediate\",\n DefaultLeaseTtlSeconds = 86400,\n MaxLeaseTtlSeconds = 86400,\n });\n\n var example = new Vault.PkiSecret.SecretBackendRootCert(\"example\", new()\n {\n Backend = root.Path,\n Type = \"internal\",\n CommonName = \"RootOrg Root CA\",\n Ttl = \"86400\",\n Format = \"pem\",\n PrivateKeyFormat = \"der\",\n KeyType = \"rsa\",\n KeyBits = 4096,\n ExcludeCnFromSans = true,\n Ou = \"Organizational Unit\",\n Organization = \"RootOrg\",\n Country = \"US\",\n Locality = \"San Francisco\",\n Province = \"CA\",\n });\n\n var exampleSecretBackendIntermediateCertRequest = new Vault.PkiSecret.SecretBackendIntermediateCertRequest(\"example\", new()\n {\n Backend = intermediate.Path,\n Type = example.Type,\n CommonName = \"SubOrg Intermediate CA\",\n });\n\n var exampleSecretBackendRootSignIntermediate = new Vault.PkiSecret.SecretBackendRootSignIntermediate(\"example\", new()\n {\n Backend = root.Path,\n Csr = exampleSecretBackendIntermediateCertRequest.Csr,\n CommonName = \"SubOrg Intermediate CA\",\n ExcludeCnFromSans = true,\n Ou = \"SubUnit\",\n Organization = \"SubOrg\",\n Country = \"US\",\n Locality = \"San Francisco\",\n Province = \"CA\",\n Revoke = true,\n });\n\n var exampleSecretBackendIntermediateSetSigned = new Vault.PkiSecret.SecretBackendIntermediateSetSigned(\"example\", new()\n {\n Backend = intermediate.Path,\n Certificate = exampleSecretBackendRootSignIntermediate.Certificate,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\troot, err := vault.NewMount(ctx, \"root\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-root\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDescription: pulumi.String(\"root\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(8640000),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(8640000),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tintermediate, err := vault.NewMount(ctx, \"intermediate\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-int\"),\n\t\t\tType: root.Type,\n\t\t\tDescription: pulumi.String(\"intermediate\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(86400),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texample, err := pkisecret.NewSecretBackendRootCert(ctx, \"example\", \u0026pkisecret.SecretBackendRootCertArgs{\n\t\t\tBackend: root.Path,\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tCommonName: pulumi.String(\"RootOrg Root CA\"),\n\t\t\tTtl: pulumi.String(\"86400\"),\n\t\t\tFormat: pulumi.String(\"pem\"),\n\t\t\tPrivateKeyFormat: pulumi.String(\"der\"),\n\t\t\tKeyType: pulumi.String(\"rsa\"),\n\t\t\tKeyBits: pulumi.Int(4096),\n\t\t\tExcludeCnFromSans: pulumi.Bool(true),\n\t\t\tOu: pulumi.String(\"Organizational Unit\"),\n\t\t\tOrganization: pulumi.String(\"RootOrg\"),\n\t\t\tCountry: pulumi.String(\"US\"),\n\t\t\tLocality: pulumi.String(\"San Francisco\"),\n\t\t\tProvince: pulumi.String(\"CA\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendIntermediateCertRequest, err := pkisecret.NewSecretBackendIntermediateCertRequest(ctx, \"example\", \u0026pkisecret.SecretBackendIntermediateCertRequestArgs{\n\t\t\tBackend: intermediate.Path,\n\t\t\tType: example.Type,\n\t\t\tCommonName: pulumi.String(\"SubOrg Intermediate CA\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendRootSignIntermediate, err := pkisecret.NewSecretBackendRootSignIntermediate(ctx, \"example\", \u0026pkisecret.SecretBackendRootSignIntermediateArgs{\n\t\t\tBackend: root.Path,\n\t\t\tCsr: exampleSecretBackendIntermediateCertRequest.Csr,\n\t\t\tCommonName: pulumi.String(\"SubOrg Intermediate CA\"),\n\t\t\tExcludeCnFromSans: pulumi.Bool(true),\n\t\t\tOu: pulumi.String(\"SubUnit\"),\n\t\t\tOrganization: pulumi.String(\"SubOrg\"),\n\t\t\tCountry: pulumi.String(\"US\"),\n\t\t\tLocality: pulumi.String(\"San Francisco\"),\n\t\t\tProvince: pulumi.String(\"CA\"),\n\t\t\tRevoke: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewSecretBackendIntermediateSetSigned(ctx, \"example\", \u0026pkisecret.SecretBackendIntermediateSetSignedArgs{\n\t\t\tBackend: intermediate.Path,\n\t\t\tCertificate: exampleSecretBackendRootSignIntermediate.Certificate,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"root\" {\n path = \"pki-root\"\n type = \"pki\"\n description = \"root\"\n default_lease_ttl_seconds = 8640000\n max_lease_ttl_seconds = 8640000\n}\nresource \"vault_mount\" \"intermediate\" {\n path = \"pki-int\"\n type = vault_mount.root.type\n description = \"intermediate\"\n default_lease_ttl_seconds = 86400\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_secretbackendrootcert\" \"example\" {\n backend = vault_mount.root.path\n type = \"internal\"\n common_name = \"RootOrg Root CA\"\n ttl = 86400\n format = \"pem\"\n private_key_format = \"der\"\n key_type = \"rsa\"\n key_bits = 4096\n exclude_cn_from_sans = true\n ou = \"Organizational Unit\"\n organization = \"RootOrg\"\n country = \"US\"\n locality = \"San Francisco\"\n province = \"CA\"\n}\nresource \"vault_pkisecret_secretbackendintermediatecertrequest\" \"example\" {\n backend = vault_mount.intermediate.path\n type = vault_pkisecret_secretbackendrootcert.example.type\n common_name = \"SubOrg Intermediate CA\"\n}\nresource \"vault_pkisecret_secretbackendrootsignintermediate\" \"example\" {\n backend = vault_mount.root.path\n csr = vault_pkisecret_secretbackendintermediatecertrequest.example.csr\n common_name = \"SubOrg Intermediate CA\"\n exclude_cn_from_sans = true\n ou = \"SubUnit\"\n organization = \"SubOrg\"\n country = \"US\"\n locality = \"San Francisco\"\n province = \"CA\"\n revoke = true\n}\nresource \"vault_pkisecret_secretbackendintermediatesetsigned\" \"example\" {\n backend = vault_mount.intermediate.path\n certificate = vault_pkisecret_secretbackendrootsignintermediate.example.certificate\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootCert;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootCertArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendIntermediateCertRequest;\nimport com.pulumi.vault.pkiSecret.SecretBackendIntermediateCertRequestArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootSignIntermediate;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootSignIntermediateArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendIntermediateSetSigned;\nimport com.pulumi.vault.pkiSecret.SecretBackendIntermediateSetSignedArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var root = new Mount(\"root\", MountArgs.builder()\n .path(\"pki-root\")\n .type(\"pki\")\n .description(\"root\")\n .defaultLeaseTtlSeconds(8640000)\n .maxLeaseTtlSeconds(8640000)\n .build());\n\n var intermediate = new Mount(\"intermediate\", MountArgs.builder()\n .path(\"pki-int\")\n .type(root.type())\n .description(\"intermediate\")\n .defaultLeaseTtlSeconds(86400)\n .maxLeaseTtlSeconds(86400)\n .build());\n\n var example = new SecretBackendRootCert(\"example\", SecretBackendRootCertArgs.builder()\n .backend(root.path())\n .type(\"internal\")\n .commonName(\"RootOrg Root CA\")\n .ttl(\"86400\")\n .format(\"pem\")\n .privateKeyFormat(\"der\")\n .keyType(\"rsa\")\n .keyBits(4096)\n .excludeCnFromSans(true)\n .ou(\"Organizational Unit\")\n .organization(\"RootOrg\")\n .country(\"US\")\n .locality(\"San Francisco\")\n .province(\"CA\")\n .build());\n\n var exampleSecretBackendIntermediateCertRequest = new SecretBackendIntermediateCertRequest(\"exampleSecretBackendIntermediateCertRequest\", SecretBackendIntermediateCertRequestArgs.builder()\n .backend(intermediate.path())\n .type(example.type())\n .commonName(\"SubOrg Intermediate CA\")\n .build());\n\n var exampleSecretBackendRootSignIntermediate = new SecretBackendRootSignIntermediate(\"exampleSecretBackendRootSignIntermediate\", SecretBackendRootSignIntermediateArgs.builder()\n .backend(root.path())\n .csr(exampleSecretBackendIntermediateCertRequest.csr())\n .commonName(\"SubOrg Intermediate CA\")\n .excludeCnFromSans(true)\n .ou(\"SubUnit\")\n .organization(\"SubOrg\")\n .country(\"US\")\n .locality(\"San Francisco\")\n .province(\"CA\")\n .revoke(true)\n .build());\n\n var exampleSecretBackendIntermediateSetSigned = new SecretBackendIntermediateSetSigned(\"exampleSecretBackendIntermediateSetSigned\", SecretBackendIntermediateSetSignedArgs.builder()\n .backend(intermediate.path())\n .certificate(exampleSecretBackendRootSignIntermediate.certificate())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n root:\n type: vault:Mount\n properties:\n path: pki-root\n type: pki\n description: root\n defaultLeaseTtlSeconds: 8.64e+06\n maxLeaseTtlSeconds: 8.64e+06\n intermediate:\n type: vault:Mount\n properties:\n path: pki-int\n type: ${root.type}\n description: intermediate\n defaultLeaseTtlSeconds: 86400\n maxLeaseTtlSeconds: 86400\n example:\n type: vault:pkiSecret:SecretBackendRootCert\n properties:\n backend: ${root.path}\n type: internal\n commonName: RootOrg Root CA\n ttl: 86400\n format: pem\n privateKeyFormat: der\n keyType: rsa\n keyBits: 4096\n excludeCnFromSans: true\n ou: Organizational Unit\n organization: RootOrg\n country: US\n locality: San Francisco\n province: CA\n exampleSecretBackendIntermediateCertRequest:\n type: vault:pkiSecret:SecretBackendIntermediateCertRequest\n name: example\n properties:\n backend: ${intermediate.path}\n type: ${example.type}\n commonName: SubOrg Intermediate CA\n exampleSecretBackendRootSignIntermediate:\n type: vault:pkiSecret:SecretBackendRootSignIntermediate\n name: example\n properties:\n backend: ${root.path}\n csr: ${exampleSecretBackendIntermediateCertRequest.csr}\n commonName: SubOrg Intermediate CA\n excludeCnFromSans: true\n ou: SubUnit\n organization: SubOrg\n country: US\n locality: San Francisco\n province: CA\n revoke: true\n exampleSecretBackendIntermediateSetSigned:\n type: vault:pkiSecret:SecretBackendIntermediateSetSigned\n name: example\n properties:\n backend: ${intermediate.path}\n certificate: ${exampleSecretBackendRootSignIntermediate.certificate}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n" }, "certificate": { "type": "string", "description": "Specifies the PEM encoded certificate. May optionally append additional\nCA certificates to populate the whole chain, which will then enable returning the full chain from\nissue and sign operations.\n" }, "importedIssuers": { "type": "array", "items": { "type": "string" }, "description": "The imported issuers indicating which issuers were created as part of\nthis request.\n" }, "importedKeys": { "type": "array", "items": { "type": "string" }, "description": "The imported keys indicating which keys were created as part of this request.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "backend", "certificate", "importedIssuers", "importedKeys" ], "inputProperties": { "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "certificate": { "type": "string", "description": "Specifies the PEM encoded certificate. May optionally append additional\nCA certificates to populate the whole chain, which will then enable returning the full chain from\nissue and sign operations.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "certificate" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendIntermediateSetSigned resources.\n", "properties": { "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "certificate": { "type": "string", "description": "Specifies the PEM encoded certificate. May optionally append additional\nCA certificates to populate the whole chain, which will then enable returning the full chain from\nissue and sign operations.\n", "willReplaceOnChanges": true }, "importedIssuers": { "type": "array", "items": { "type": "string" }, "description": "The imported issuers indicating which issuers were created as part of\nthis request.\n", "willReplaceOnChanges": true }, "importedKeys": { "type": "array", "items": { "type": "string" }, "description": "The imported keys indicating which keys were created as part of this request.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/secretBackendIssuer:SecretBackendIssuer": { "description": "Manages the lifecycle of an existing issuer on a PKI Secret Backend. This resource does not\ncreate issuers. It instead tracks and performs updates made to an existing issuer that was\ncreated by one of the PKI generate endpoints. For more information, see the \n[Vault documentation](https://developer.hashicorp.com/vault/api-docs/secret/pki#managing-keys-and-issuers)\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki\",\n type: \"pki\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 86400,\n});\nconst root = new vault.pkisecret.SecretBackendRootCert(\"root\", {\n backend: pki.path,\n type: \"internal\",\n commonName: \"test\",\n ttl: \"86400\",\n});\nconst example = new vault.pkisecret.SecretBackendIssuer(\"example\", {\n backend: root.backend,\n issuerRef: root.issuerId,\n issuerName: \"example-issuer\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki = vault.Mount(\"pki\",\n path=\"pki\",\n type=\"pki\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=86400)\nroot = vault.pkisecret.SecretBackendRootCert(\"root\",\n backend=pki.path,\n type=\"internal\",\n common_name=\"test\",\n ttl=\"86400\")\nexample = vault.pkisecret.SecretBackendIssuer(\"example\",\n backend=root.backend,\n issuer_ref=root.issuer_id,\n issuer_name=\"example-issuer\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki\",\n Type = \"pki\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 86400,\n });\n\n var root = new Vault.PkiSecret.SecretBackendRootCert(\"root\", new()\n {\n Backend = pki.Path,\n Type = \"internal\",\n CommonName = \"test\",\n Ttl = \"86400\",\n });\n\n var example = new Vault.PkiSecret.SecretBackendIssuer(\"example\", new()\n {\n Backend = root.Backend,\n IssuerRef = root.IssuerId,\n IssuerName = \"example-issuer\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\troot, err := pkisecret.NewSecretBackendRootCert(ctx, \"root\", \u0026pkisecret.SecretBackendRootCertArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tCommonName: pulumi.String(\"test\"),\n\t\t\tTtl: pulumi.String(\"86400\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewSecretBackendIssuer(ctx, \"example\", \u0026pkisecret.SecretBackendIssuerArgs{\n\t\t\tBackend: root.Backend,\n\t\t\tIssuerRef: root.IssuerId,\n\t\t\tIssuerName: pulumi.String(\"example-issuer\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_secretbackendrootcert\" \"root\" {\n backend = vault_mount.pki.path\n type = \"internal\"\n common_name = \"test\"\n ttl = \"86400\"\n}\nresource \"vault_pkisecret_secretbackendissuer\" \"example\" {\n backend = vault_pkisecret_secretbackendrootcert.root.backend\n issuer_ref = vault_pkisecret_secretbackendrootcert.root.issuer_id\n issuer_name = \"example-issuer\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootCert;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootCertArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendIssuer;\nimport com.pulumi.vault.pkiSecret.SecretBackendIssuerArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki\")\n .type(\"pki\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(86400)\n .build());\n\n var root = new SecretBackendRootCert(\"root\", SecretBackendRootCertArgs.builder()\n .backend(pki.path())\n .type(\"internal\")\n .commonName(\"test\")\n .ttl(\"86400\")\n .build());\n\n var example = new SecretBackendIssuer(\"example\", SecretBackendIssuerArgs.builder()\n .backend(root.backend())\n .issuerRef(root.issuerId())\n .issuerName(\"example-issuer\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n root:\n type: vault:pkiSecret:SecretBackendRootCert\n properties:\n backend: ${pki.path}\n type: internal\n commonName: test\n ttl: '86400'\n example:\n type: vault:pkiSecret:SecretBackendIssuer\n properties:\n backend: ${root.backend}\n issuerRef: ${root.issuerId}\n issuerName: example-issuer\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPKI secret backend issuer can be imported using the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/secretBackendIssuer:SecretBackendIssuer example pki/issuer/bf9b0d48-d0dd-652c-30be-77d04fc7e94d\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no\nleading or trailing `/`s.\n" }, "crlDistributionPoints": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the CRL\nDistribution Points field.\n" }, "disableCriticalExtensionChecks": { "type": "boolean", "description": "This determines whether this\nissuer is able to issue certificates where the chain of trust (including the\nissued certificate) contain critical extensions not processed by Vault.\n" }, "disableNameChecks": { "type": "boolean", "description": "This determines whether this issuer is able\nto issue certificates where the chain of trust (including the final issued\ncertificate) contains a link in which the subject of the issuing certificate\ndoes not match the named issuer of the certificate it signed.\n" }, "disableNameConstraintChecks": { "type": "boolean", "description": "This determines whether this\nissuer is able to issue certificates where the chain of trust (including the\nfinal issued certificate) violates the name constraints critical extension of\none of the issuer certificates in the chain.\n" }, "disablePathLengthChecks": { "type": "boolean", "description": "This determines whether this issuer\nis able to issue certificates where the chain of trust (including the final\nissued certificate) is longer than allowed by a certificate authority in that\nchain.\n" }, "enableAiaUrlTemplating": { "type": "boolean", "description": "Specifies that the AIA URL values should\nbe templated.\n" }, "issuerId": { "type": "string", "description": "ID of the issuer.\n" }, "issuerName": { "type": "string", "description": "Name of the issuer.\n" }, "issuerRef": { "type": "string", "description": "Reference to an existing issuer.\n" }, "issuingCertificates": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the Issuing\nCertificate field.\n" }, "leafNotAfterBehavior": { "type": "string", "description": "Behavior of a leaf's NotAfter field during\nissuance.\n" }, "manualChains": { "type": "array", "items": { "type": "string" }, "description": "Chain of issuer references to build this issuer's\ncomputed CAChain field from, when non-empty.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "ocspServers": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the OCSP Servers field.\n" }, "revocationSignatureAlgorithm": { "type": "string", "description": "Which signature algorithm to use\nwhen building CRLs.\n" }, "usage": { "type": "string", "description": "Allowed usages for this issuer.\n" } }, "required": [ "backend", "issuerId", "issuerRef", "leafNotAfterBehavior", "revocationSignatureAlgorithm", "usage" ], "inputProperties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no\nleading or trailing `/`s.\n", "willReplaceOnChanges": true }, "crlDistributionPoints": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the CRL\nDistribution Points field.\n" }, "disableCriticalExtensionChecks": { "type": "boolean", "description": "This determines whether this\nissuer is able to issue certificates where the chain of trust (including the\nissued certificate) contain critical extensions not processed by Vault.\n" }, "disableNameChecks": { "type": "boolean", "description": "This determines whether this issuer is able\nto issue certificates where the chain of trust (including the final issued\ncertificate) contains a link in which the subject of the issuing certificate\ndoes not match the named issuer of the certificate it signed.\n" }, "disableNameConstraintChecks": { "type": "boolean", "description": "This determines whether this\nissuer is able to issue certificates where the chain of trust (including the\nfinal issued certificate) violates the name constraints critical extension of\none of the issuer certificates in the chain.\n" }, "disablePathLengthChecks": { "type": "boolean", "description": "This determines whether this issuer\nis able to issue certificates where the chain of trust (including the final\nissued certificate) is longer than allowed by a certificate authority in that\nchain.\n" }, "enableAiaUrlTemplating": { "type": "boolean", "description": "Specifies that the AIA URL values should\nbe templated.\n" }, "issuerName": { "type": "string", "description": "Name of the issuer.\n" }, "issuerRef": { "type": "string", "description": "Reference to an existing issuer.\n" }, "issuingCertificates": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the Issuing\nCertificate field.\n" }, "leafNotAfterBehavior": { "type": "string", "description": "Behavior of a leaf's NotAfter field during\nissuance.\n" }, "manualChains": { "type": "array", "items": { "type": "string" }, "description": "Chain of issuer references to build this issuer's\ncomputed CAChain field from, when non-empty.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocspServers": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the OCSP Servers field.\n" }, "revocationSignatureAlgorithm": { "type": "string", "description": "Which signature algorithm to use\nwhen building CRLs.\n" }, "usage": { "type": "string", "description": "Allowed usages for this issuer.\n" } }, "requiredInputs": [ "backend", "issuerRef" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendIssuer resources.\n", "properties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no\nleading or trailing `/`s.\n", "willReplaceOnChanges": true }, "crlDistributionPoints": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the CRL\nDistribution Points field.\n" }, "disableCriticalExtensionChecks": { "type": "boolean", "description": "This determines whether this\nissuer is able to issue certificates where the chain of trust (including the\nissued certificate) contain critical extensions not processed by Vault.\n" }, "disableNameChecks": { "type": "boolean", "description": "This determines whether this issuer is able\nto issue certificates where the chain of trust (including the final issued\ncertificate) contains a link in which the subject of the issuing certificate\ndoes not match the named issuer of the certificate it signed.\n" }, "disableNameConstraintChecks": { "type": "boolean", "description": "This determines whether this\nissuer is able to issue certificates where the chain of trust (including the\nfinal issued certificate) violates the name constraints critical extension of\none of the issuer certificates in the chain.\n" }, "disablePathLengthChecks": { "type": "boolean", "description": "This determines whether this issuer\nis able to issue certificates where the chain of trust (including the final\nissued certificate) is longer than allowed by a certificate authority in that\nchain.\n" }, "enableAiaUrlTemplating": { "type": "boolean", "description": "Specifies that the AIA URL values should\nbe templated.\n" }, "issuerId": { "type": "string", "description": "ID of the issuer.\n" }, "issuerName": { "type": "string", "description": "Name of the issuer.\n" }, "issuerRef": { "type": "string", "description": "Reference to an existing issuer.\n" }, "issuingCertificates": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the Issuing\nCertificate field.\n" }, "leafNotAfterBehavior": { "type": "string", "description": "Behavior of a leaf's NotAfter field during\nissuance.\n" }, "manualChains": { "type": "array", "items": { "type": "string" }, "description": "Chain of issuer references to build this issuer's\ncomputed CAChain field from, when non-empty.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "ocspServers": { "type": "array", "items": { "type": "string" }, "description": "Specifies the URL values for the OCSP Servers field.\n" }, "revocationSignatureAlgorithm": { "type": "string", "description": "Which signature algorithm to use\nwhen building CRLs.\n" }, "usage": { "type": "string", "description": "Allowed usages for this issuer.\n" } }, "type": "object" } }, "vault:pkiSecret/secretBackendKey:SecretBackendKey": { "description": "Creates a key on a PKI Secret Backend for Vault.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki\",\n type: \"pki\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 86400,\n});\nconst key = new vault.pkisecret.SecretBackendKey(\"key\", {\n mount: pki.path,\n type: \"exported\",\n keyName: \"example-key\",\n keyType: \"rsa\",\n keyBits: 2048,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki = vault.Mount(\"pki\",\n path=\"pki\",\n type=\"pki\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=86400)\nkey = vault.pkisecret.SecretBackendKey(\"key\",\n mount=pki.path,\n type=\"exported\",\n key_name=\"example-key\",\n key_type=\"rsa\",\n key_bits=2048)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki\",\n Type = \"pki\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 86400,\n });\n\n var key = new Vault.PkiSecret.SecretBackendKey(\"key\", new()\n {\n Mount = pki.Path,\n Type = \"exported\",\n KeyName = \"example-key\",\n KeyType = \"rsa\",\n KeyBits = 2048,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewSecretBackendKey(ctx, \"key\", \u0026pkisecret.SecretBackendKeyArgs{\n\t\t\tMount: pki.Path,\n\t\t\tType: pulumi.String(\"exported\"),\n\t\t\tKeyName: pulumi.String(\"example-key\"),\n\t\t\tKeyType: pulumi.String(\"rsa\"),\n\t\t\tKeyBits: pulumi.Int(2048),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_secretbackendkey\" \"key\" {\n mount = vault_mount.pki.path\n type = \"exported\"\n key_name = \"example-key\"\n key_type = \"rsa\"\n key_bits = \"2048\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendKey;\nimport com.pulumi.vault.pkiSecret.SecretBackendKeyArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki\")\n .type(\"pki\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(86400)\n .build());\n\n var key = new SecretBackendKey(\"key\", SecretBackendKeyArgs.builder()\n .mount(pki.path())\n .type(\"exported\")\n .keyName(\"example-key\")\n .keyType(\"rsa\")\n .keyBits(2048)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n key:\n type: vault:pkiSecret:SecretBackendKey\n properties:\n mount: ${pki.path}\n type: exported\n keyName: example-key\n keyType: rsa\n keyBits: '2048'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPKI secret backend key can be imported using the \u003cspan pulumi-lang-nodejs=\"`id`\" pulumi-lang-dotnet=\"`Id`\" pulumi-lang-go=\"`id`\" pulumi-lang-python=\"`id`\" pulumi-lang-yaml=\"`id`\" pulumi-lang-java=\"`id`\" pulumi-lang-hcl=\"`id`\"\u003e`id`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/secretBackendKey:SecretBackendKey key pki/key/bf9b0d48-d0dd-652c-30be-77d04fc7e94d\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n" }, "keyBits": { "type": "integer", "description": "Specifies the number of bits to use for the generated keys. \nAllowed values are 0 (universal default); with `key_type=rsa`, allowed values are:\n2048 (default), 3072, or 4096; with `key_type=ec`, allowed values are: 224, 256 (default),\n384, or 521; ignored with `key_type=ed25519`.\n" }, "keyId": { "type": "string", "description": "ID of the generated key.\n" }, "keyName": { "type": "string", "description": "When a new key is created with this request, optionally specifies the name for this. \nThe global ref \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e may not be used as a name.\n" }, "keyType": { "type": "string", "description": "Specifies the desired key type; must be \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ed25519`\" pulumi-lang-dotnet=\"`Ed25519`\" pulumi-lang-go=\"`ed25519`\" pulumi-lang-python=\"`ed25519`\" pulumi-lang-yaml=\"`ed25519`\" pulumi-lang-java=\"`ed25519`\" pulumi-lang-hcl=\"`ed25519`\"\u003e`ed25519`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n" }, "managedKeyId": { "type": "string", "description": "The managed key's UUID.\n" }, "managedKeyName": { "type": "string", "description": "The managed key's configured name.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "type": { "type": "string", "description": "Specifies the type of the key to create. Can be \u003cspan pulumi-lang-nodejs=\"`exported`\" pulumi-lang-dotnet=\"`Exported`\" pulumi-lang-go=\"`exported`\" pulumi-lang-python=\"`exported`\" pulumi-lang-yaml=\"`exported`\" pulumi-lang-java=\"`exported`\" pulumi-lang-hcl=\"`exported`\"\u003e`exported`\u003c/span\u003e,\u003cspan pulumi-lang-nodejs=\"`internal`\" pulumi-lang-dotnet=\"`Internal`\" pulumi-lang-go=\"`internal`\" pulumi-lang-python=\"`internal`\" pulumi-lang-yaml=\"`internal`\" pulumi-lang-java=\"`internal`\" pulumi-lang-hcl=\"`internal`\"\u003e`internal`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e.\n" } }, "required": [ "backend", "keyBits", "keyId", "keyType", "type" ], "inputProperties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "keyBits": { "type": "integer", "description": "Specifies the number of bits to use for the generated keys. \nAllowed values are 0 (universal default); with `key_type=rsa`, allowed values are:\n2048 (default), 3072, or 4096; with `key_type=ec`, allowed values are: 224, 256 (default),\n384, or 521; ignored with `key_type=ed25519`.\n", "willReplaceOnChanges": true }, "keyName": { "type": "string", "description": "When a new key is created with this request, optionally specifies the name for this. \nThe global ref \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e may not be used as a name.\n" }, "keyType": { "type": "string", "description": "Specifies the desired key type; must be \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ed25519`\" pulumi-lang-dotnet=\"`Ed25519`\" pulumi-lang-go=\"`ed25519`\" pulumi-lang-python=\"`ed25519`\" pulumi-lang-yaml=\"`ed25519`\" pulumi-lang-java=\"`ed25519`\" pulumi-lang-hcl=\"`ed25519`\"\u003e`ed25519`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "managedKeyId": { "type": "string", "description": "The managed key's UUID.\n" }, "managedKeyName": { "type": "string", "description": "The managed key's configured name.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Specifies the type of the key to create. Can be \u003cspan pulumi-lang-nodejs=\"`exported`\" pulumi-lang-dotnet=\"`Exported`\" pulumi-lang-go=\"`exported`\" pulumi-lang-python=\"`exported`\" pulumi-lang-yaml=\"`exported`\" pulumi-lang-java=\"`exported`\" pulumi-lang-hcl=\"`exported`\"\u003e`exported`\u003c/span\u003e,\u003cspan pulumi-lang-nodejs=\"`internal`\" pulumi-lang-dotnet=\"`Internal`\" pulumi-lang-go=\"`internal`\" pulumi-lang-python=\"`internal`\" pulumi-lang-yaml=\"`internal`\" pulumi-lang-java=\"`internal`\" pulumi-lang-hcl=\"`internal`\"\u003e`internal`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendKey resources.\n", "properties": { "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "keyBits": { "type": "integer", "description": "Specifies the number of bits to use for the generated keys. \nAllowed values are 0 (universal default); with `key_type=rsa`, allowed values are:\n2048 (default), 3072, or 4096; with `key_type=ec`, allowed values are: 224, 256 (default),\n384, or 521; ignored with `key_type=ed25519`.\n", "willReplaceOnChanges": true }, "keyId": { "type": "string", "description": "ID of the generated key.\n" }, "keyName": { "type": "string", "description": "When a new key is created with this request, optionally specifies the name for this. \nThe global ref \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e may not be used as a name.\n" }, "keyType": { "type": "string", "description": "Specifies the desired key type; must be \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ed25519`\" pulumi-lang-dotnet=\"`Ed25519`\" pulumi-lang-go=\"`ed25519`\" pulumi-lang-python=\"`ed25519`\" pulumi-lang-yaml=\"`ed25519`\" pulumi-lang-java=\"`ed25519`\" pulumi-lang-hcl=\"`ed25519`\"\u003e`ed25519`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "managedKeyId": { "type": "string", "description": "The managed key's UUID.\n" }, "managedKeyName": { "type": "string", "description": "The managed key's configured name.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Specifies the type of the key to create. Can be \u003cspan pulumi-lang-nodejs=\"`exported`\" pulumi-lang-dotnet=\"`Exported`\" pulumi-lang-go=\"`exported`\" pulumi-lang-python=\"`exported`\" pulumi-lang-yaml=\"`exported`\" pulumi-lang-java=\"`exported`\" pulumi-lang-hcl=\"`exported`\"\u003e`exported`\u003c/span\u003e,\u003cspan pulumi-lang-nodejs=\"`internal`\" pulumi-lang-dotnet=\"`Internal`\" pulumi-lang-go=\"`internal`\" pulumi-lang-python=\"`internal`\" pulumi-lang-yaml=\"`internal`\" pulumi-lang-java=\"`internal`\" pulumi-lang-hcl=\"`internal`\"\u003e`internal`\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/secretBackendRole:SecretBackendRole": { "description": "Creates a role on an PKI Secret Backend for Vault.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki = new vault.Mount(\"pki\", {\n path: \"pki\",\n type: \"pki\",\n defaultLeaseTtlSeconds: 3600,\n maxLeaseTtlSeconds: 86400,\n});\nconst role = new vault.pkisecret.SecretBackendRole(\"role\", {\n backend: pki.path,\n name: \"my_role\",\n ttl: \"3600\",\n allowIpSans: true,\n keyType: \"rsa\",\n keyBits: 4096,\n allowedDomains: [\n \"example.com\",\n \"my.domain\",\n ],\n allowSubdomains: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki = vault.Mount(\"pki\",\n path=\"pki\",\n type=\"pki\",\n default_lease_ttl_seconds=3600,\n max_lease_ttl_seconds=86400)\nrole = vault.pkisecret.SecretBackendRole(\"role\",\n backend=pki.path,\n name=\"my_role\",\n ttl=\"3600\",\n allow_ip_sans=True,\n key_type=\"rsa\",\n key_bits=4096,\n allowed_domains=[\n \"example.com\",\n \"my.domain\",\n ],\n allow_subdomains=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki = new Vault.Mount(\"pki\", new()\n {\n Path = \"pki\",\n Type = \"pki\",\n DefaultLeaseTtlSeconds = 3600,\n MaxLeaseTtlSeconds = 86400,\n });\n\n var role = new Vault.PkiSecret.SecretBackendRole(\"role\", new()\n {\n Backend = pki.Path,\n Name = \"my_role\",\n Ttl = \"3600\",\n AllowIpSans = true,\n KeyType = \"rsa\",\n KeyBits = 4096,\n AllowedDomains = new[]\n {\n \"example.com\",\n \"my.domain\",\n },\n AllowSubdomains = true,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki, err := vault.NewMount(ctx, \"pki\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki\"),\n\t\t\tType: pulumi.String(\"pki\"),\n\t\t\tDefaultLeaseTtlSeconds: pulumi.Int(3600),\n\t\t\tMaxLeaseTtlSeconds: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkisecret.NewSecretBackendRole(ctx, \"role\", \u0026pkisecret.SecretBackendRoleArgs{\n\t\t\tBackend: pki.Path,\n\t\t\tName: pulumi.String(\"my_role\"),\n\t\t\tTtl: pulumi.String(\"3600\"),\n\t\t\tAllowIpSans: pulumi.Bool(true),\n\t\t\tKeyType: pulumi.String(\"rsa\"),\n\t\t\tKeyBits: pulumi.Int(4096),\n\t\t\tAllowedDomains: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"example.com\"),\n\t\t\t\tpulumi.String(\"my.domain\"),\n\t\t\t},\n\t\t\tAllowSubdomains: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_secretbackendrole\" \"role\" {\n backend = vault_mount.pki.path\n name = \"my_role\"\n ttl = 3600\n allow_ip_sans = true\n key_type = \"rsa\"\n key_bits = 4096\n allowed_domains = [\"example.com\", \"my.domain\"]\n allow_subdomains = true\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiSecret.SecretBackendRole;\nimport com.pulumi.vault.pkiSecret.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki = new Mount(\"pki\", MountArgs.builder()\n .path(\"pki\")\n .type(\"pki\")\n .defaultLeaseTtlSeconds(3600)\n .maxLeaseTtlSeconds(86400)\n .build());\n\n var role = new SecretBackendRole(\"role\", SecretBackendRoleArgs.builder()\n .backend(pki.path())\n .name(\"my_role\")\n .ttl(\"3600\")\n .allowIpSans(true)\n .keyType(\"rsa\")\n .keyBits(4096)\n .allowedDomains( \n \"example.com\",\n \"my.domain\")\n .allowSubdomains(true)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n role:\n type: vault:pkiSecret:SecretBackendRole\n properties:\n backend: ${pki.path}\n name: my_role\n ttl: 3600\n allowIpSans: true\n keyType: rsa\n keyBits: 4096\n allowedDomains:\n - example.com\n - my.domain\n allowSubdomains: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPKI secret backend roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:pkiSecret/secretBackendRole:SecretBackendRole role pki/roles/my_role\n```\n\n", "properties": { "allowAnyName": { "type": "boolean", "description": "Flag to allow any name\n" }, "allowBareDomains": { "type": "boolean", "description": "Flag to allow certificates matching the actual domain\n" }, "allowGlobDomains": { "type": "boolean", "description": "Flag to allow names containing glob patterns.\n" }, "allowIpSans": { "type": "boolean", "description": "Flag to allow IP SANs\n" }, "allowLocalhost": { "type": "boolean", "description": "Flag to allow certificates for localhost\n" }, "allowSubdomains": { "type": "boolean", "description": "Flag to allow certificates matching subdomains\n" }, "allowWildcardCertificates": { "type": "boolean", "description": "Flag to allow wildcard certificates.\n" }, "allowedDomains": { "type": "array", "items": { "type": "string" }, "description": "List of allowed domains for certificates\n" }, "allowedDomainsTemplate": { "type": "boolean", "description": "Flag, if set, \u003cspan pulumi-lang-nodejs=\"`allowedDomains`\" pulumi-lang-dotnet=\"`AllowedDomains`\" pulumi-lang-go=\"`allowedDomains`\" pulumi-lang-python=\"`allowed_domains`\" pulumi-lang-yaml=\"`allowedDomains`\" pulumi-lang-java=\"`allowedDomains`\" pulumi-lang-hcl=\"`allowed_domains`\"\u003e`allowedDomains`\u003c/span\u003e can be specified using identity template expressions such as `{{identity.entity.aliases.\u003cmount accessor\u003e.name}}`.\n" }, "allowedOtherSans": { "type": "array", "items": { "type": "string" }, "description": "Defines allowed custom SANs\n" }, "allowedSerialNumbers": { "type": "array", "items": { "type": "string" }, "description": "An array of allowed serial numbers to put in Subject\n" }, "allowedUriSans": { "type": "array", "items": { "type": "string" }, "description": "Defines allowed URI SANs\n" }, "allowedUriSansTemplate": { "type": "boolean", "description": "Flag, if set, \u003cspan pulumi-lang-nodejs=\"`allowedUriSans`\" pulumi-lang-dotnet=\"`AllowedUriSans`\" pulumi-lang-go=\"`allowedUriSans`\" pulumi-lang-python=\"`allowed_uri_sans`\" pulumi-lang-yaml=\"`allowedUriSans`\" pulumi-lang-java=\"`allowedUriSans`\" pulumi-lang-hcl=\"`allowed_uri_sans`\"\u003e`allowedUriSans`\u003c/span\u003e can be specified using identity template expressions such as `{{identity.entity.aliases.\u003cmount accessor\u003e.name}}`.\n" }, "allowedUserIds": { "type": "array", "items": { "type": "string" }, "description": "Defines allowed User IDs\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n" }, "basicConstraintsValidForNonCa": { "type": "boolean", "description": "Flag to mark basic constraints valid when issuing non-CA certificates\n" }, "clientFlag": { "type": "boolean", "description": "Flag to specify certificates for client use\n" }, "cnValidations": { "type": "array", "items": { "type": "string" }, "description": "Validations to run on the Common Name field of the certificate, choices: \u003cspan pulumi-lang-nodejs=\"`email`\" pulumi-lang-dotnet=\"`Email`\" pulumi-lang-go=\"`email`\" pulumi-lang-python=\"`email`\" pulumi-lang-yaml=\"`email`\" pulumi-lang-java=\"`email`\" pulumi-lang-hcl=\"`email`\"\u003e`email`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`hostname`\" pulumi-lang-dotnet=\"`Hostname`\" pulumi-lang-go=\"`hostname`\" pulumi-lang-python=\"`hostname`\" pulumi-lang-yaml=\"`hostname`\" pulumi-lang-java=\"`hostname`\" pulumi-lang-hcl=\"`hostname`\"\u003e`hostname`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`disabled`\" pulumi-lang-dotnet=\"`Disabled`\" pulumi-lang-go=\"`disabled`\" pulumi-lang-python=\"`disabled`\" pulumi-lang-yaml=\"`disabled`\" pulumi-lang-java=\"`disabled`\" pulumi-lang-hcl=\"`disabled`\"\u003e`disabled`\u003c/span\u003e\n" }, "codeSigningFlag": { "type": "boolean", "description": "Flag to specify certificates for code signing use\n" }, "countries": { "type": "array", "items": { "type": "string" }, "description": "The country of generated certificates\n" }, "emailProtectionFlag": { "type": "boolean", "description": "Flag to specify certificates for email protection use\n" }, "enforceHostnames": { "type": "boolean", "description": "Flag to allow only valid host names\n" }, "extKeyUsageOids": { "type": "array", "items": { "type": "string" }, "description": "Specify the allowed extended key usage OIDs constraint on issued certificates\n" }, "extKeyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specify the allowed extended key usage constraint on issued certificates\n" }, "generateLease": { "type": "boolean", "description": "Flag to generate leases with certificates\n" }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request. May\nbe the value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, a name, or an issuer ID. Use ACLs to prevent access to\nthe `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users\noverriding the role's \u003cspan pulumi-lang-nodejs=\"`issuerRef`\" pulumi-lang-dotnet=\"`IssuerRef`\" pulumi-lang-go=\"`issuerRef`\" pulumi-lang-python=\"`issuer_ref`\" pulumi-lang-yaml=\"`issuerRef`\" pulumi-lang-java=\"`issuerRef`\" pulumi-lang-hcl=\"`issuer_ref`\"\u003e`issuerRef`\u003c/span\u003e value.\n" }, "keyBits": { "type": "integer", "description": "The number of bits of generated keys\n" }, "keyType": { "type": "string", "description": "The generated key type, choices: \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ed25519`\" pulumi-lang-dotnet=\"`Ed25519`\" pulumi-lang-go=\"`ed25519`\" pulumi-lang-python=\"`ed25519`\" pulumi-lang-yaml=\"`ed25519`\" pulumi-lang-java=\"`ed25519`\" pulumi-lang-hcl=\"`ed25519`\"\u003e`ed25519`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`any`\" pulumi-lang-dotnet=\"`Any`\" pulumi-lang-go=\"`any`\" pulumi-lang-python=\"`any`\" pulumi-lang-yaml=\"`any`\" pulumi-lang-java=\"`any`\" pulumi-lang-hcl=\"`any`\"\u003e`any`\u003c/span\u003e\nDefaults to \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e\n" }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specify the allowed key usage constraint on issued\ncertificates. Defaults to `[\"DigitalSignature\", \"KeyAgreement\", \"KeyEncipherment\"])`.\nTo specify no default key usage constraints, set this to an empty list `[]`.\n" }, "localities": { "type": "array", "items": { "type": "string" }, "description": "The locality of generated certificates\n" }, "maxTtl": { "type": "string", "description": "The maximum lease TTL, in seconds, for the role.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend. Must be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "noStore": { "type": "boolean", "description": "Flag to not store certificates in the storage backend\n" }, "noStoreMetadata": { "type": "boolean", "description": "Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs\n" }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "notBeforeDuration": { "type": "string", "description": "Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.\n" }, "organizationUnit": { "type": "array", "items": { "type": "string" }, "description": "The organization unit of generated certificates\n" }, "organizations": { "type": "array", "items": { "type": "string" }, "description": "The organization of generated certificates\n" }, "policyIdentifier": { "type": "array", "items": { "$ref": "#/types/vault:pkiSecret/SecretBackendRolePolicyIdentifier:SecretBackendRolePolicyIdentifier" }, "description": "(Vault 1.11+ only) A block for specifying policy identifers. The \u003cspan pulumi-lang-nodejs=\"`policyIdentifier`\" pulumi-lang-dotnet=\"`PolicyIdentifier`\" pulumi-lang-go=\"`policyIdentifier`\" pulumi-lang-python=\"`policy_identifier`\" pulumi-lang-yaml=\"`policyIdentifier`\" pulumi-lang-java=\"`policyIdentifier`\" pulumi-lang-hcl=\"`policy_identifier`\"\u003e`policyIdentifier`\u003c/span\u003e block can be repeated, and supports the following arguments:\n" }, "policyIdentifiers": { "type": "array", "items": { "type": "string" }, "description": "Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use \u003cspan pulumi-lang-nodejs=\"`policyIdentifier`\" pulumi-lang-dotnet=\"`PolicyIdentifier`\" pulumi-lang-go=\"`policyIdentifier`\" pulumi-lang-python=\"`policy_identifier`\" pulumi-lang-yaml=\"`policyIdentifier`\" pulumi-lang-java=\"`policyIdentifier`\" pulumi-lang-hcl=\"`policy_identifier`\"\u003e`policyIdentifier`\u003c/span\u003e blocks instead\n" }, "postalCodes": { "type": "array", "items": { "type": "string" }, "description": "The postal code of generated certificates\n" }, "provinces": { "type": "array", "items": { "type": "string" }, "description": "The province of generated certificates\n" }, "requireCn": { "type": "boolean", "description": "Flag to force CN usage\n" }, "serialNumberSource": { "type": "string", "description": "Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the\u003cspan pulumi-lang-nodejs=\" serialNumber \" pulumi-lang-dotnet=\" SerialNumber \" pulumi-lang-go=\" serialNumber \" pulumi-lang-python=\" serial_number \" pulumi-lang-yaml=\" serialNumber \" pulumi-lang-java=\" serialNumber \" pulumi-lang-hcl=\" serial_number \"\u003e serialNumber \u003c/span\u003eparameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the\u003cspan pulumi-lang-nodejs=\" serialNumber \" pulumi-lang-dotnet=\" SerialNumber \" pulumi-lang-go=\" serialNumber \" pulumi-lang-python=\" serial_number \" pulumi-lang-yaml=\" serialNumber \" pulumi-lang-java=\" serialNumber \" pulumi-lang-hcl=\" serial_number \"\u003e serialNumber \u003c/span\u003eparameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.\n\nExample usage:\n\u003c!--Start PulumiCodeChooser --\u003e\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_secretbackendrole\" \"role\" {\n backend = vault_mount.pki.path\n name = \"my_role\"\n ttl = 3600\n allow_ip_sans = true\n key_type = \"rsa\"\n key_bits = 4096\n allowed_domains = [\"example.com\", \"my.domain\"]\n allow_subdomains = true\n policy_identifiers = [{\n \"oid\" = \"1.3.6.1.4.1.7.8\"\n \"notice\" = \"I am a user Notice\"\n }, {\n \"oid\" = \"1.3.6.1.4.1.32473.1.2.4\"\n \"cps\" = \"https://example.com\"\n }]\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n role:\n type: vault:pkiSecret:SecretBackendRole\n properties:\n backend: ${pki.path}\n name: my_role\n ttl: 3600\n allowIpSans: true\n keyType: rsa\n keyBits: 4096\n allowedDomains:\n - example.com\n - my.domain\n allowSubdomains: true\n policyIdentifiers:\n - oid: 1.3.6.1.4.1.7.8\n notice: I am a user Notice\n - oid: 1.3.6.1.4.1.32473.1.2.4\n cps: https://example.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n" }, "serverFlag": { "type": "boolean", "description": "Flag to specify certificates for server use\n" }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n" }, "streetAddresses": { "type": "array", "items": { "type": "string" }, "description": "The street address of generated certificates\n" }, "ttl": { "type": "string", "description": "The TTL, in seconds, for any certificate issued against this role.\n" }, "useCsrCommonName": { "type": "boolean", "description": "Flag to use the CN in the CSR\n" }, "useCsrSans": { "type": "boolean", "description": "Flag to use the SANs in the CSR\n" }, "usePss": { "type": "boolean", "description": "Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.\n" } }, "required": [ "allowedUriSansTemplate", "backend", "cnValidations", "issuerRef", "keyUsages", "maxTtl", "name", "notBeforeDuration", "serialNumberSource", "signatureBits", "ttl" ], "inputProperties": { "allowAnyName": { "type": "boolean", "description": "Flag to allow any name\n" }, "allowBareDomains": { "type": "boolean", "description": "Flag to allow certificates matching the actual domain\n" }, "allowGlobDomains": { "type": "boolean", "description": "Flag to allow names containing glob patterns.\n" }, "allowIpSans": { "type": "boolean", "description": "Flag to allow IP SANs\n" }, "allowLocalhost": { "type": "boolean", "description": "Flag to allow certificates for localhost\n" }, "allowSubdomains": { "type": "boolean", "description": "Flag to allow certificates matching subdomains\n" }, "allowWildcardCertificates": { "type": "boolean", "description": "Flag to allow wildcard certificates.\n" }, "allowedDomains": { "type": "array", "items": { "type": "string" }, "description": "List of allowed domains for certificates\n" }, "allowedDomainsTemplate": { "type": "boolean", "description": "Flag, if set, \u003cspan pulumi-lang-nodejs=\"`allowedDomains`\" pulumi-lang-dotnet=\"`AllowedDomains`\" pulumi-lang-go=\"`allowedDomains`\" pulumi-lang-python=\"`allowed_domains`\" pulumi-lang-yaml=\"`allowedDomains`\" pulumi-lang-java=\"`allowedDomains`\" pulumi-lang-hcl=\"`allowed_domains`\"\u003e`allowedDomains`\u003c/span\u003e can be specified using identity template expressions such as `{{identity.entity.aliases.\u003cmount accessor\u003e.name}}`.\n" }, "allowedOtherSans": { "type": "array", "items": { "type": "string" }, "description": "Defines allowed custom SANs\n" }, "allowedSerialNumbers": { "type": "array", "items": { "type": "string" }, "description": "An array of allowed serial numbers to put in Subject\n" }, "allowedUriSans": { "type": "array", "items": { "type": "string" }, "description": "Defines allowed URI SANs\n" }, "allowedUriSansTemplate": { "type": "boolean", "description": "Flag, if set, \u003cspan pulumi-lang-nodejs=\"`allowedUriSans`\" pulumi-lang-dotnet=\"`AllowedUriSans`\" pulumi-lang-go=\"`allowedUriSans`\" pulumi-lang-python=\"`allowed_uri_sans`\" pulumi-lang-yaml=\"`allowedUriSans`\" pulumi-lang-java=\"`allowedUriSans`\" pulumi-lang-hcl=\"`allowed_uri_sans`\"\u003e`allowedUriSans`\u003c/span\u003e can be specified using identity template expressions such as `{{identity.entity.aliases.\u003cmount accessor\u003e.name}}`.\n" }, "allowedUserIds": { "type": "array", "items": { "type": "string" }, "description": "Defines allowed User IDs\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "basicConstraintsValidForNonCa": { "type": "boolean", "description": "Flag to mark basic constraints valid when issuing non-CA certificates\n" }, "clientFlag": { "type": "boolean", "description": "Flag to specify certificates for client use\n" }, "cnValidations": { "type": "array", "items": { "type": "string" }, "description": "Validations to run on the Common Name field of the certificate, choices: \u003cspan pulumi-lang-nodejs=\"`email`\" pulumi-lang-dotnet=\"`Email`\" pulumi-lang-go=\"`email`\" pulumi-lang-python=\"`email`\" pulumi-lang-yaml=\"`email`\" pulumi-lang-java=\"`email`\" pulumi-lang-hcl=\"`email`\"\u003e`email`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`hostname`\" pulumi-lang-dotnet=\"`Hostname`\" pulumi-lang-go=\"`hostname`\" pulumi-lang-python=\"`hostname`\" pulumi-lang-yaml=\"`hostname`\" pulumi-lang-java=\"`hostname`\" pulumi-lang-hcl=\"`hostname`\"\u003e`hostname`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`disabled`\" pulumi-lang-dotnet=\"`Disabled`\" pulumi-lang-go=\"`disabled`\" pulumi-lang-python=\"`disabled`\" pulumi-lang-yaml=\"`disabled`\" pulumi-lang-java=\"`disabled`\" pulumi-lang-hcl=\"`disabled`\"\u003e`disabled`\u003c/span\u003e\n" }, "codeSigningFlag": { "type": "boolean", "description": "Flag to specify certificates for code signing use\n" }, "countries": { "type": "array", "items": { "type": "string" }, "description": "The country of generated certificates\n" }, "emailProtectionFlag": { "type": "boolean", "description": "Flag to specify certificates for email protection use\n" }, "enforceHostnames": { "type": "boolean", "description": "Flag to allow only valid host names\n" }, "extKeyUsageOids": { "type": "array", "items": { "type": "string" }, "description": "Specify the allowed extended key usage OIDs constraint on issued certificates\n" }, "extKeyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specify the allowed extended key usage constraint on issued certificates\n" }, "generateLease": { "type": "boolean", "description": "Flag to generate leases with certificates\n" }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request. May\nbe the value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, a name, or an issuer ID. Use ACLs to prevent access to\nthe `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users\noverriding the role's \u003cspan pulumi-lang-nodejs=\"`issuerRef`\" pulumi-lang-dotnet=\"`IssuerRef`\" pulumi-lang-go=\"`issuerRef`\" pulumi-lang-python=\"`issuer_ref`\" pulumi-lang-yaml=\"`issuerRef`\" pulumi-lang-java=\"`issuerRef`\" pulumi-lang-hcl=\"`issuer_ref`\"\u003e`issuerRef`\u003c/span\u003e value.\n" }, "keyBits": { "type": "integer", "description": "The number of bits of generated keys\n" }, "keyType": { "type": "string", "description": "The generated key type, choices: \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ed25519`\" pulumi-lang-dotnet=\"`Ed25519`\" pulumi-lang-go=\"`ed25519`\" pulumi-lang-python=\"`ed25519`\" pulumi-lang-yaml=\"`ed25519`\" pulumi-lang-java=\"`ed25519`\" pulumi-lang-hcl=\"`ed25519`\"\u003e`ed25519`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`any`\" pulumi-lang-dotnet=\"`Any`\" pulumi-lang-go=\"`any`\" pulumi-lang-python=\"`any`\" pulumi-lang-yaml=\"`any`\" pulumi-lang-java=\"`any`\" pulumi-lang-hcl=\"`any`\"\u003e`any`\u003c/span\u003e\nDefaults to \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e\n" }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specify the allowed key usage constraint on issued\ncertificates. Defaults to `[\"DigitalSignature\", \"KeyAgreement\", \"KeyEncipherment\"])`.\nTo specify no default key usage constraints, set this to an empty list `[]`.\n" }, "localities": { "type": "array", "items": { "type": "string" }, "description": "The locality of generated certificates\n" }, "maxTtl": { "type": "string", "description": "The maximum lease TTL, in seconds, for the role.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend. Must be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "noStore": { "type": "boolean", "description": "Flag to not store certificates in the storage backend\n" }, "noStoreMetadata": { "type": "boolean", "description": "Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs\n" }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "notBeforeDuration": { "type": "string", "description": "Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.\n" }, "organizationUnit": { "type": "array", "items": { "type": "string" }, "description": "The organization unit of generated certificates\n" }, "organizations": { "type": "array", "items": { "type": "string" }, "description": "The organization of generated certificates\n" }, "policyIdentifier": { "type": "array", "items": { "$ref": "#/types/vault:pkiSecret/SecretBackendRolePolicyIdentifier:SecretBackendRolePolicyIdentifier" }, "description": "(Vault 1.11+ only) A block for specifying policy identifers. The \u003cspan pulumi-lang-nodejs=\"`policyIdentifier`\" pulumi-lang-dotnet=\"`PolicyIdentifier`\" pulumi-lang-go=\"`policyIdentifier`\" pulumi-lang-python=\"`policy_identifier`\" pulumi-lang-yaml=\"`policyIdentifier`\" pulumi-lang-java=\"`policyIdentifier`\" pulumi-lang-hcl=\"`policy_identifier`\"\u003e`policyIdentifier`\u003c/span\u003e block can be repeated, and supports the following arguments:\n" }, "policyIdentifiers": { "type": "array", "items": { "type": "string" }, "description": "Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use \u003cspan pulumi-lang-nodejs=\"`policyIdentifier`\" pulumi-lang-dotnet=\"`PolicyIdentifier`\" pulumi-lang-go=\"`policyIdentifier`\" pulumi-lang-python=\"`policy_identifier`\" pulumi-lang-yaml=\"`policyIdentifier`\" pulumi-lang-java=\"`policyIdentifier`\" pulumi-lang-hcl=\"`policy_identifier`\"\u003e`policyIdentifier`\u003c/span\u003e blocks instead\n" }, "postalCodes": { "type": "array", "items": { "type": "string" }, "description": "The postal code of generated certificates\n" }, "provinces": { "type": "array", "items": { "type": "string" }, "description": "The province of generated certificates\n" }, "requireCn": { "type": "boolean", "description": "Flag to force CN usage\n" }, "serialNumberSource": { "type": "string", "description": "Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the\u003cspan pulumi-lang-nodejs=\" serialNumber \" pulumi-lang-dotnet=\" SerialNumber \" pulumi-lang-go=\" serialNumber \" pulumi-lang-python=\" serial_number \" pulumi-lang-yaml=\" serialNumber \" pulumi-lang-java=\" serialNumber \" pulumi-lang-hcl=\" serial_number \"\u003e serialNumber \u003c/span\u003eparameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the\u003cspan pulumi-lang-nodejs=\" serialNumber \" pulumi-lang-dotnet=\" SerialNumber \" pulumi-lang-go=\" serialNumber \" pulumi-lang-python=\" serial_number \" pulumi-lang-yaml=\" serialNumber \" pulumi-lang-java=\" serialNumber \" pulumi-lang-hcl=\" serial_number \"\u003e serialNumber \u003c/span\u003eparameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.\n\nExample usage:\n\u003c!--Start PulumiCodeChooser --\u003e\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_secretbackendrole\" \"role\" {\n backend = vault_mount.pki.path\n name = \"my_role\"\n ttl = 3600\n allow_ip_sans = true\n key_type = \"rsa\"\n key_bits = 4096\n allowed_domains = [\"example.com\", \"my.domain\"]\n allow_subdomains = true\n policy_identifiers = [{\n \"oid\" = \"1.3.6.1.4.1.7.8\"\n \"notice\" = \"I am a user Notice\"\n }, {\n \"oid\" = \"1.3.6.1.4.1.32473.1.2.4\"\n \"cps\" = \"https://example.com\"\n }]\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n role:\n type: vault:pkiSecret:SecretBackendRole\n properties:\n backend: ${pki.path}\n name: my_role\n ttl: 3600\n allowIpSans: true\n keyType: rsa\n keyBits: 4096\n allowedDomains:\n - example.com\n - my.domain\n allowSubdomains: true\n policyIdentifiers:\n - oid: 1.3.6.1.4.1.7.8\n notice: I am a user Notice\n - oid: 1.3.6.1.4.1.32473.1.2.4\n cps: https://example.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n" }, "serverFlag": { "type": "boolean", "description": "Flag to specify certificates for server use\n" }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n" }, "streetAddresses": { "type": "array", "items": { "type": "string" }, "description": "The street address of generated certificates\n" }, "ttl": { "type": "string", "description": "The TTL, in seconds, for any certificate issued against this role.\n" }, "useCsrCommonName": { "type": "boolean", "description": "Flag to use the CN in the CSR\n" }, "useCsrSans": { "type": "boolean", "description": "Flag to use the SANs in the CSR\n" }, "usePss": { "type": "boolean", "description": "Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.\n" } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRole resources.\n", "properties": { "allowAnyName": { "type": "boolean", "description": "Flag to allow any name\n" }, "allowBareDomains": { "type": "boolean", "description": "Flag to allow certificates matching the actual domain\n" }, "allowGlobDomains": { "type": "boolean", "description": "Flag to allow names containing glob patterns.\n" }, "allowIpSans": { "type": "boolean", "description": "Flag to allow IP SANs\n" }, "allowLocalhost": { "type": "boolean", "description": "Flag to allow certificates for localhost\n" }, "allowSubdomains": { "type": "boolean", "description": "Flag to allow certificates matching subdomains\n" }, "allowWildcardCertificates": { "type": "boolean", "description": "Flag to allow wildcard certificates.\n" }, "allowedDomains": { "type": "array", "items": { "type": "string" }, "description": "List of allowed domains for certificates\n" }, "allowedDomainsTemplate": { "type": "boolean", "description": "Flag, if set, \u003cspan pulumi-lang-nodejs=\"`allowedDomains`\" pulumi-lang-dotnet=\"`AllowedDomains`\" pulumi-lang-go=\"`allowedDomains`\" pulumi-lang-python=\"`allowed_domains`\" pulumi-lang-yaml=\"`allowedDomains`\" pulumi-lang-java=\"`allowedDomains`\" pulumi-lang-hcl=\"`allowed_domains`\"\u003e`allowedDomains`\u003c/span\u003e can be specified using identity template expressions such as `{{identity.entity.aliases.\u003cmount accessor\u003e.name}}`.\n" }, "allowedOtherSans": { "type": "array", "items": { "type": "string" }, "description": "Defines allowed custom SANs\n" }, "allowedSerialNumbers": { "type": "array", "items": { "type": "string" }, "description": "An array of allowed serial numbers to put in Subject\n" }, "allowedUriSans": { "type": "array", "items": { "type": "string" }, "description": "Defines allowed URI SANs\n" }, "allowedUriSansTemplate": { "type": "boolean", "description": "Flag, if set, \u003cspan pulumi-lang-nodejs=\"`allowedUriSans`\" pulumi-lang-dotnet=\"`AllowedUriSans`\" pulumi-lang-go=\"`allowedUriSans`\" pulumi-lang-python=\"`allowed_uri_sans`\" pulumi-lang-yaml=\"`allowedUriSans`\" pulumi-lang-java=\"`allowedUriSans`\" pulumi-lang-hcl=\"`allowed_uri_sans`\"\u003e`allowedUriSans`\u003c/span\u003e can be specified using identity template expressions such as `{{identity.entity.aliases.\u003cmount accessor\u003e.name}}`.\n" }, "allowedUserIds": { "type": "array", "items": { "type": "string" }, "description": "Defines allowed User IDs\n" }, "backend": { "type": "string", "description": "The path the PKI secret backend is mounted at, with no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "basicConstraintsValidForNonCa": { "type": "boolean", "description": "Flag to mark basic constraints valid when issuing non-CA certificates\n" }, "clientFlag": { "type": "boolean", "description": "Flag to specify certificates for client use\n" }, "cnValidations": { "type": "array", "items": { "type": "string" }, "description": "Validations to run on the Common Name field of the certificate, choices: \u003cspan pulumi-lang-nodejs=\"`email`\" pulumi-lang-dotnet=\"`Email`\" pulumi-lang-go=\"`email`\" pulumi-lang-python=\"`email`\" pulumi-lang-yaml=\"`email`\" pulumi-lang-java=\"`email`\" pulumi-lang-hcl=\"`email`\"\u003e`email`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`hostname`\" pulumi-lang-dotnet=\"`Hostname`\" pulumi-lang-go=\"`hostname`\" pulumi-lang-python=\"`hostname`\" pulumi-lang-yaml=\"`hostname`\" pulumi-lang-java=\"`hostname`\" pulumi-lang-hcl=\"`hostname`\"\u003e`hostname`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`disabled`\" pulumi-lang-dotnet=\"`Disabled`\" pulumi-lang-go=\"`disabled`\" pulumi-lang-python=\"`disabled`\" pulumi-lang-yaml=\"`disabled`\" pulumi-lang-java=\"`disabled`\" pulumi-lang-hcl=\"`disabled`\"\u003e`disabled`\u003c/span\u003e\n" }, "codeSigningFlag": { "type": "boolean", "description": "Flag to specify certificates for code signing use\n" }, "countries": { "type": "array", "items": { "type": "string" }, "description": "The country of generated certificates\n" }, "emailProtectionFlag": { "type": "boolean", "description": "Flag to specify certificates for email protection use\n" }, "enforceHostnames": { "type": "boolean", "description": "Flag to allow only valid host names\n" }, "extKeyUsageOids": { "type": "array", "items": { "type": "string" }, "description": "Specify the allowed extended key usage OIDs constraint on issued certificates\n" }, "extKeyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specify the allowed extended key usage constraint on issued certificates\n" }, "generateLease": { "type": "boolean", "description": "Flag to generate leases with certificates\n" }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request. May\nbe the value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, a name, or an issuer ID. Use ACLs to prevent access to\nthe `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users\noverriding the role's \u003cspan pulumi-lang-nodejs=\"`issuerRef`\" pulumi-lang-dotnet=\"`IssuerRef`\" pulumi-lang-go=\"`issuerRef`\" pulumi-lang-python=\"`issuer_ref`\" pulumi-lang-yaml=\"`issuerRef`\" pulumi-lang-java=\"`issuerRef`\" pulumi-lang-hcl=\"`issuer_ref`\"\u003e`issuerRef`\u003c/span\u003e value.\n" }, "keyBits": { "type": "integer", "description": "The number of bits of generated keys\n" }, "keyType": { "type": "string", "description": "The generated key type, choices: \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ec`\" pulumi-lang-dotnet=\"`Ec`\" pulumi-lang-go=\"`ec`\" pulumi-lang-python=\"`ec`\" pulumi-lang-yaml=\"`ec`\" pulumi-lang-java=\"`ec`\" pulumi-lang-hcl=\"`ec`\"\u003e`ec`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`ed25519`\" pulumi-lang-dotnet=\"`Ed25519`\" pulumi-lang-go=\"`ed25519`\" pulumi-lang-python=\"`ed25519`\" pulumi-lang-yaml=\"`ed25519`\" pulumi-lang-java=\"`ed25519`\" pulumi-lang-hcl=\"`ed25519`\"\u003e`ed25519`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`any`\" pulumi-lang-dotnet=\"`Any`\" pulumi-lang-go=\"`any`\" pulumi-lang-python=\"`any`\" pulumi-lang-yaml=\"`any`\" pulumi-lang-java=\"`any`\" pulumi-lang-hcl=\"`any`\"\u003e`any`\u003c/span\u003e\nDefaults to \u003cspan pulumi-lang-nodejs=\"`rsa`\" pulumi-lang-dotnet=\"`Rsa`\" pulumi-lang-go=\"`rsa`\" pulumi-lang-python=\"`rsa`\" pulumi-lang-yaml=\"`rsa`\" pulumi-lang-java=\"`rsa`\" pulumi-lang-hcl=\"`rsa`\"\u003e`rsa`\u003c/span\u003e\n" }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specify the allowed key usage constraint on issued\ncertificates. Defaults to `[\"DigitalSignature\", \"KeyAgreement\", \"KeyEncipherment\"])`.\nTo specify no default key usage constraints, set this to an empty list `[]`.\n" }, "localities": { "type": "array", "items": { "type": "string" }, "description": "The locality of generated certificates\n" }, "maxTtl": { "type": "string", "description": "The maximum lease TTL, in seconds, for the role.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend. Must be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "noStore": { "type": "boolean", "description": "Flag to not store certificates in the storage backend\n" }, "noStoreMetadata": { "type": "boolean", "description": "Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs\n" }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "notBeforeDuration": { "type": "string", "description": "Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.\n" }, "organizationUnit": { "type": "array", "items": { "type": "string" }, "description": "The organization unit of generated certificates\n" }, "organizations": { "type": "array", "items": { "type": "string" }, "description": "The organization of generated certificates\n" }, "policyIdentifier": { "type": "array", "items": { "$ref": "#/types/vault:pkiSecret/SecretBackendRolePolicyIdentifier:SecretBackendRolePolicyIdentifier" }, "description": "(Vault 1.11+ only) A block for specifying policy identifers. The \u003cspan pulumi-lang-nodejs=\"`policyIdentifier`\" pulumi-lang-dotnet=\"`PolicyIdentifier`\" pulumi-lang-go=\"`policyIdentifier`\" pulumi-lang-python=\"`policy_identifier`\" pulumi-lang-yaml=\"`policyIdentifier`\" pulumi-lang-java=\"`policyIdentifier`\" pulumi-lang-hcl=\"`policy_identifier`\"\u003e`policyIdentifier`\u003c/span\u003e block can be repeated, and supports the following arguments:\n" }, "policyIdentifiers": { "type": "array", "items": { "type": "string" }, "description": "Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use \u003cspan pulumi-lang-nodejs=\"`policyIdentifier`\" pulumi-lang-dotnet=\"`PolicyIdentifier`\" pulumi-lang-go=\"`policyIdentifier`\" pulumi-lang-python=\"`policy_identifier`\" pulumi-lang-yaml=\"`policyIdentifier`\" pulumi-lang-java=\"`policyIdentifier`\" pulumi-lang-hcl=\"`policy_identifier`\"\u003e`policyIdentifier`\u003c/span\u003e blocks instead\n" }, "postalCodes": { "type": "array", "items": { "type": "string" }, "description": "The postal code of generated certificates\n" }, "provinces": { "type": "array", "items": { "type": "string" }, "description": "The province of generated certificates\n" }, "requireCn": { "type": "boolean", "description": "Flag to force CN usage\n" }, "serialNumberSource": { "type": "string", "description": "Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the\u003cspan pulumi-lang-nodejs=\" serialNumber \" pulumi-lang-dotnet=\" SerialNumber \" pulumi-lang-go=\" serialNumber \" pulumi-lang-python=\" serial_number \" pulumi-lang-yaml=\" serialNumber \" pulumi-lang-java=\" serialNumber \" pulumi-lang-hcl=\" serial_number \"\u003e serialNumber \u003c/span\u003eparameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the\u003cspan pulumi-lang-nodejs=\" serialNumber \" pulumi-lang-dotnet=\" SerialNumber \" pulumi-lang-go=\" serialNumber \" pulumi-lang-python=\" serial_number \" pulumi-lang-yaml=\" serialNumber \" pulumi-lang-java=\" serialNumber \" pulumi-lang-hcl=\" serial_number \"\u003e serialNumber \u003c/span\u003eparameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.\n\nExample usage:\n\u003c!--Start PulumiCodeChooser --\u003e\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki\" {\n path = \"pki\"\n type = \"pki\"\n default_lease_ttl_seconds = 3600\n max_lease_ttl_seconds = 86400\n}\nresource \"vault_pkisecret_secretbackendrole\" \"role\" {\n backend = vault_mount.pki.path\n name = \"my_role\"\n ttl = 3600\n allow_ip_sans = true\n key_type = \"rsa\"\n key_bits = 4096\n allowed_domains = [\"example.com\", \"my.domain\"]\n allow_subdomains = true\n policy_identifiers = [{\n \"oid\" = \"1.3.6.1.4.1.7.8\"\n \"notice\" = \"I am a user Notice\"\n }, {\n \"oid\" = \"1.3.6.1.4.1.32473.1.2.4\"\n \"cps\" = \"https://example.com\"\n }]\n}\n```\n```yaml\nresources:\n pki:\n type: vault:Mount\n properties:\n path: pki\n type: pki\n defaultLeaseTtlSeconds: 3600\n maxLeaseTtlSeconds: 86400\n role:\n type: vault:pkiSecret:SecretBackendRole\n properties:\n backend: ${pki.path}\n name: my_role\n ttl: 3600\n allowIpSans: true\n keyType: rsa\n keyBits: 4096\n allowedDomains:\n - example.com\n - my.domain\n allowSubdomains: true\n policyIdentifiers:\n - oid: 1.3.6.1.4.1.7.8\n notice: I am a user Notice\n - oid: 1.3.6.1.4.1.32473.1.2.4\n cps: https://example.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n" }, "serverFlag": { "type": "boolean", "description": "Flag to specify certificates for server use\n" }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n" }, "streetAddresses": { "type": "array", "items": { "type": "string" }, "description": "The street address of generated certificates\n" }, "ttl": { "type": "string", "description": "The TTL, in seconds, for any certificate issued against this role.\n" }, "useCsrCommonName": { "type": "boolean", "description": "Flag to use the CN in the CSR\n" }, "useCsrSans": { "type": "boolean", "description": "Flag to use the SANs in the CSR\n" }, "usePss": { "type": "boolean", "description": "Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.\n" } }, "type": "object" } }, "vault:pkiSecret/secretBackendRootCert:SecretBackendRootCert": { "description": "Generates a new self-signed CA certificate and private keys for the PKI Secret Backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n\u003e **Important** Multi-Issuer Functionality is enabled on this version\nof the Provider. If migrating from an older version of Vault or the Provider,\nplease refer to the PKI Multi-Issuer Upgrade Guide\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.pkisecret.SecretBackendRootCert(\"test\", {\n backend: pki.path,\n type: \"internal\",\n commonName: \"Root CA\",\n ttl: \"315360000\",\n format: \"pem\",\n privateKeyFormat: \"der\",\n keyType: \"rsa\",\n keyBits: 4096,\n excludeCnFromSans: true,\n ou: \"My OU\",\n organization: \"My organization\",\n}, {\n dependsOn: [pki],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.pkisecret.SecretBackendRootCert(\"test\",\n backend=pki[\"path\"],\n type=\"internal\",\n common_name=\"Root CA\",\n ttl=\"315360000\",\n format=\"pem\",\n private_key_format=\"der\",\n key_type=\"rsa\",\n key_bits=4096,\n exclude_cn_from_sans=True,\n ou=\"My OU\",\n organization=\"My organization\",\n opts = pulumi.ResourceOptions(depends_on=[pki]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.PkiSecret.SecretBackendRootCert(\"test\", new()\n {\n Backend = pki.Path,\n Type = \"internal\",\n CommonName = \"Root CA\",\n Ttl = \"315360000\",\n Format = \"pem\",\n PrivateKeyFormat = \"der\",\n KeyType = \"rsa\",\n KeyBits = 4096,\n ExcludeCnFromSans = true,\n Ou = \"My OU\",\n Organization = \"My organization\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n pki,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := pkisecret.NewSecretBackendRootCert(ctx, \"test\", \u0026pkisecret.SecretBackendRootCertArgs{\n\t\t\tBackend: pulumi.Any(pki.Path),\n\t\t\tType: pulumi.String(\"internal\"),\n\t\t\tCommonName: pulumi.String(\"Root CA\"),\n\t\t\tTtl: pulumi.String(\"315360000\"),\n\t\t\tFormat: pulumi.String(\"pem\"),\n\t\t\tPrivateKeyFormat: pulumi.String(\"der\"),\n\t\t\tKeyType: pulumi.String(\"rsa\"),\n\t\t\tKeyBits: pulumi.Int(4096),\n\t\t\tExcludeCnFromSans: pulumi.Bool(true),\n\t\t\tOu: pulumi.String(\"My OU\"),\n\t\t\tOrganization: pulumi.String(\"My organization\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tpki,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pkisecret_secretbackendrootcert\" \"test\" {\n depends_on = [pki]\n backend = pki.path\n type = \"internal\"\n common_name = \"Root CA\"\n ttl = \"315360000\"\n format = \"pem\"\n private_key_format = \"der\"\n key_type = \"rsa\"\n key_bits = 4096\n exclude_cn_from_sans = true\n ou = \"My OU\"\n organization = \"My organization\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootCert;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootCertArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new SecretBackendRootCert(\"test\", SecretBackendRootCertArgs.builder()\n .backend(pki.path())\n .type(\"internal\")\n .commonName(\"Root CA\")\n .ttl(\"315360000\")\n .format(\"pem\")\n .privateKeyFormat(\"der\")\n .keyType(\"rsa\")\n .keyBits(4096)\n .excludeCnFromSans(true)\n .ou(\"My OU\")\n .organization(\"My organization\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(pki)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:pkiSecret:SecretBackendRootCert\n properties:\n backend: ${pki.path}\n type: internal\n commonName: Root CA\n ttl: '315360000'\n format: pem\n privateKeyFormat: der\n keyType: rsa\n keyBits: 4096\n excludeCnFromSans: true\n ou: My OU\n organization: My organization\n options:\n dependsOn:\n - ${pki}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n" }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n" }, "certificate": { "type": "string", "description": "The certificate.\n" }, "commonName": { "type": "string", "description": "CN of intermediate to create\n" }, "country": { "type": "string", "description": "The country\n" }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n" }, "excludedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n" }, "excludedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n" }, "excludedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n" }, "excludedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n" }, "format": { "type": "string", "description": "The format of data. Valid values are \"pem\", \u003cspan pulumi-lang-nodejs=\"\"pemBundle\"\" pulumi-lang-dotnet=\"\"PemBundle\"\" pulumi-lang-go=\"\"pemBundle\"\" pulumi-lang-python=\"\"pem_bundle\"\" pulumi-lang-yaml=\"\"pemBundle\"\" pulumi-lang-java=\"\"pemBundle\"\" pulumi-lang-hcl=\"\"pem_bundle\"\"\u003e\"pemBundle\"\u003c/span\u003e, \"der\", \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. Values \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e require Vault 2.0.5+.\n" }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n" }, "issuerId": { "type": "string", "description": "The ID of the generated issuer.\n" }, "issuerName": { "type": "string", "description": "Provides a name to the specified issuer. The name must be unique\nacross all issuers and not be the reserved value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e\n" }, "issuingCa": { "type": "string", "description": "The issuing CA certificate.\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n" }, "jksPrivateKeyAlias": { "type": "string", "description": "The entry alias in the Java keystore (JKS) when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e and bundle contains a single PrivateKeyEntry. This field is case-sensitive, but relying on case-only differences for unique aliases is not recommended. Defaults to \"1\". This parameter is ignored by endpoints that return TrustedCertificateEntry values (JKS trust stores), and entry aliases are assigned incrementing numeric strings starting at \"1\". Requires Vault 2.0.5+.\n" }, "keyBits": { "type": "integer", "description": "The number of bits to use\n" }, "keyId": { "type": "string", "description": "The ID of the generated key.\n" }, "keyName": { "type": "string", "description": "When a new key is created with this request, optionally specifies\nthe name for this. The global ref \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e may not be used as a name.\n" }, "keyRef": { "type": "string", "description": "Specifies the key (either default, by name, or by identifier) to use\nfor generating this request. Only suitable for `type=existing` requests.\n" }, "keyType": { "type": "string", "description": "The desired key type\n" }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specifies the allowed key usage constraints for the certificate. This list of key usages will be added to the existing set of key usages (`CRLSign`, `CertSign`) on the generated certificate. Defaults to `[\"CRLSign\", \"CertSign\"]` for root CA certificates. Requires Vault 1.19.2+.\n" }, "locality": { "type": "string", "description": "The locality\n" }, "managedKeyId": { "type": "string", "description": "The ID of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyName`\" pulumi-lang-dotnet=\"`ManagedKeyName`\" pulumi-lang-go=\"`managedKeyName`\" pulumi-lang-python=\"`managed_key_name`\" pulumi-lang-yaml=\"`managedKeyName`\" pulumi-lang-java=\"`managedKeyName`\" pulumi-lang-hcl=\"`managed_key_name`\"\u003e`managedKeyName`\u003c/span\u003e\n" }, "managedKeyName": { "type": "string", "description": "The name of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyId`\" pulumi-lang-dotnet=\"`ManagedKeyId`\" pulumi-lang-go=\"`managedKeyId`\" pulumi-lang-python=\"`managed_key_id`\" pulumi-lang-yaml=\"`managedKeyId`\" pulumi-lang-java=\"`managedKeyId`\" pulumi-lang-hcl=\"`managed_key_id`\"\u003e`managedKeyId`\u003c/span\u003e\n" }, "maxPathLength": { "type": "integer", "description": "The maximum path length to encode in the generated certificate\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "notBeforeDuration": { "type": "string", "description": "Specifies the duration by which to backdate the NotBefore property.\n" }, "organization": { "type": "string", "description": "The organization\n" }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n" }, "ou": { "type": "string", "description": "The organization unit\n" }, "permittedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are allowed to be issued\n" }, "permittedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are allowed to be issued. Requires Vault version 1.19+.\n" }, "permittedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are allowed to be issued. Requires Vault version 1.19+.\n" }, "permittedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are allowed to be issued. Requires Vault version 1.19+.\n" }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n" }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n" }, "postalCode": { "type": "string", "description": "The postal code\n" }, "privateKeyFormat": { "type": "string", "description": "The private key format\n" }, "province": { "type": "string", "description": "The province\n" }, "serialNumber": { "type": "string", "description": "The certificate's serial number, hex formatted.\n" }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n" }, "streetAddress": { "type": "string", "description": "The street address\n" }, "ttl": { "type": "string", "description": "Time to live\n" }, "type": { "type": "string", "description": "Type of intermediate to create. Must be either \\\"exported\\\", \\\"internal\\\"\nor \\\"kms\\\"\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n" }, "usePss": { "type": "boolean", "description": "When \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, uses PSS (Probabilistic Signature Scheme) for RSA signatures instead of PKCS#1 v1.5. PSS provides enhanced security but may have compatibility issues with older systems. Only applicable to RSA keys; ignored for ECDSA/Ed25519 keys. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 1.18.0+.\n" } }, "required": [ "backend", "certificate", "commonName", "issuerId", "issuerName", "issuingCa", "keyId", "keyName", "keyRef", "managedKeyId", "managedKeyName", "serialNumber", "signatureBits", "type" ], "inputProperties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "commonName": { "type": "string", "description": "CN of intermediate to create\n", "willReplaceOnChanges": true }, "country": { "type": "string", "description": "The country\n", "willReplaceOnChanges": true }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "excludedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "format": { "type": "string", "description": "The format of data. Valid values are \"pem\", \u003cspan pulumi-lang-nodejs=\"\"pemBundle\"\" pulumi-lang-dotnet=\"\"PemBundle\"\" pulumi-lang-go=\"\"pemBundle\"\" pulumi-lang-python=\"\"pem_bundle\"\" pulumi-lang-yaml=\"\"pemBundle\"\" pulumi-lang-java=\"\"pemBundle\"\" pulumi-lang-hcl=\"\"pem_bundle\"\"\u003e\"pemBundle\"\u003c/span\u003e, \"der\", \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. Values \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e require Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "issuerName": { "type": "string", "description": "Provides a name to the specified issuer. The name must be unique\nacross all issuers and not be the reserved value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "jksPrivateKeyAlias": { "type": "string", "description": "The entry alias in the Java keystore (JKS) when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e and bundle contains a single PrivateKeyEntry. This field is case-sensitive, but relying on case-only differences for unique aliases is not recommended. Defaults to \"1\". This parameter is ignored by endpoints that return TrustedCertificateEntry values (JKS trust stores), and entry aliases are assigned incrementing numeric strings starting at \"1\". Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "keyBits": { "type": "integer", "description": "The number of bits to use\n", "willReplaceOnChanges": true }, "keyName": { "type": "string", "description": "When a new key is created with this request, optionally specifies\nthe name for this. The global ref \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e may not be used as a name.\n", "willReplaceOnChanges": true }, "keyRef": { "type": "string", "description": "Specifies the key (either default, by name, or by identifier) to use\nfor generating this request. Only suitable for `type=existing` requests.\n", "willReplaceOnChanges": true }, "keyType": { "type": "string", "description": "The desired key type\n", "willReplaceOnChanges": true }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specifies the allowed key usage constraints for the certificate. This list of key usages will be added to the existing set of key usages (`CRLSign`, `CertSign`) on the generated certificate. Defaults to `[\"CRLSign\", \"CertSign\"]` for root CA certificates. Requires Vault 1.19.2+.\n", "willReplaceOnChanges": true }, "locality": { "type": "string", "description": "The locality\n", "willReplaceOnChanges": true }, "managedKeyId": { "type": "string", "description": "The ID of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyName`\" pulumi-lang-dotnet=\"`ManagedKeyName`\" pulumi-lang-go=\"`managedKeyName`\" pulumi-lang-python=\"`managed_key_name`\" pulumi-lang-yaml=\"`managedKeyName`\" pulumi-lang-java=\"`managedKeyName`\" pulumi-lang-hcl=\"`managed_key_name`\"\u003e`managedKeyName`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "managedKeyName": { "type": "string", "description": "The name of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyId`\" pulumi-lang-dotnet=\"`ManagedKeyId`\" pulumi-lang-go=\"`managedKeyId`\" pulumi-lang-python=\"`managed_key_id`\" pulumi-lang-yaml=\"`managedKeyId`\" pulumi-lang-java=\"`managedKeyId`\" pulumi-lang-hcl=\"`managed_key_id`\"\u003e`managedKeyId`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "maxPathLength": { "type": "integer", "description": "The maximum path length to encode in the generated certificate\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "notBeforeDuration": { "type": "string", "description": "Specifies the duration by which to backdate the NotBefore property.\n", "willReplaceOnChanges": true }, "organization": { "type": "string", "description": "The organization\n", "willReplaceOnChanges": true }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "ou": { "type": "string", "description": "The organization unit\n", "willReplaceOnChanges": true }, "permittedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are allowed to be issued\n", "willReplaceOnChanges": true }, "permittedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "permittedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "permittedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "postalCode": { "type": "string", "description": "The postal code\n", "willReplaceOnChanges": true }, "privateKeyFormat": { "type": "string", "description": "The private key format\n", "willReplaceOnChanges": true }, "province": { "type": "string", "description": "The province\n", "willReplaceOnChanges": true }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n" }, "streetAddress": { "type": "string", "description": "The street address\n", "willReplaceOnChanges": true }, "ttl": { "type": "string", "description": "Time to live\n" }, "type": { "type": "string", "description": "Type of intermediate to create. Must be either \\\"exported\\\", \\\"internal\\\"\nor \\\"kms\\\"\n", "willReplaceOnChanges": true }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true }, "usePss": { "type": "boolean", "description": "When \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, uses PSS (Probabilistic Signature Scheme) for RSA signatures instead of PKCS#1 v1.5. PSS provides enhanced security but may have compatibility issues with older systems. Only applicable to RSA keys; ignored for ECDSA/Ed25519 keys. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 1.18.0+.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "commonName", "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRootCert resources.\n", "properties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "certificate": { "type": "string", "description": "The certificate.\n" }, "commonName": { "type": "string", "description": "CN of intermediate to create\n", "willReplaceOnChanges": true }, "country": { "type": "string", "description": "The country\n", "willReplaceOnChanges": true }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "excludedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "format": { "type": "string", "description": "The format of data. Valid values are \"pem\", \u003cspan pulumi-lang-nodejs=\"\"pemBundle\"\" pulumi-lang-dotnet=\"\"PemBundle\"\" pulumi-lang-go=\"\"pemBundle\"\" pulumi-lang-python=\"\"pem_bundle\"\" pulumi-lang-yaml=\"\"pemBundle\"\" pulumi-lang-java=\"\"pemBundle\"\" pulumi-lang-hcl=\"\"pem_bundle\"\"\u003e\"pemBundle\"\u003c/span\u003e, \"der\", \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. Values \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e require Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "issuerId": { "type": "string", "description": "The ID of the generated issuer.\n", "willReplaceOnChanges": true }, "issuerName": { "type": "string", "description": "Provides a name to the specified issuer. The name must be unique\nacross all issuers and not be the reserved value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "issuingCa": { "type": "string", "description": "The issuing CA certificate.\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "jksPrivateKeyAlias": { "type": "string", "description": "The entry alias in the Java keystore (JKS) when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e and bundle contains a single PrivateKeyEntry. This field is case-sensitive, but relying on case-only differences for unique aliases is not recommended. Defaults to \"1\". This parameter is ignored by endpoints that return TrustedCertificateEntry values (JKS trust stores), and entry aliases are assigned incrementing numeric strings starting at \"1\". Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "keyBits": { "type": "integer", "description": "The number of bits to use\n", "willReplaceOnChanges": true }, "keyId": { "type": "string", "description": "The ID of the generated key.\n", "willReplaceOnChanges": true }, "keyName": { "type": "string", "description": "When a new key is created with this request, optionally specifies\nthe name for this. The global ref \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e may not be used as a name.\n", "willReplaceOnChanges": true }, "keyRef": { "type": "string", "description": "Specifies the key (either default, by name, or by identifier) to use\nfor generating this request. Only suitable for `type=existing` requests.\n", "willReplaceOnChanges": true }, "keyType": { "type": "string", "description": "The desired key type\n", "willReplaceOnChanges": true }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specifies the allowed key usage constraints for the certificate. This list of key usages will be added to the existing set of key usages (`CRLSign`, `CertSign`) on the generated certificate. Defaults to `[\"CRLSign\", \"CertSign\"]` for root CA certificates. Requires Vault 1.19.2+.\n", "willReplaceOnChanges": true }, "locality": { "type": "string", "description": "The locality\n", "willReplaceOnChanges": true }, "managedKeyId": { "type": "string", "description": "The ID of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyName`\" pulumi-lang-dotnet=\"`ManagedKeyName`\" pulumi-lang-go=\"`managedKeyName`\" pulumi-lang-python=\"`managed_key_name`\" pulumi-lang-yaml=\"`managedKeyName`\" pulumi-lang-java=\"`managedKeyName`\" pulumi-lang-hcl=\"`managed_key_name`\"\u003e`managedKeyName`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "managedKeyName": { "type": "string", "description": "The name of the previously configured managed key. This field is\nrequired if \u003cspan pulumi-lang-nodejs=\"`type`\" pulumi-lang-dotnet=\"`Type`\" pulumi-lang-go=\"`type`\" pulumi-lang-python=\"`type`\" pulumi-lang-yaml=\"`type`\" pulumi-lang-java=\"`type`\" pulumi-lang-hcl=\"`type`\"\u003e`type`\u003c/span\u003e is \u003cspan pulumi-lang-nodejs=\"`kms`\" pulumi-lang-dotnet=\"`Kms`\" pulumi-lang-go=\"`kms`\" pulumi-lang-python=\"`kms`\" pulumi-lang-yaml=\"`kms`\" pulumi-lang-java=\"`kms`\" pulumi-lang-hcl=\"`kms`\"\u003e`kms`\u003c/span\u003e and it conflicts with \u003cspan pulumi-lang-nodejs=\"`managedKeyId`\" pulumi-lang-dotnet=\"`ManagedKeyId`\" pulumi-lang-go=\"`managedKeyId`\" pulumi-lang-python=\"`managed_key_id`\" pulumi-lang-yaml=\"`managedKeyId`\" pulumi-lang-java=\"`managedKeyId`\" pulumi-lang-hcl=\"`managed_key_id`\"\u003e`managedKeyId`\u003c/span\u003e\n", "willReplaceOnChanges": true }, "maxPathLength": { "type": "integer", "description": "The maximum path length to encode in the generated certificate\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "notBeforeDuration": { "type": "string", "description": "Specifies the duration by which to backdate the NotBefore property.\n", "willReplaceOnChanges": true }, "organization": { "type": "string", "description": "The organization\n", "willReplaceOnChanges": true }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "ou": { "type": "string", "description": "The organization unit\n", "willReplaceOnChanges": true }, "permittedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are allowed to be issued\n", "willReplaceOnChanges": true }, "permittedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "permittedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "permittedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "postalCode": { "type": "string", "description": "The postal code\n", "willReplaceOnChanges": true }, "privateKeyFormat": { "type": "string", "description": "The private key format\n", "willReplaceOnChanges": true }, "province": { "type": "string", "description": "The province\n", "willReplaceOnChanges": true }, "serialNumber": { "type": "string", "description": "The certificate's serial number, hex formatted.\n" }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n" }, "streetAddress": { "type": "string", "description": "The street address\n", "willReplaceOnChanges": true }, "ttl": { "type": "string", "description": "Time to live\n" }, "type": { "type": "string", "description": "Type of intermediate to create. Must be either \\\"exported\\\", \\\"internal\\\"\nor \\\"kms\\\"\n", "willReplaceOnChanges": true }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true }, "usePss": { "type": "boolean", "description": "When \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, uses PSS (Probabilistic Signature Scheme) for RSA signatures instead of PKCS#1 v1.5. PSS provides enhanced security but may have compatibility issues with older systems. Only applicable to RSA keys; ignored for ECDSA/Ed25519 keys. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 1.18.0+.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/secretBackendRootSignIntermediate:SecretBackendRootSignIntermediate": { "description": "Creates PKI certificate.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst root = new vault.pkisecret.SecretBackendRootSignIntermediate(\"root\", {\n backend: rootVaultMount.path,\n csr: intermediate.csr,\n commonName: \"Intermediate CA\",\n excludeCnFromSans: true,\n ou: \"My OU\",\n organization: \"My organization\",\n}, {\n dependsOn: [intermediate],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nroot = vault.pkisecret.SecretBackendRootSignIntermediate(\"root\",\n backend=root_vault_mount[\"path\"],\n csr=intermediate[\"csr\"],\n common_name=\"Intermediate CA\",\n exclude_cn_from_sans=True,\n ou=\"My OU\",\n organization=\"My organization\",\n opts = pulumi.ResourceOptions(depends_on=[intermediate]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var root = new Vault.PkiSecret.SecretBackendRootSignIntermediate(\"root\", new()\n {\n Backend = rootVaultMount.Path,\n Csr = intermediate.Csr,\n CommonName = \"Intermediate CA\",\n ExcludeCnFromSans = true,\n Ou = \"My OU\",\n Organization = \"My organization\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n intermediate,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := pkisecret.NewSecretBackendRootSignIntermediate(ctx, \"root\", \u0026pkisecret.SecretBackendRootSignIntermediateArgs{\n\t\t\tBackend: pulumi.Any(rootVaultMount.Path),\n\t\t\tCsr: pulumi.Any(intermediate.Csr),\n\t\t\tCommonName: pulumi.String(\"Intermediate CA\"),\n\t\t\tExcludeCnFromSans: pulumi.Bool(true),\n\t\t\tOu: pulumi.String(\"My OU\"),\n\t\t\tOrganization: pulumi.String(\"My organization\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tintermediate,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pkisecret_secretbackendrootsignintermediate\" \"root\" {\n depends_on = [intermediate]\n backend = rootVaultMount.path\n csr = intermediate.csr\n common_name = \"Intermediate CA\"\n exclude_cn_from_sans = true\n ou = \"My OU\"\n organization = \"My organization\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootSignIntermediate;\nimport com.pulumi.vault.pkiSecret.SecretBackendRootSignIntermediateArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var root = new SecretBackendRootSignIntermediate(\"root\", SecretBackendRootSignIntermediateArgs.builder()\n .backend(rootVaultMount.path())\n .csr(intermediate.csr())\n .commonName(\"Intermediate CA\")\n .excludeCnFromSans(true)\n .ou(\"My OU\")\n .organization(\"My organization\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(intermediate)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n root:\n type: vault:pkiSecret:SecretBackendRootSignIntermediate\n properties:\n backend: ${rootVaultMount.path}\n csr: ${intermediate.csr}\n commonName: Intermediate CA\n excludeCnFromSans: true\n ou: My OU\n organization: My organization\n options:\n dependsOn:\n - ${intermediate}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n" }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n" }, "caChains": { "type": "array", "items": { "type": "string" }, "description": "A list of the issuing and intermediate CA certificates in the \u003cspan pulumi-lang-nodejs=\"`format`\" pulumi-lang-dotnet=\"`Format`\" pulumi-lang-go=\"`format`\" pulumi-lang-python=\"`format`\" pulumi-lang-yaml=\"`format`\" pulumi-lang-java=\"`format`\" pulumi-lang-hcl=\"`format`\"\u003e`format`\u003c/span\u003e specified.\n" }, "certificate": { "type": "string", "description": "The intermediate CA certificate in the \u003cspan pulumi-lang-nodejs=\"`format`\" pulumi-lang-dotnet=\"`Format`\" pulumi-lang-go=\"`format`\" pulumi-lang-python=\"`format`\" pulumi-lang-yaml=\"`format`\" pulumi-lang-java=\"`format`\" pulumi-lang-hcl=\"`format`\"\u003e`format`\u003c/span\u003e specified.\n" }, "certificateBundle": { "type": "string", "description": "The concatenation of the intermediate CA and the issuing CA certificates (PEM encoded). \nRequires the \u003cspan pulumi-lang-nodejs=\"`format`\" pulumi-lang-dotnet=\"`Format`\" pulumi-lang-go=\"`format`\" pulumi-lang-python=\"`format`\" pulumi-lang-yaml=\"`format`\" pulumi-lang-java=\"`format`\" pulumi-lang-hcl=\"`format`\"\u003e`format`\u003c/span\u003e to be set to any of: pem, pem_bundle. The value will be empty for all other formats.\n" }, "commonName": { "type": "string", "description": "CN of intermediate to create\n" }, "country": { "type": "string", "description": "The country\n" }, "csr": { "type": "string", "description": "The CSR\n" }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n" }, "excludedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n" }, "excludedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n" }, "excludedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n" }, "excludedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n" }, "format": { "type": "string", "description": "The format of data\n" }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n" }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request. May\nbe the value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, a name, or an issuer ID. Use ACLs to prevent access to\nthe `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users\noverriding the role's \u003cspan pulumi-lang-nodejs=\"`issuerRef`\" pulumi-lang-dotnet=\"`IssuerRef`\" pulumi-lang-go=\"`issuerRef`\" pulumi-lang-python=\"`issuer_ref`\" pulumi-lang-yaml=\"`issuerRef`\" pulumi-lang-java=\"`issuerRef`\" pulumi-lang-hcl=\"`issuer_ref`\"\u003e`issuerRef`\u003c/span\u003e value.\n" }, "issuingCa": { "type": "string", "description": "The issuing CA certificate in the \u003cspan pulumi-lang-nodejs=\"`format`\" pulumi-lang-dotnet=\"`Format`\" pulumi-lang-go=\"`format`\" pulumi-lang-python=\"`format`\" pulumi-lang-yaml=\"`format`\" pulumi-lang-java=\"`format`\" pulumi-lang-hcl=\"`format`\"\u003e`format`\u003c/span\u003e specified.\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n" }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specify the key usages to be added to the existing set of key usages (\"CRL\", \"CertSign\") on the generated certificate. Requires Vault 1.19.2+.\n" }, "locality": { "type": "string", "description": "The locality\n" }, "maxPathLength": { "type": "integer", "description": "The maximum path length to encode in the generated certificate\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. \nThe value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date\nfor IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "notBeforeDuration": { "type": "string", "description": "Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.\n" }, "organization": { "type": "string", "description": "The organization\n" }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n" }, "ou": { "type": "string", "description": "The organization unit\n" }, "permittedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are allowed to be issued\n" }, "permittedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are allowed to be issued. Requires Vault version 1.19+.\n" }, "permittedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are allowed to be issued. Requires Vault version 1.19+.\n" }, "permittedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are allowed to be issued. Requires Vault version 1.19+.\n" }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n" }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n" }, "postalCode": { "type": "string", "description": "The postal code\n" }, "province": { "type": "string", "description": "The province\n" }, "revoke": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the certificate will be revoked on resource destruction.\n" }, "serialNumber": { "type": "string", "description": "The certificate's serial number, hex formatted.\n" }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n" }, "skid": { "type": "string", "description": "Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.\n" }, "streetAddress": { "type": "string", "description": "The street address\n" }, "ttl": { "type": "string", "description": "Time to live\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n" }, "useCsrValues": { "type": "boolean", "description": "Preserve CSR values\n" }, "usePss": { "type": "boolean", "description": "Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.\n" } }, "required": [ "backend", "caChains", "certificate", "certificateBundle", "commonName", "csr", "issuingCa", "serialNumber" ], "inputProperties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "commonName": { "type": "string", "description": "CN of intermediate to create\n", "willReplaceOnChanges": true }, "country": { "type": "string", "description": "The country\n", "willReplaceOnChanges": true }, "csr": { "type": "string", "description": "The CSR\n", "willReplaceOnChanges": true }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "excludedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "format": { "type": "string", "description": "The format of data\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request. May\nbe the value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, a name, or an issuer ID. Use ACLs to prevent access to\nthe `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users\noverriding the role's \u003cspan pulumi-lang-nodejs=\"`issuerRef`\" pulumi-lang-dotnet=\"`IssuerRef`\" pulumi-lang-go=\"`issuerRef`\" pulumi-lang-python=\"`issuer_ref`\" pulumi-lang-yaml=\"`issuerRef`\" pulumi-lang-java=\"`issuerRef`\" pulumi-lang-hcl=\"`issuer_ref`\"\u003e`issuerRef`\u003c/span\u003e value.\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specify the key usages to be added to the existing set of key usages (\"CRL\", \"CertSign\") on the generated certificate. Requires Vault 1.19.2+.\n", "willReplaceOnChanges": true }, "locality": { "type": "string", "description": "The locality\n", "willReplaceOnChanges": true }, "maxPathLength": { "type": "integer", "description": "The maximum path length to encode in the generated certificate\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. \nThe value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date\nfor IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "notBeforeDuration": { "type": "string", "description": "Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.\n", "willReplaceOnChanges": true }, "organization": { "type": "string", "description": "The organization\n", "willReplaceOnChanges": true }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "ou": { "type": "string", "description": "The organization unit\n", "willReplaceOnChanges": true }, "permittedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are allowed to be issued\n", "willReplaceOnChanges": true }, "permittedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "permittedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "permittedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "postalCode": { "type": "string", "description": "The postal code\n", "willReplaceOnChanges": true }, "province": { "type": "string", "description": "The province\n", "willReplaceOnChanges": true }, "revoke": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the certificate will be revoked on resource destruction.\n" }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n", "willReplaceOnChanges": true }, "skid": { "type": "string", "description": "Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.\n", "willReplaceOnChanges": true }, "streetAddress": { "type": "string", "description": "The street address\n", "willReplaceOnChanges": true }, "ttl": { "type": "string", "description": "Time to live\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true }, "useCsrValues": { "type": "boolean", "description": "Preserve CSR values\n", "willReplaceOnChanges": true }, "usePss": { "type": "boolean", "description": "Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "commonName", "csr" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRootSignIntermediate resources.\n", "properties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "caChains": { "type": "array", "items": { "type": "string" }, "description": "A list of the issuing and intermediate CA certificates in the \u003cspan pulumi-lang-nodejs=\"`format`\" pulumi-lang-dotnet=\"`Format`\" pulumi-lang-go=\"`format`\" pulumi-lang-python=\"`format`\" pulumi-lang-yaml=\"`format`\" pulumi-lang-java=\"`format`\" pulumi-lang-hcl=\"`format`\"\u003e`format`\u003c/span\u003e specified.\n" }, "certificate": { "type": "string", "description": "The intermediate CA certificate in the \u003cspan pulumi-lang-nodejs=\"`format`\" pulumi-lang-dotnet=\"`Format`\" pulumi-lang-go=\"`format`\" pulumi-lang-python=\"`format`\" pulumi-lang-yaml=\"`format`\" pulumi-lang-java=\"`format`\" pulumi-lang-hcl=\"`format`\"\u003e`format`\u003c/span\u003e specified.\n" }, "certificateBundle": { "type": "string", "description": "The concatenation of the intermediate CA and the issuing CA certificates (PEM encoded). \nRequires the \u003cspan pulumi-lang-nodejs=\"`format`\" pulumi-lang-dotnet=\"`Format`\" pulumi-lang-go=\"`format`\" pulumi-lang-python=\"`format`\" pulumi-lang-yaml=\"`format`\" pulumi-lang-java=\"`format`\" pulumi-lang-hcl=\"`format`\"\u003e`format`\u003c/span\u003e to be set to any of: pem, pem_bundle. The value will be empty for all other formats.\n" }, "commonName": { "type": "string", "description": "CN of intermediate to create\n", "willReplaceOnChanges": true }, "country": { "type": "string", "description": "The country\n", "willReplaceOnChanges": true }, "csr": { "type": "string", "description": "The CSR\n", "willReplaceOnChanges": true }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "excludedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "excludedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are not allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "format": { "type": "string", "description": "The format of data\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request. May\nbe the value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, a name, or an issuer ID. Use ACLs to prevent access to\nthe `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users\noverriding the role's \u003cspan pulumi-lang-nodejs=\"`issuerRef`\" pulumi-lang-dotnet=\"`IssuerRef`\" pulumi-lang-go=\"`issuerRef`\" pulumi-lang-python=\"`issuer_ref`\" pulumi-lang-yaml=\"`issuerRef`\" pulumi-lang-java=\"`issuerRef`\" pulumi-lang-hcl=\"`issuer_ref`\"\u003e`issuerRef`\u003c/span\u003e value.\n" }, "issuingCa": { "type": "string", "description": "The issuing CA certificate in the \u003cspan pulumi-lang-nodejs=\"`format`\" pulumi-lang-dotnet=\"`Format`\" pulumi-lang-go=\"`format`\" pulumi-lang-python=\"`format`\" pulumi-lang-yaml=\"`format`\" pulumi-lang-java=\"`format`\" pulumi-lang-hcl=\"`format`\"\u003e`format`\u003c/span\u003e specified.\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "keyUsages": { "type": "array", "items": { "type": "string" }, "description": "Specify the key usages to be added to the existing set of key usages (\"CRL\", \"CertSign\") on the generated certificate. Requires Vault 1.19.2+.\n", "willReplaceOnChanges": true }, "locality": { "type": "string", "description": "The locality\n", "willReplaceOnChanges": true }, "maxPathLength": { "type": "integer", "description": "The maximum path length to encode in the generated certificate\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. \nThe value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date\nfor IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "notBeforeDuration": { "type": "string", "description": "Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.\n", "willReplaceOnChanges": true }, "organization": { "type": "string", "description": "The organization\n", "willReplaceOnChanges": true }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "ou": { "type": "string", "description": "The organization unit\n", "willReplaceOnChanges": true }, "permittedDnsDomains": { "type": "array", "items": { "type": "string" }, "description": "List of domains for which certificates are allowed to be issued\n", "willReplaceOnChanges": true }, "permittedEmailAddresses": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "permittedIpRanges": { "type": "array", "items": { "type": "string" }, "description": "List of IP ranges for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "permittedUriDomains": { "type": "array", "items": { "type": "string" }, "description": "List of URI domains for which certificates are allowed to be issued. Requires Vault version 1.19+.\n", "willReplaceOnChanges": true }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "postalCode": { "type": "string", "description": "The postal code\n", "willReplaceOnChanges": true }, "province": { "type": "string", "description": "The province\n", "willReplaceOnChanges": true }, "revoke": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the certificate will be revoked on resource destruction.\n" }, "serialNumber": { "type": "string", "description": "The certificate's serial number, hex formatted.\n" }, "signatureBits": { "type": "integer", "description": "The number of bits to use in the signature algorithm\n", "willReplaceOnChanges": true }, "skid": { "type": "string", "description": "Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.\n", "willReplaceOnChanges": true }, "streetAddress": { "type": "string", "description": "The street address\n", "willReplaceOnChanges": true }, "ttl": { "type": "string", "description": "Time to live\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true }, "useCsrValues": { "type": "boolean", "description": "Preserve CSR values\n", "willReplaceOnChanges": true }, "usePss": { "type": "boolean", "description": "Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiSecret/secretBackendSign:SecretBackendSign": { "description": "Signs a new certificate based upon the provided CSR and the supplied parameters by the PKI Secret Backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.pkisecret.SecretBackendSign(\"test\", {\n backend: pki.path,\n name: admin.name,\n csr: `-----BEGIN CERTIFICATE REQUEST-----\nMIIEqDCCApACAQAwYzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx\nITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEcMBoGA1UEAwwTY2Vy\ndC50ZXN0Lm15LmRvbWFpbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB\nAJupYCQ8UVCWII1Zof1c6YcSSaM9hEaDU78cfKP5RoSeH10BvrWRfT+mzCONVpNP\nCW9Iabtvk6hm0ot6ilnndEyVJbc0g7hdDLBX5BM25D+DGZGJRKUz1V+uBrWmXtIt\nVonj7JTDTe7ViH0GDsB7CvqXFGXO2a2cDYBchLkL6vQiFPshxvUsLtwxuy/qdYgy\nX6ya+AUoZcoQGy1XxNjfH6cPtWSWQGEp1oPR6vL9hU3laTZb3C+VV4jZem+he8/0\nV+qV6fLG92WTXm2hmf8nrtUqqJ+C7mW/RJod+TviviBadIX0OHXW7k5HVsZood01\nte8vMRUNJNiZfa9EMIK5oncbQn0LcM3Wo9VrjpL7jREb/4HCS2gswYGv7hzk9cCS\nkVY4rDucchKbApuI3kfzmO7GFOF5eiSkYZpY/czNn7VVM3WCu6dpOX4+3rhgrZQw\nkY14L930DaLVRUgve/zKVP2D2GHdEOs+MbV7s96UgigT9pXly/yHPj+1sSYqmnaD\n5b7jSeJusmzO/nrwXVGLsnezR87VzHl9Ux9g5s6zh+R+PrZuVxYsLvoUpaasH47O\ngIcBzSb/6pSGZKAUizmYsHsR1k88dAvsQ+FsUDaNokdi9VndEB4QPmiFmjyLV+0I\n1TFoXop4sW11NPz1YCq+IxnYrEaIN3PyhY0GvBJDFY1/AgMBAAGgADANBgkqhkiG\n9w0BAQsFAAOCAgEActuqnqS8Y9UF7e08w7tR3FPzGecWreuvxILrlFEZJxiLPFqL\nIt7uJvtypCVQvz6UQzKdBYO7tMpRaWViB8DrWzXNZjLMrg+QHcpveg8C0Ett4scG\nfnvLk6fTDFYrnGvwHTqiHos5i0y3bFLyS1BGwSpdLAykGtvC+VM8mRyw/Y7CPcKN\n77kebY/9xduW1g2uxWLr0x90RuQDv9psPojT+59tRLGSp5Kt0IeD3QtnAZEFE4aN\nvt+Pd69eg3BgZ8ZeDgoqAw3yppvOkpAFiE5pw2qPZaM4SRphl4d2Lek2zNIMyZqv\ndo5zh356HOgXtDaSg0POnRGrN/Ua+LMCRTg6GEPUnx9uQb/zt8Zu0hIexDGyykp1\nOGqtWlv/Nc8UYuS38v0BeB6bMPeoqQUjkqs8nHlAEFn0KlgYdtDC+7SdQx6wS4te\ndBKRNDfC4lS3jYJgs55jHqonZgkpSi3bamlxpfpW0ukGBcmq91wRe4bOw/4uD/vf\nUwqMWOdCYcU3mdYNjTWy22ORW3SGFQxMBwpUEURCSoeqWr6aJeQ7KAYkx1PrB5T8\nOTEc13lWf+B0PU9UJuGTsmpIuImPDVd0EVDayr3mT5dDbqTVDbe8ppf2IswABmf0\no3DybUeUmknYjl109rdSf+76nuREICHatxXgN3xCMFuBaN4WLO+ksd6Y1Ys=\n-----END CERTIFICATE REQUEST-----\n`,\n commonName: \"test.my.domain\",\n}, {\n dependsOn: [admin],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.pkisecret.SecretBackendSign(\"test\",\n backend=pki[\"path\"],\n name=admin[\"name\"],\n csr=\"\"\"-----BEGIN CERTIFICATE REQUEST-----\nMIIEqDCCApACAQAwYzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx\nITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEcMBoGA1UEAwwTY2Vy\ndC50ZXN0Lm15LmRvbWFpbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB\nAJupYCQ8UVCWII1Zof1c6YcSSaM9hEaDU78cfKP5RoSeH10BvrWRfT+mzCONVpNP\nCW9Iabtvk6hm0ot6ilnndEyVJbc0g7hdDLBX5BM25D+DGZGJRKUz1V+uBrWmXtIt\nVonj7JTDTe7ViH0GDsB7CvqXFGXO2a2cDYBchLkL6vQiFPshxvUsLtwxuy/qdYgy\nX6ya+AUoZcoQGy1XxNjfH6cPtWSWQGEp1oPR6vL9hU3laTZb3C+VV4jZem+he8/0\nV+qV6fLG92WTXm2hmf8nrtUqqJ+C7mW/RJod+TviviBadIX0OHXW7k5HVsZood01\nte8vMRUNJNiZfa9EMIK5oncbQn0LcM3Wo9VrjpL7jREb/4HCS2gswYGv7hzk9cCS\nkVY4rDucchKbApuI3kfzmO7GFOF5eiSkYZpY/czNn7VVM3WCu6dpOX4+3rhgrZQw\nkY14L930DaLVRUgve/zKVP2D2GHdEOs+MbV7s96UgigT9pXly/yHPj+1sSYqmnaD\n5b7jSeJusmzO/nrwXVGLsnezR87VzHl9Ux9g5s6zh+R+PrZuVxYsLvoUpaasH47O\ngIcBzSb/6pSGZKAUizmYsHsR1k88dAvsQ+FsUDaNokdi9VndEB4QPmiFmjyLV+0I\n1TFoXop4sW11NPz1YCq+IxnYrEaIN3PyhY0GvBJDFY1/AgMBAAGgADANBgkqhkiG\n9w0BAQsFAAOCAgEActuqnqS8Y9UF7e08w7tR3FPzGecWreuvxILrlFEZJxiLPFqL\nIt7uJvtypCVQvz6UQzKdBYO7tMpRaWViB8DrWzXNZjLMrg+QHcpveg8C0Ett4scG\nfnvLk6fTDFYrnGvwHTqiHos5i0y3bFLyS1BGwSpdLAykGtvC+VM8mRyw/Y7CPcKN\n77kebY/9xduW1g2uxWLr0x90RuQDv9psPojT+59tRLGSp5Kt0IeD3QtnAZEFE4aN\nvt+Pd69eg3BgZ8ZeDgoqAw3yppvOkpAFiE5pw2qPZaM4SRphl4d2Lek2zNIMyZqv\ndo5zh356HOgXtDaSg0POnRGrN/Ua+LMCRTg6GEPUnx9uQb/zt8Zu0hIexDGyykp1\nOGqtWlv/Nc8UYuS38v0BeB6bMPeoqQUjkqs8nHlAEFn0KlgYdtDC+7SdQx6wS4te\ndBKRNDfC4lS3jYJgs55jHqonZgkpSi3bamlxpfpW0ukGBcmq91wRe4bOw/4uD/vf\nUwqMWOdCYcU3mdYNjTWy22ORW3SGFQxMBwpUEURCSoeqWr6aJeQ7KAYkx1PrB5T8\nOTEc13lWf+B0PU9UJuGTsmpIuImPDVd0EVDayr3mT5dDbqTVDbe8ppf2IswABmf0\no3DybUeUmknYjl109rdSf+76nuREICHatxXgN3xCMFuBaN4WLO+ksd6Y1Ys=\n-----END CERTIFICATE REQUEST-----\n\"\"\",\n common_name=\"test.my.domain\",\n opts = pulumi.ResourceOptions(depends_on=[admin]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.PkiSecret.SecretBackendSign(\"test\", new()\n {\n Backend = pki.Path,\n Name = admin.Name,\n Csr = @\"-----BEGIN CERTIFICATE REQUEST-----\nMIIEqDCCApACAQAwYzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx\nITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEcMBoGA1UEAwwTY2Vy\ndC50ZXN0Lm15LmRvbWFpbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB\nAJupYCQ8UVCWII1Zof1c6YcSSaM9hEaDU78cfKP5RoSeH10BvrWRfT+mzCONVpNP\nCW9Iabtvk6hm0ot6ilnndEyVJbc0g7hdDLBX5BM25D+DGZGJRKUz1V+uBrWmXtIt\nVonj7JTDTe7ViH0GDsB7CvqXFGXO2a2cDYBchLkL6vQiFPshxvUsLtwxuy/qdYgy\nX6ya+AUoZcoQGy1XxNjfH6cPtWSWQGEp1oPR6vL9hU3laTZb3C+VV4jZem+he8/0\nV+qV6fLG92WTXm2hmf8nrtUqqJ+C7mW/RJod+TviviBadIX0OHXW7k5HVsZood01\nte8vMRUNJNiZfa9EMIK5oncbQn0LcM3Wo9VrjpL7jREb/4HCS2gswYGv7hzk9cCS\nkVY4rDucchKbApuI3kfzmO7GFOF5eiSkYZpY/czNn7VVM3WCu6dpOX4+3rhgrZQw\nkY14L930DaLVRUgve/zKVP2D2GHdEOs+MbV7s96UgigT9pXly/yHPj+1sSYqmnaD\n5b7jSeJusmzO/nrwXVGLsnezR87VzHl9Ux9g5s6zh+R+PrZuVxYsLvoUpaasH47O\ngIcBzSb/6pSGZKAUizmYsHsR1k88dAvsQ+FsUDaNokdi9VndEB4QPmiFmjyLV+0I\n1TFoXop4sW11NPz1YCq+IxnYrEaIN3PyhY0GvBJDFY1/AgMBAAGgADANBgkqhkiG\n9w0BAQsFAAOCAgEActuqnqS8Y9UF7e08w7tR3FPzGecWreuvxILrlFEZJxiLPFqL\nIt7uJvtypCVQvz6UQzKdBYO7tMpRaWViB8DrWzXNZjLMrg+QHcpveg8C0Ett4scG\nfnvLk6fTDFYrnGvwHTqiHos5i0y3bFLyS1BGwSpdLAykGtvC+VM8mRyw/Y7CPcKN\n77kebY/9xduW1g2uxWLr0x90RuQDv9psPojT+59tRLGSp5Kt0IeD3QtnAZEFE4aN\nvt+Pd69eg3BgZ8ZeDgoqAw3yppvOkpAFiE5pw2qPZaM4SRphl4d2Lek2zNIMyZqv\ndo5zh356HOgXtDaSg0POnRGrN/Ua+LMCRTg6GEPUnx9uQb/zt8Zu0hIexDGyykp1\nOGqtWlv/Nc8UYuS38v0BeB6bMPeoqQUjkqs8nHlAEFn0KlgYdtDC+7SdQx6wS4te\ndBKRNDfC4lS3jYJgs55jHqonZgkpSi3bamlxpfpW0ukGBcmq91wRe4bOw/4uD/vf\nUwqMWOdCYcU3mdYNjTWy22ORW3SGFQxMBwpUEURCSoeqWr6aJeQ7KAYkx1PrB5T8\nOTEc13lWf+B0PU9UJuGTsmpIuImPDVd0EVDayr3mT5dDbqTVDbe8ppf2IswABmf0\no3DybUeUmknYjl109rdSf+76nuREICHatxXgN3xCMFuBaN4WLO+ksd6Y1Ys=\n-----END CERTIFICATE REQUEST-----\n\",\n CommonName = \"test.my.domain\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n admin,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkisecret\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := pkisecret.NewSecretBackendSign(ctx, \"test\", \u0026pkisecret.SecretBackendSignArgs{\n\t\t\tBackend: pulumi.Any(pki.Path),\n\t\t\tName: pulumi.Any(admin.Name),\n\t\t\tCsr: pulumi.String(`-----BEGIN CERTIFICATE REQUEST-----\nMIIEqDCCApACAQAwYzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx\nITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEcMBoGA1UEAwwTY2Vy\ndC50ZXN0Lm15LmRvbWFpbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB\nAJupYCQ8UVCWII1Zof1c6YcSSaM9hEaDU78cfKP5RoSeH10BvrWRfT+mzCONVpNP\nCW9Iabtvk6hm0ot6ilnndEyVJbc0g7hdDLBX5BM25D+DGZGJRKUz1V+uBrWmXtIt\nVonj7JTDTe7ViH0GDsB7CvqXFGXO2a2cDYBchLkL6vQiFPshxvUsLtwxuy/qdYgy\nX6ya+AUoZcoQGy1XxNjfH6cPtWSWQGEp1oPR6vL9hU3laTZb3C+VV4jZem+he8/0\nV+qV6fLG92WTXm2hmf8nrtUqqJ+C7mW/RJod+TviviBadIX0OHXW7k5HVsZood01\nte8vMRUNJNiZfa9EMIK5oncbQn0LcM3Wo9VrjpL7jREb/4HCS2gswYGv7hzk9cCS\nkVY4rDucchKbApuI3kfzmO7GFOF5eiSkYZpY/czNn7VVM3WCu6dpOX4+3rhgrZQw\nkY14L930DaLVRUgve/zKVP2D2GHdEOs+MbV7s96UgigT9pXly/yHPj+1sSYqmnaD\n5b7jSeJusmzO/nrwXVGLsnezR87VzHl9Ux9g5s6zh+R+PrZuVxYsLvoUpaasH47O\ngIcBzSb/6pSGZKAUizmYsHsR1k88dAvsQ+FsUDaNokdi9VndEB4QPmiFmjyLV+0I\n1TFoXop4sW11NPz1YCq+IxnYrEaIN3PyhY0GvBJDFY1/AgMBAAGgADANBgkqhkiG\n9w0BAQsFAAOCAgEActuqnqS8Y9UF7e08w7tR3FPzGecWreuvxILrlFEZJxiLPFqL\nIt7uJvtypCVQvz6UQzKdBYO7tMpRaWViB8DrWzXNZjLMrg+QHcpveg8C0Ett4scG\nfnvLk6fTDFYrnGvwHTqiHos5i0y3bFLyS1BGwSpdLAykGtvC+VM8mRyw/Y7CPcKN\n77kebY/9xduW1g2uxWLr0x90RuQDv9psPojT+59tRLGSp5Kt0IeD3QtnAZEFE4aN\nvt+Pd69eg3BgZ8ZeDgoqAw3yppvOkpAFiE5pw2qPZaM4SRphl4d2Lek2zNIMyZqv\ndo5zh356HOgXtDaSg0POnRGrN/Ua+LMCRTg6GEPUnx9uQb/zt8Zu0hIexDGyykp1\nOGqtWlv/Nc8UYuS38v0BeB6bMPeoqQUjkqs8nHlAEFn0KlgYdtDC+7SdQx6wS4te\ndBKRNDfC4lS3jYJgs55jHqonZgkpSi3bamlxpfpW0ukGBcmq91wRe4bOw/4uD/vf\nUwqMWOdCYcU3mdYNjTWy22ORW3SGFQxMBwpUEURCSoeqWr6aJeQ7KAYkx1PrB5T8\nOTEc13lWf+B0PU9UJuGTsmpIuImPDVd0EVDayr3mT5dDbqTVDbe8ppf2IswABmf0\no3DybUeUmknYjl109rdSf+76nuREICHatxXgN3xCMFuBaN4WLO+ksd6Y1Ys=\n-----END CERTIFICATE REQUEST-----\n`),\n\t\t\tCommonName: pulumi.String(\"test.my.domain\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tadmin,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pkisecret_secretbackendsign\" \"test\" {\n depends_on = [admin]\n backend = pki.path\n name = admin.name\n csr = \"-----BEGIN CERTIFICATE REQUEST-----\\nMIIEqDCCApACAQAwYzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx\\nITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEcMBoGA1UEAwwTY2Vy\\ndC50ZXN0Lm15LmRvbWFpbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB\\nAJupYCQ8UVCWII1Zof1c6YcSSaM9hEaDU78cfKP5RoSeH10BvrWRfT+mzCONVpNP\\nCW9Iabtvk6hm0ot6ilnndEyVJbc0g7hdDLBX5BM25D+DGZGJRKUz1V+uBrWmXtIt\\nVonj7JTDTe7ViH0GDsB7CvqXFGXO2a2cDYBchLkL6vQiFPshxvUsLtwxuy/qdYgy\\nX6ya+AUoZcoQGy1XxNjfH6cPtWSWQGEp1oPR6vL9hU3laTZb3C+VV4jZem+he8/0\\nV+qV6fLG92WTXm2hmf8nrtUqqJ+C7mW/RJod+TviviBadIX0OHXW7k5HVsZood01\\nte8vMRUNJNiZfa9EMIK5oncbQn0LcM3Wo9VrjpL7jREb/4HCS2gswYGv7hzk9cCS\\nkVY4rDucchKbApuI3kfzmO7GFOF5eiSkYZpY/czNn7VVM3WCu6dpOX4+3rhgrZQw\\nkY14L930DaLVRUgve/zKVP2D2GHdEOs+MbV7s96UgigT9pXly/yHPj+1sSYqmnaD\\n5b7jSeJusmzO/nrwXVGLsnezR87VzHl9Ux9g5s6zh+R+PrZuVxYsLvoUpaasH47O\\ngIcBzSb/6pSGZKAUizmYsHsR1k88dAvsQ+FsUDaNokdi9VndEB4QPmiFmjyLV+0I\\n1TFoXop4sW11NPz1YCq+IxnYrEaIN3PyhY0GvBJDFY1/AgMBAAGgADANBgkqhkiG\\n9w0BAQsFAAOCAgEActuqnqS8Y9UF7e08w7tR3FPzGecWreuvxILrlFEZJxiLPFqL\\nIt7uJvtypCVQvz6UQzKdBYO7tMpRaWViB8DrWzXNZjLMrg+QHcpveg8C0Ett4scG\\nfnvLk6fTDFYrnGvwHTqiHos5i0y3bFLyS1BGwSpdLAykGtvC+VM8mRyw/Y7CPcKN\\n77kebY/9xduW1g2uxWLr0x90RuQDv9psPojT+59tRLGSp5Kt0IeD3QtnAZEFE4aN\\nvt+Pd69eg3BgZ8ZeDgoqAw3yppvOkpAFiE5pw2qPZaM4SRphl4d2Lek2zNIMyZqv\\ndo5zh356HOgXtDaSg0POnRGrN/Ua+LMCRTg6GEPUnx9uQb/zt8Zu0hIexDGyykp1\\nOGqtWlv/Nc8UYuS38v0BeB6bMPeoqQUjkqs8nHlAEFn0KlgYdtDC+7SdQx6wS4te\\ndBKRNDfC4lS3jYJgs55jHqonZgkpSi3bamlxpfpW0ukGBcmq91wRe4bOw/4uD/vf\\nUwqMWOdCYcU3mdYNjTWy22ORW3SGFQxMBwpUEURCSoeqWr6aJeQ7KAYkx1PrB5T8\\nOTEc13lWf+B0PU9UJuGTsmpIuImPDVd0EVDayr3mT5dDbqTVDbe8ppf2IswABmf0\\no3DybUeUmknYjl109rdSf+76nuREICHatxXgN3xCMFuBaN4WLO+ksd6Y1Ys=\\n-----END CERTIFICATE REQUEST-----\\n\"\n common_name = \"test.my.domain\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.pkiSecret.SecretBackendSign;\nimport com.pulumi.vault.pkiSecret.SecretBackendSignArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new SecretBackendSign(\"test\", SecretBackendSignArgs.builder()\n .backend(pki.path())\n .name(admin.name())\n .csr(\"\"\"\n-----BEGIN CERTIFICATE REQUEST-----\nMIIEqDCCApACAQAwYzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx\nITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEcMBoGA1UEAwwTY2Vy\ndC50ZXN0Lm15LmRvbWFpbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB\nAJupYCQ8UVCWII1Zof1c6YcSSaM9hEaDU78cfKP5RoSeH10BvrWRfT+mzCONVpNP\nCW9Iabtvk6hm0ot6ilnndEyVJbc0g7hdDLBX5BM25D+DGZGJRKUz1V+uBrWmXtIt\nVonj7JTDTe7ViH0GDsB7CvqXFGXO2a2cDYBchLkL6vQiFPshxvUsLtwxuy/qdYgy\nX6ya+AUoZcoQGy1XxNjfH6cPtWSWQGEp1oPR6vL9hU3laTZb3C+VV4jZem+he8/0\nV+qV6fLG92WTXm2hmf8nrtUqqJ+C7mW/RJod+TviviBadIX0OHXW7k5HVsZood01\nte8vMRUNJNiZfa9EMIK5oncbQn0LcM3Wo9VrjpL7jREb/4HCS2gswYGv7hzk9cCS\nkVY4rDucchKbApuI3kfzmO7GFOF5eiSkYZpY/czNn7VVM3WCu6dpOX4+3rhgrZQw\nkY14L930DaLVRUgve/zKVP2D2GHdEOs+MbV7s96UgigT9pXly/yHPj+1sSYqmnaD\n5b7jSeJusmzO/nrwXVGLsnezR87VzHl9Ux9g5s6zh+R+PrZuVxYsLvoUpaasH47O\ngIcBzSb/6pSGZKAUizmYsHsR1k88dAvsQ+FsUDaNokdi9VndEB4QPmiFmjyLV+0I\n1TFoXop4sW11NPz1YCq+IxnYrEaIN3PyhY0GvBJDFY1/AgMBAAGgADANBgkqhkiG\n9w0BAQsFAAOCAgEActuqnqS8Y9UF7e08w7tR3FPzGecWreuvxILrlFEZJxiLPFqL\nIt7uJvtypCVQvz6UQzKdBYO7tMpRaWViB8DrWzXNZjLMrg+QHcpveg8C0Ett4scG\nfnvLk6fTDFYrnGvwHTqiHos5i0y3bFLyS1BGwSpdLAykGtvC+VM8mRyw/Y7CPcKN\n77kebY/9xduW1g2uxWLr0x90RuQDv9psPojT+59tRLGSp5Kt0IeD3QtnAZEFE4aN\nvt+Pd69eg3BgZ8ZeDgoqAw3yppvOkpAFiE5pw2qPZaM4SRphl4d2Lek2zNIMyZqv\ndo5zh356HOgXtDaSg0POnRGrN/Ua+LMCRTg6GEPUnx9uQb/zt8Zu0hIexDGyykp1\nOGqtWlv/Nc8UYuS38v0BeB6bMPeoqQUjkqs8nHlAEFn0KlgYdtDC+7SdQx6wS4te\ndBKRNDfC4lS3jYJgs55jHqonZgkpSi3bamlxpfpW0ukGBcmq91wRe4bOw/4uD/vf\nUwqMWOdCYcU3mdYNjTWy22ORW3SGFQxMBwpUEURCSoeqWr6aJeQ7KAYkx1PrB5T8\nOTEc13lWf+B0PU9UJuGTsmpIuImPDVd0EVDayr3mT5dDbqTVDbe8ppf2IswABmf0\no3DybUeUmknYjl109rdSf+76nuREICHatxXgN3xCMFuBaN4WLO+ksd6Y1Ys=\n-----END CERTIFICATE REQUEST-----\n \"\"\")\n .commonName(\"test.my.domain\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(admin)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:pkiSecret:SecretBackendSign\n properties:\n backend: ${pki.path}\n name: ${admin.name}\n csr: |\n -----BEGIN CERTIFICATE REQUEST-----\n MIIEqDCCApACAQAwYzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx\n ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEcMBoGA1UEAwwTY2Vy\n dC50ZXN0Lm15LmRvbWFpbjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB\n AJupYCQ8UVCWII1Zof1c6YcSSaM9hEaDU78cfKP5RoSeH10BvrWRfT+mzCONVpNP\n CW9Iabtvk6hm0ot6ilnndEyVJbc0g7hdDLBX5BM25D+DGZGJRKUz1V+uBrWmXtIt\n Vonj7JTDTe7ViH0GDsB7CvqXFGXO2a2cDYBchLkL6vQiFPshxvUsLtwxuy/qdYgy\n X6ya+AUoZcoQGy1XxNjfH6cPtWSWQGEp1oPR6vL9hU3laTZb3C+VV4jZem+he8/0\n V+qV6fLG92WTXm2hmf8nrtUqqJ+C7mW/RJod+TviviBadIX0OHXW7k5HVsZood01\n te8vMRUNJNiZfa9EMIK5oncbQn0LcM3Wo9VrjpL7jREb/4HCS2gswYGv7hzk9cCS\n kVY4rDucchKbApuI3kfzmO7GFOF5eiSkYZpY/czNn7VVM3WCu6dpOX4+3rhgrZQw\n kY14L930DaLVRUgve/zKVP2D2GHdEOs+MbV7s96UgigT9pXly/yHPj+1sSYqmnaD\n 5b7jSeJusmzO/nrwXVGLsnezR87VzHl9Ux9g5s6zh+R+PrZuVxYsLvoUpaasH47O\n gIcBzSb/6pSGZKAUizmYsHsR1k88dAvsQ+FsUDaNokdi9VndEB4QPmiFmjyLV+0I\n 1TFoXop4sW11NPz1YCq+IxnYrEaIN3PyhY0GvBJDFY1/AgMBAAGgADANBgkqhkiG\n 9w0BAQsFAAOCAgEActuqnqS8Y9UF7e08w7tR3FPzGecWreuvxILrlFEZJxiLPFqL\n It7uJvtypCVQvz6UQzKdBYO7tMpRaWViB8DrWzXNZjLMrg+QHcpveg8C0Ett4scG\n fnvLk6fTDFYrnGvwHTqiHos5i0y3bFLyS1BGwSpdLAykGtvC+VM8mRyw/Y7CPcKN\n 77kebY/9xduW1g2uxWLr0x90RuQDv9psPojT+59tRLGSp5Kt0IeD3QtnAZEFE4aN\n vt+Pd69eg3BgZ8ZeDgoqAw3yppvOkpAFiE5pw2qPZaM4SRphl4d2Lek2zNIMyZqv\n do5zh356HOgXtDaSg0POnRGrN/Ua+LMCRTg6GEPUnx9uQb/zt8Zu0hIexDGyykp1\n OGqtWlv/Nc8UYuS38v0BeB6bMPeoqQUjkqs8nHlAEFn0KlgYdtDC+7SdQx6wS4te\n dBKRNDfC4lS3jYJgs55jHqonZgkpSi3bamlxpfpW0ukGBcmq91wRe4bOw/4uD/vf\n UwqMWOdCYcU3mdYNjTWy22ORW3SGFQxMBwpUEURCSoeqWr6aJeQ7KAYkx1PrB5T8\n OTEc13lWf+B0PU9UJuGTsmpIuImPDVd0EVDayr3mT5dDbqTVDbe8ppf2IswABmf0\n o3DybUeUmknYjl109rdSf+76nuREICHatxXgN3xCMFuBaN4WLO+ksd6Y1Ys=\n -----END CERTIFICATE REQUEST-----\n commonName: test.my.domain\n options:\n dependsOn:\n - ${admin}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n" }, "autoRenew": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, certs will be renewed if the expiration is within \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n" }, "caChains": { "type": "array", "items": { "type": "string" }, "description": "The CA chain\n" }, "certMetadata": { "type": "string", "description": "A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's\u003cspan pulumi-lang-nodejs=\" noStoreMetadata \" pulumi-lang-dotnet=\" NoStoreMetadata \" pulumi-lang-go=\" noStoreMetadata \" pulumi-lang-python=\" no_store_metadata \" pulumi-lang-yaml=\" noStoreMetadata \" pulumi-lang-java=\" noStoreMetadata \" pulumi-lang-hcl=\" no_store_metadata \"\u003e noStoreMetadata \u003c/span\u003emust be set to false, otherwise an error is returned when specified.\n" }, "certificate": { "type": "string", "description": "The certificate\n" }, "commonName": { "type": "string", "description": "CN of certificate to create\n" }, "csr": { "type": "string", "description": "The CSR\n" }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n" }, "expiration": { "type": "integer", "description": "The expiration date of the certificate in unix epoch format\n" }, "format": { "type": "string", "description": "The format of data. Valid values are \"pem\", \u003cspan pulumi-lang-nodejs=\"\"pemBundle\"\" pulumi-lang-dotnet=\"\"PemBundle\"\" pulumi-lang-go=\"\"pemBundle\"\" pulumi-lang-python=\"\"pem_bundle\"\" pulumi-lang-yaml=\"\"pemBundle\"\" pulumi-lang-java=\"\"pemBundle\"\" pulumi-lang-hcl=\"\"pem_bundle\"\"\u003e\"pemBundle\"\u003c/span\u003e, \"der\", \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. Values \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e require Vault 2.0.5+.\n" }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n" }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request. Can\nbe the value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, a name, or an issuer ID. Use ACLs to prevent access to\nthe `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users\noverriding the role's \u003cspan pulumi-lang-nodejs=\"`issuerRef`\" pulumi-lang-dotnet=\"`IssuerRef`\" pulumi-lang-go=\"`issuerRef`\" pulumi-lang-python=\"`issuer_ref`\" pulumi-lang-yaml=\"`issuerRef`\" pulumi-lang-java=\"`issuerRef`\" pulumi-lang-hcl=\"`issuer_ref`\"\u003e`issuerRef`\u003c/span\u003e value.\n" }, "issuingCa": { "type": "string", "description": "The issuing CA\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n" }, "minSecondsRemaining": { "type": "integer", "description": "Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)\n" }, "name": { "type": "string", "description": "Name of the role to create the certificate against\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n" }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n" }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n" }, "removeRootsFromChain": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the returned \u003cspan pulumi-lang-nodejs=\"`caChain`\" pulumi-lang-dotnet=\"`CaChain`\" pulumi-lang-go=\"`caChain`\" pulumi-lang-python=\"`ca_chain`\" pulumi-lang-yaml=\"`caChain`\" pulumi-lang-java=\"`caChain`\" pulumi-lang-hcl=\"`ca_chain`\"\u003e`caChain`\u003c/span\u003e field will not include any self-signed CA certificates. Useful if end-users already have the root CA in their trust store. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "renewPending": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the current time (during refresh) is after the start of the early renewal window declared by \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e otherwise; if \u003cspan pulumi-lang-nodejs=\"`autoRenew`\" pulumi-lang-dotnet=\"`AutoRenew`\" pulumi-lang-go=\"`autoRenew`\" pulumi-lang-python=\"`auto_renew`\" pulumi-lang-yaml=\"`autoRenew`\" pulumi-lang-java=\"`autoRenew`\" pulumi-lang-hcl=\"`auto_renew`\"\u003e`autoRenew`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e then the provider will plan to replace the certificate once renewal is pending.\n" }, "serialNumber": { "type": "string", "description": "The certificate's serial number, hex formatted.\n" }, "ttl": { "type": "string", "description": "Time to live\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n" } }, "required": [ "backend", "caChains", "certificate", "commonName", "csr", "expiration", "issuingCa", "name", "renewPending", "serialNumber" ], "inputProperties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "autoRenew": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, certs will be renewed if the expiration is within \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "certMetadata": { "type": "string", "description": "A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's\u003cspan pulumi-lang-nodejs=\" noStoreMetadata \" pulumi-lang-dotnet=\" NoStoreMetadata \" pulumi-lang-go=\" noStoreMetadata \" pulumi-lang-python=\" no_store_metadata \" pulumi-lang-yaml=\" noStoreMetadata \" pulumi-lang-java=\" noStoreMetadata \" pulumi-lang-hcl=\" no_store_metadata \"\u003e noStoreMetadata \u003c/span\u003emust be set to false, otherwise an error is returned when specified.\n" }, "commonName": { "type": "string", "description": "CN of certificate to create\n", "willReplaceOnChanges": true }, "csr": { "type": "string", "description": "The CSR\n", "willReplaceOnChanges": true }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "format": { "type": "string", "description": "The format of data. Valid values are \"pem\", \u003cspan pulumi-lang-nodejs=\"\"pemBundle\"\" pulumi-lang-dotnet=\"\"PemBundle\"\" pulumi-lang-go=\"\"pemBundle\"\" pulumi-lang-python=\"\"pem_bundle\"\" pulumi-lang-yaml=\"\"pemBundle\"\" pulumi-lang-java=\"\"pemBundle\"\" pulumi-lang-hcl=\"\"pem_bundle\"\"\u003e\"pemBundle\"\u003c/span\u003e, \"der\", \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. Values \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e require Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request. Can\nbe the value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, a name, or an issuer ID. Use ACLs to prevent access to\nthe `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users\noverriding the role's \u003cspan pulumi-lang-nodejs=\"`issuerRef`\" pulumi-lang-dotnet=\"`IssuerRef`\" pulumi-lang-go=\"`issuerRef`\" pulumi-lang-python=\"`issuer_ref`\" pulumi-lang-yaml=\"`issuerRef`\" pulumi-lang-java=\"`issuerRef`\" pulumi-lang-hcl=\"`issuer_ref`\"\u003e`issuerRef`\u003c/span\u003e value.\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "minSecondsRemaining": { "type": "integer", "description": "Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)\n" }, "name": { "type": "string", "description": "Name of the role to create the certificate against\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "removeRootsFromChain": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the returned \u003cspan pulumi-lang-nodejs=\"`caChain`\" pulumi-lang-dotnet=\"`CaChain`\" pulumi-lang-go=\"`caChain`\" pulumi-lang-python=\"`ca_chain`\" pulumi-lang-yaml=\"`caChain`\" pulumi-lang-java=\"`caChain`\" pulumi-lang-hcl=\"`ca_chain`\"\u003e`caChain`\u003c/span\u003e field will not include any self-signed CA certificates. Useful if end-users already have the root CA in their trust store. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "ttl": { "type": "string", "description": "Time to live\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "backend", "commonName", "csr" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendSign resources.\n", "properties": { "altNames": { "type": "array", "items": { "type": "string" }, "description": "List of alternative names\n", "willReplaceOnChanges": true }, "autoRenew": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, certs will be renewed if the expiration is within \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e\n" }, "backend": { "type": "string", "description": "The PKI secret backend the resource belongs to.\n", "willReplaceOnChanges": true }, "caChains": { "type": "array", "items": { "type": "string" }, "description": "The CA chain\n" }, "certMetadata": { "type": "string", "description": "A base 64 encoded value or an empty string to associate with the certificate's serial number. The role's\u003cspan pulumi-lang-nodejs=\" noStoreMetadata \" pulumi-lang-dotnet=\" NoStoreMetadata \" pulumi-lang-go=\" noStoreMetadata \" pulumi-lang-python=\" no_store_metadata \" pulumi-lang-yaml=\" noStoreMetadata \" pulumi-lang-java=\" noStoreMetadata \" pulumi-lang-hcl=\" no_store_metadata \"\u003e noStoreMetadata \u003c/span\u003emust be set to false, otherwise an error is returned when specified.\n" }, "certificate": { "type": "string", "description": "The certificate\n" }, "commonName": { "type": "string", "description": "CN of certificate to create\n", "willReplaceOnChanges": true }, "csr": { "type": "string", "description": "The CSR\n", "willReplaceOnChanges": true }, "excludeCnFromSans": { "type": "boolean", "description": "Flag to exclude CN from SANs\n", "willReplaceOnChanges": true }, "expiration": { "type": "integer", "description": "The expiration date of the certificate in unix epoch format\n" }, "format": { "type": "string", "description": "The format of data. Valid values are \"pem\", \u003cspan pulumi-lang-nodejs=\"\"pemBundle\"\" pulumi-lang-dotnet=\"\"PemBundle\"\" pulumi-lang-go=\"\"pemBundle\"\" pulumi-lang-python=\"\"pem_bundle\"\" pulumi-lang-yaml=\"\"pemBundle\"\" pulumi-lang-java=\"\"pemBundle\"\" pulumi-lang-hcl=\"\"pem_bundle\"\"\u003e\"pemBundle\"\u003c/span\u003e, \"der\", \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e or \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. Values \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e and \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e require Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "ipSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative IPs\n", "willReplaceOnChanges": true }, "issuerRef": { "type": "string", "description": "Specifies the default issuer of this request. Can\nbe the value \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e, a name, or an issuer ID. Use ACLs to prevent access to\nthe `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users\noverriding the role's \u003cspan pulumi-lang-nodejs=\"`issuerRef`\" pulumi-lang-dotnet=\"`IssuerRef`\" pulumi-lang-go=\"`issuerRef`\" pulumi-lang-python=\"`issuer_ref`\" pulumi-lang-yaml=\"`issuerRef`\" pulumi-lang-java=\"`issuerRef`\" pulumi-lang-hcl=\"`issuer_ref`\"\u003e`issuerRef`\u003c/span\u003e value.\n" }, "issuingCa": { "type": "string", "description": "The issuing CA\n" }, "jksPassword": { "type": "string", "description": "Password for encrypting the Java keystore when format is set to \u003cspan pulumi-lang-nodejs=\"\"jksBundle\"\" pulumi-lang-dotnet=\"\"JksBundle\"\" pulumi-lang-go=\"\"jksBundle\"\" pulumi-lang-python=\"\"jks_bundle\"\" pulumi-lang-yaml=\"\"jksBundle\"\" pulumi-lang-java=\"\"jksBundle\"\" pulumi-lang-hcl=\"\"jks_bundle\"\"\u003e\"jksBundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "minSecondsRemaining": { "type": "integer", "description": "Generate a new certificate when the expiration is within this number of seconds, default is 604800 (7 days)\n" }, "name": { "type": "string", "description": "Name of the role to create the certificate against\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "notAfter": { "type": "string", "description": "Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.\n" }, "otherSans": { "type": "array", "items": { "type": "string" }, "description": "List of other SANs\n", "willReplaceOnChanges": true }, "pkcs12Encoder": { "type": "string", "description": "Encoder profile to use for PKCS#12 archives when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. Valid values are \"modern2026\" and \"modern2023\". Defaults to \"modern2026\", which uses the newer PKCS#12 integrity format (PBMAC1). Requires Vault 2.0.5+.\n\n**NOTE**: The \u003cspan pulumi-lang-nodejs=\"`jksBundle`\" pulumi-lang-dotnet=\"`JksBundle`\" pulumi-lang-go=\"`jksBundle`\" pulumi-lang-python=\"`jks_bundle`\" pulumi-lang-yaml=\"`jksBundle`\" pulumi-lang-java=\"`jksBundle`\" pulumi-lang-hcl=\"`jks_bundle`\"\u003e`jksBundle`\u003c/span\u003e format is provided only for compatibility with legacy systems and should be avoided for new usage. Prefer \u003cspan pulumi-lang-nodejs=\"`pkcs12Bundle`\" pulumi-lang-dotnet=\"`Pkcs12Bundle`\" pulumi-lang-go=\"`pkcs12Bundle`\" pulumi-lang-python=\"`pkcs12_bundle`\" pulumi-lang-yaml=\"`pkcs12Bundle`\" pulumi-lang-java=\"`pkcs12Bundle`\" pulumi-lang-hcl=\"`pkcs12_bundle`\"\u003e`pkcs12Bundle`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "pkcs12Password": { "type": "string", "description": "Password for encrypting the PKCS#12 archive when format is set to \u003cspan pulumi-lang-nodejs=\"\"pkcs12Bundle\"\" pulumi-lang-dotnet=\"\"Pkcs12Bundle\"\" pulumi-lang-go=\"\"pkcs12Bundle\"\" pulumi-lang-python=\"\"pkcs12_bundle\"\" pulumi-lang-yaml=\"\"pkcs12Bundle\"\" pulumi-lang-java=\"\"pkcs12Bundle\"\" pulumi-lang-hcl=\"\"pkcs12_bundle\"\"\u003e\"pkcs12Bundle\"\u003c/span\u003e. If not provided, defaults to \"changeit\". It is recommended to use the default password and protect the file using other means or use a high-entropy password. Requires Vault 2.0.5+.\n", "willReplaceOnChanges": true }, "removeRootsFromChain": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, the returned \u003cspan pulumi-lang-nodejs=\"`caChain`\" pulumi-lang-dotnet=\"`CaChain`\" pulumi-lang-go=\"`caChain`\" pulumi-lang-python=\"`ca_chain`\" pulumi-lang-yaml=\"`caChain`\" pulumi-lang-java=\"`caChain`\" pulumi-lang-hcl=\"`ca_chain`\"\u003e`caChain`\u003c/span\u003e field will not include any self-signed CA certificates. Useful if end-users already have the root CA in their trust store. Default \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n", "willReplaceOnChanges": true }, "renewPending": { "type": "boolean", "description": "\u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e if the current time (during refresh) is after the start of the early renewal window declared by \u003cspan pulumi-lang-nodejs=\"`minSecondsRemaining`\" pulumi-lang-dotnet=\"`MinSecondsRemaining`\" pulumi-lang-go=\"`minSecondsRemaining`\" pulumi-lang-python=\"`min_seconds_remaining`\" pulumi-lang-yaml=\"`minSecondsRemaining`\" pulumi-lang-java=\"`minSecondsRemaining`\" pulumi-lang-hcl=\"`min_seconds_remaining`\"\u003e`minSecondsRemaining`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e otherwise; if \u003cspan pulumi-lang-nodejs=\"`autoRenew`\" pulumi-lang-dotnet=\"`AutoRenew`\" pulumi-lang-go=\"`autoRenew`\" pulumi-lang-python=\"`auto_renew`\" pulumi-lang-yaml=\"`autoRenew`\" pulumi-lang-java=\"`autoRenew`\" pulumi-lang-hcl=\"`auto_renew`\"\u003e`autoRenew`\u003c/span\u003e is set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e then the provider will plan to replace the certificate once renewal is pending.\n" }, "serialNumber": { "type": "string", "description": "The certificate's serial number, hex formatted.\n" }, "ttl": { "type": "string", "description": "Time to live\n" }, "uriSans": { "type": "array", "items": { "type": "string" }, "description": "List of alternative URIs\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:pkiexternalca/secretBackendAcmeAccount:SecretBackendAcmeAccount": { "description": "Manages ACME accounts for external CA integration. This resource allows you to configure an ACME account that can be used to obtain certificates from external ACME-compliant Certificate Authorities.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki_external_ca = new vault.Mount(\"pki-external-ca\", {\n path: \"pki-external-ca\",\n type: \"pki-external-ca\",\n});\nconst example = new vault.pkiexternalca.SecretBackendAcmeAccount(\"example\", {\n mount: pki_external_ca.path,\n name: \"my-acme-account\",\n directoryUrl: \"https://acme-v02.api.letsencrypt.org/directory\",\n emailContacts: [\"admin@example.com\"],\n keyType: \"ec-256\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki_external_ca = vault.Mount(\"pki-external-ca\",\n path=\"pki-external-ca\",\n type=\"pki-external-ca\")\nexample = vault.pkiexternalca.SecretBackendAcmeAccount(\"example\",\n mount=pki_external_ca.path,\n name=\"my-acme-account\",\n directory_url=\"https://acme-v02.api.letsencrypt.org/directory\",\n email_contacts=[\"admin@example.com\"],\n key_type=\"ec-256\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki_external_ca = new Vault.Mount(\"pki-external-ca\", new()\n {\n Path = \"pki-external-ca\",\n Type = \"pki-external-ca\",\n });\n\n var example = new Vault.PkiExternalCa.SecretBackendAcmeAccount(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"my-acme-account\",\n DirectoryUrl = \"https://acme-v02.api.letsencrypt.org/directory\",\n EmailContacts = new[]\n {\n \"admin@example.com\",\n },\n KeyType = \"ec-256\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki_external_ca, err := vault.NewMount(ctx, \"pki-external-ca\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-external-ca\"),\n\t\t\tType: pulumi.String(\"pki-external-ca\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkiexternalca.NewSecretBackendAcmeAccount(ctx, \"example\", \u0026pkiexternalca.SecretBackendAcmeAccountArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tName: pulumi.String(\"my-acme-account\"),\n\t\t\tDirectoryUrl: pulumi.String(\"https://acme-v02.api.letsencrypt.org/directory\"),\n\t\t\tEmailContacts: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"admin@example.com\"),\n\t\t\t},\n\t\t\tKeyType: pulumi.String(\"ec-256\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki-external-ca\" {\n path = \"pki-external-ca\"\n type = \"pki-external-ca\"\n}\nresource \"vault_pkiexternalca_secretbackendacmeaccount\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n name = \"my-acme-account\"\n directory_url = \"https://acme-v02.api.letsencrypt.org/directory\"\n email_contacts = [\"admin@example.com\"]\n key_type = \"ec-256\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki_external_ca = new Mount(\"pki-external-ca\", MountArgs.builder()\n .path(\"pki-external-ca\")\n .type(\"pki-external-ca\")\n .build());\n\n var example = new SecretBackendAcmeAccount(\"example\", SecretBackendAcmeAccountArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"my-acme-account\")\n .directoryUrl(\"https://acme-v02.api.letsencrypt.org/directory\")\n .emailContacts(\"admin@example.com\")\n .keyType(\"ec-256\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki-external-ca:\n type: vault:Mount\n properties:\n path: pki-external-ca\n type: pki-external-ca\n example:\n type: vault:pkiexternalca:SecretBackendAcmeAccount\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: my-acme-account\n directoryUrl: https://acme-v02.api.letsencrypt.org/directory\n emailContacts:\n - admin@example.com\n keyType: ec-256\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\n### With External Account Binding (EAB)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst withEab = new vault.pkiexternalca.SecretBackendAcmeAccount(\"with_eab\", {\n mount: pki_external_ca.path,\n name: \"my-acme-account-eab\",\n directoryUrl: \"https://acme.example.com/directory\",\n emailContacts: [\"admin@example.com\"],\n keyType: \"rsa-2048\",\n eabKid: \"your-eab-key-id\",\n eabKey: \"your-eab-hmac-key\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nwith_eab = vault.pkiexternalca.SecretBackendAcmeAccount(\"with_eab\",\n mount=pki_external_ca[\"path\"],\n name=\"my-acme-account-eab\",\n directory_url=\"https://acme.example.com/directory\",\n email_contacts=[\"admin@example.com\"],\n key_type=\"rsa-2048\",\n eab_kid=\"your-eab-key-id\",\n eab_key=\"your-eab-hmac-key\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var withEab = new Vault.PkiExternalCa.SecretBackendAcmeAccount(\"with_eab\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"my-acme-account-eab\",\n DirectoryUrl = \"https://acme.example.com/directory\",\n EmailContacts = new[]\n {\n \"admin@example.com\",\n },\n KeyType = \"rsa-2048\",\n EabKid = \"your-eab-key-id\",\n EabKey = \"your-eab-hmac-key\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, \"with_eab\", \u0026pkiexternalca.SecretBackendAcmeAccountArgs{\n\t\t\tMount: pulumi.Any(pki_external_ca.Path),\n\t\t\tName: pulumi.String(\"my-acme-account-eab\"),\n\t\t\tDirectoryUrl: pulumi.String(\"https://acme.example.com/directory\"),\n\t\t\tEmailContacts: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"admin@example.com\"),\n\t\t\t},\n\t\t\tKeyType: pulumi.String(\"rsa-2048\"),\n\t\t\tEabKid: pulumi.String(\"your-eab-key-id\"),\n\t\t\tEabKey: pulumi.String(\"your-eab-hmac-key\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pkiexternalca_secretbackendacmeaccount\" \"with_eab\" {\n mount = pki-external-ca.path\n name = \"my-acme-account-eab\"\n directory_url = \"https://acme.example.com/directory\"\n email_contacts = [\"admin@example.com\"]\n key_type = \"rsa-2048\"\n eab_kid = \"your-eab-key-id\"\n eab_key = \"your-eab-hmac-key\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var withEab = new SecretBackendAcmeAccount(\"withEab\", SecretBackendAcmeAccountArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"my-acme-account-eab\")\n .directoryUrl(\"https://acme.example.com/directory\")\n .emailContacts(\"admin@example.com\")\n .keyType(\"rsa-2048\")\n .eabKid(\"your-eab-key-id\")\n .eabKey(\"your-eab-hmac-key\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n withEab:\n type: vault:pkiexternalca:SecretBackendAcmeAccount\n name: with_eab\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: my-acme-account-eab\n directoryUrl: https://acme.example.com/directory\n emailContacts:\n - admin@example.com\n keyType: rsa-2048\n eabKid: your-eab-key-id\n eabKey: your-eab-hmac-key\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\n## Import\n\nPKI ACME accounts can be imported using the format `\u003cmount\u003e/config/acme-account/\u003cname\u003e`, e.g.\n\n```\n$ terraform import vault_pki_external_ca_secret_backend_acme_account.example pki-external-ca/config/acme-account/my-acme-account\n\n```", "properties": { "activeKeyVersion": { "type": "integer", "description": "Version of the active account key, starts at zero.\n" }, "directoryUrl": { "type": "string", "description": "ACME Directory URL for the Certificate Authority (e.g., `https://acme-v02.api.letsencrypt.org/directory` for Let's Encrypt production).\n" }, "eabKey": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.\n", "secret": true }, "eabKid": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.\n", "secret": true }, "emailContacts": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for the ACME account. These will be used for important notifications from the CA.\n" }, "keyType": { "type": "string", "description": "Key type to generate for the account key. Valid values are `ec-256`, `ec-384`, `ec-521`, `rsa-2048`, `rsa-4096`, `rsa-8192`. Defaults to `ec-256`.\n" }, "mount": { "type": "string", "description": "The path where the PKI secret backend is mounted.\n" }, "name": { "type": "string", "description": "Name of the ACME account. Must be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "trustedCa": { "type": "string", "description": "PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.\n" } }, "required": [ "activeKeyVersion", "directoryUrl", "emailContacts", "keyType", "mount", "name" ], "inputProperties": { "directoryUrl": { "type": "string", "description": "ACME Directory URL for the Certificate Authority (e.g., `https://acme-v02.api.letsencrypt.org/directory` for Let's Encrypt production).\n" }, "eabKey": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.\n", "secret": true }, "eabKid": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.\n", "secret": true }, "emailContacts": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for the ACME account. These will be used for important notifications from the CA.\n" }, "keyType": { "type": "string", "description": "Key type to generate for the account key. Valid values are `ec-256`, `ec-384`, `ec-521`, `rsa-2048`, `rsa-4096`, `rsa-8192`. Defaults to `ec-256`.\n" }, "mount": { "type": "string", "description": "The path where the PKI secret backend is mounted.\n" }, "name": { "type": "string", "description": "Name of the ACME account. Must be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "trustedCa": { "type": "string", "description": "PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.\n" } }, "requiredInputs": [ "directoryUrl", "emailContacts", "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendAcmeAccount resources.\n", "properties": { "activeKeyVersion": { "type": "integer", "description": "Version of the active account key, starts at zero.\n" }, "directoryUrl": { "type": "string", "description": "ACME Directory URL for the Certificate Authority (e.g., `https://acme-v02.api.letsencrypt.org/directory` for Let's Encrypt production).\n" }, "eabKey": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe external account binding HMAC key to create the initial account. Required by some CAs for account registration. This is a write-only field.\n", "secret": true }, "eabKid": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe external account binding key ID to create the initial account. Required by some CAs for account registration. This is a write-only field.\n", "secret": true }, "emailContacts": { "type": "array", "items": { "type": "string" }, "description": "List of email addresses for the ACME account. These will be used for important notifications from the CA.\n" }, "keyType": { "type": "string", "description": "Key type to generate for the account key. Valid values are `ec-256`, `ec-384`, `ec-521`, `rsa-2048`, `rsa-4096`, `rsa-8192`. Defaults to `ec-256`.\n" }, "mount": { "type": "string", "description": "The path where the PKI secret backend is mounted.\n" }, "name": { "type": "string", "description": "Name of the ACME account. Must be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "trustedCa": { "type": "string", "description": "PEM-encoded trusted CA certificates for the ACME server. Use this when connecting to an ACME server with a custom or self-signed certificate.\n" } }, "type": "object" } }, "vault:pkiexternalca/secretBackendOrder:SecretBackendOrder": { "description": "Creates and manages ACME orders for certificate issuance via PKI External CA roles. This resource initiates the ACME certificate order process with an external Certificate Authority.\n\n\u003e **Note** This resource creates an ACME order but does not automatically fulfill challenges or fetch the certificate. Use \u003cspan pulumi-lang-nodejs=\"`vault.pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-dotnet=\"`vault.pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-go=\"`pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-python=\"`pkiexternalca_get_secret_backend_order_challenge`\" pulumi-lang-yaml=\"`vault.pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-java=\"`vault.pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-hcl=\"`data.vault_pki_external_ca_secret_backend_order_challenge`\"\u003e`vault.pkiexternalca.getSecretBackendOrderChallenge`\u003c/span\u003e data source to retrieve challenge details, \u003cspan pulumi-lang-nodejs=\"`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-dotnet=\"`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-go=\"`pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-python=\"`pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-yaml=\"`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-java=\"`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-hcl=\"`vault_pki_external_ca_secret_backend_order_challenge_fulfilled`\"\u003e`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\u003c/span\u003e to mark challenges as fulfilled, and \u003cspan pulumi-lang-nodejs=\"`vault.pkiexternalca.SecretBackendOrderCertificate`\" pulumi-lang-dotnet=\"`vault.pkiexternalca.SecretBackendOrderCertificate`\" pulumi-lang-go=\"`pkiexternalca.SecretBackendOrderCertificate`\" pulumi-lang-python=\"`pkiexternalca.SecretBackendOrderCertificate`\" pulumi-lang-yaml=\"`vault.pkiexternalca.SecretBackendOrderCertificate`\" pulumi-lang-java=\"`vault.pkiexternalca.SecretBackendOrderCertificate`\" pulumi-lang-hcl=\"`vault_pki_external_ca_secret_backend_order_certificate`\"\u003e`vault.pkiexternalca.SecretBackendOrderCertificate`\u003c/span\u003e to fetch the final certificate.\n\n## Example Usage\n\n### With Identifiers\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki_external_ca = new vault.Mount(\"pki-external-ca\", {\n path: \"pki-external-ca\",\n type: \"pki-external-ca\",\n});\nconst example = new vault.pkiexternalca.SecretBackendAcmeAccount(\"example\", {\n mount: pki_external_ca.path,\n name: \"my-acme-account\",\n directoryUrl: \"https://acme-v02.api.letsencrypt.org/directory\",\n emailContacts: [\"admin@example.com\"],\n});\nconst exampleSecretBackendRole = new vault.pkiexternalca.SecretBackendRole(\"example\", {\n mount: pki_external_ca.path,\n name: \"example-role\",\n acmeAccountName: example.name,\n allowedDomains: [\"example.com\"],\n allowedDomainOptions: [\n \"bare_domains\",\n \"subdomains\",\n ],\n});\nconst exampleSecretBackendOrder = new vault.pkiexternalca.SecretBackendOrder(\"example\", {\n mount: pki_external_ca.path,\n roleName: exampleSecretBackendRole.name,\n identifiers: [\n \"www.example.com\",\n \"api.example.com\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki_external_ca = vault.Mount(\"pki-external-ca\",\n path=\"pki-external-ca\",\n type=\"pki-external-ca\")\nexample = vault.pkiexternalca.SecretBackendAcmeAccount(\"example\",\n mount=pki_external_ca.path,\n name=\"my-acme-account\",\n directory_url=\"https://acme-v02.api.letsencrypt.org/directory\",\n email_contacts=[\"admin@example.com\"])\nexample_secret_backend_role = vault.pkiexternalca.SecretBackendRole(\"example\",\n mount=pki_external_ca.path,\n name=\"example-role\",\n acme_account_name=example.name,\n allowed_domains=[\"example.com\"],\n allowed_domain_options=[\n \"bare_domains\",\n \"subdomains\",\n ])\nexample_secret_backend_order = vault.pkiexternalca.SecretBackendOrder(\"example\",\n mount=pki_external_ca.path,\n role_name=example_secret_backend_role.name,\n identifiers=[\n \"www.example.com\",\n \"api.example.com\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki_external_ca = new Vault.Mount(\"pki-external-ca\", new()\n {\n Path = \"pki-external-ca\",\n Type = \"pki-external-ca\",\n });\n\n var example = new Vault.PkiExternalCa.SecretBackendAcmeAccount(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"my-acme-account\",\n DirectoryUrl = \"https://acme-v02.api.letsencrypt.org/directory\",\n EmailContacts = new[]\n {\n \"admin@example.com\",\n },\n });\n\n var exampleSecretBackendRole = new Vault.PkiExternalCa.SecretBackendRole(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"example-role\",\n AcmeAccountName = example.Name,\n AllowedDomains = new[]\n {\n \"example.com\",\n },\n AllowedDomainOptions = new[]\n {\n \"bare_domains\",\n \"subdomains\",\n },\n });\n\n var exampleSecretBackendOrder = new Vault.PkiExternalCa.SecretBackendOrder(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleSecretBackendRole.Name,\n Identifiers = new[]\n {\n \"www.example.com\",\n \"api.example.com\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki_external_ca, err := vault.NewMount(ctx, \"pki-external-ca\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-external-ca\"),\n\t\t\tType: pulumi.String(\"pki-external-ca\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texample, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, \"example\", \u0026pkiexternalca.SecretBackendAcmeAccountArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tName: pulumi.String(\"my-acme-account\"),\n\t\t\tDirectoryUrl: pulumi.String(\"https://acme-v02.api.letsencrypt.org/directory\"),\n\t\t\tEmailContacts: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"admin@example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendRole, err := pkiexternalca.NewSecretBackendRole(ctx, \"example\", \u0026pkiexternalca.SecretBackendRoleArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tName: pulumi.String(\"example-role\"),\n\t\t\tAcmeAccountName: example.Name,\n\t\t\tAllowedDomains: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"example.com\"),\n\t\t\t},\n\t\t\tAllowedDomainOptions: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"bare_domains\"),\n\t\t\t\tpulumi.String(\"subdomains\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkiexternalca.NewSecretBackendOrder(ctx, \"example\", \u0026pkiexternalca.SecretBackendOrderArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tRoleName: exampleSecretBackendRole.Name,\n\t\t\tIdentifiers: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"www.example.com\"),\n\t\t\t\tpulumi.String(\"api.example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki-external-ca\" {\n path = \"pki-external-ca\"\n type = \"pki-external-ca\"\n}\nresource \"vault_pkiexternalca_secretbackendacmeaccount\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n name = \"my-acme-account\"\n directory_url = \"https://acme-v02.api.letsencrypt.org/directory\"\n email_contacts = [\"admin@example.com\"]\n}\nresource \"vault_pkiexternalca_secretbackendrole\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n name = \"example-role\"\n acme_account_name = vault_pkiexternalca_secretbackendacmeaccount.example.name\n allowed_domains = [\"example.com\"]\n allowed_domain_options = [\"bare_domains\", \"subdomains\"]\n}\nresource \"vault_pkiexternalca_secretbackendorder\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n role_name = vault_pkiexternalca_secretbackendrole.example.name\n identifiers = [\"www.example.com\", \"api.example.com\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRole;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrder;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki_external_ca = new Mount(\"pki-external-ca\", MountArgs.builder()\n .path(\"pki-external-ca\")\n .type(\"pki-external-ca\")\n .build());\n\n var example = new SecretBackendAcmeAccount(\"example\", SecretBackendAcmeAccountArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"my-acme-account\")\n .directoryUrl(\"https://acme-v02.api.letsencrypt.org/directory\")\n .emailContacts(\"admin@example.com\")\n .build());\n\n var exampleSecretBackendRole = new SecretBackendRole(\"exampleSecretBackendRole\", SecretBackendRoleArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"example-role\")\n .acmeAccountName(example.name())\n .allowedDomains(\"example.com\")\n .allowedDomainOptions( \n \"bare_domains\",\n \"subdomains\")\n .build());\n\n var exampleSecretBackendOrder = new SecretBackendOrder(\"exampleSecretBackendOrder\", SecretBackendOrderArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleSecretBackendRole.name())\n .identifiers( \n \"www.example.com\",\n \"api.example.com\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki-external-ca:\n type: vault:Mount\n properties:\n path: pki-external-ca\n type: pki-external-ca\n example:\n type: vault:pkiexternalca:SecretBackendAcmeAccount\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: my-acme-account\n directoryUrl: https://acme-v02.api.letsencrypt.org/directory\n emailContacts:\n - admin@example.com\n exampleSecretBackendRole:\n type: vault:pkiexternalca:SecretBackendRole\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: example-role\n acmeAccountName: ${example.name}\n allowedDomains:\n - example.com\n allowedDomainOptions:\n - bare_domains\n - subdomains\n exampleSecretBackendOrder:\n type: vault:pkiexternalca:SecretBackendOrder\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleSecretBackendRole.name}\n identifiers:\n - www.example.com\n - api.example.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\n### With CSR\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as tls from \"@pulumi/tls\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new tls.index.PrivateKey(\"example\", {\n algorithm: \"RSA\",\n rsaBits: 2048,\n});\nconst exampleCertRequest = new tls.index.CertRequest(\"example\", {\n privateKeyPem: example.privateKeyPem,\n subject: [{\n commonName: \"www.example.com\",\n }],\n dnsNames: [\n \"www.example.com\",\n \"api.example.com\",\n ],\n});\nconst withCsr = new vault.pkiexternalca.SecretBackendOrder(\"with_csr\", {\n mount: pki_external_ca.path,\n roleName: exampleVaultPkiExternalCaSecretBackendRole.name,\n csr: exampleCertRequest.certRequestPem,\n});\n```\n```python\nimport pulumi\nimport pulumi_tls as tls\nimport pulumi_vault as vault\n\nexample = tls.PrivateKey(\"example\",\n algorithm=RSA,\n rsa_bits=2048)\nexample_cert_request = tls.CertRequest(\"example\",\n private_key_pem=example.private_key_pem,\n subject=[{\n commonName: www.example.com,\n }],\n dns_names=[\n www.example.com,\n api.example.com,\n ])\nwith_csr = vault.pkiexternalca.SecretBackendOrder(\"with_csr\",\n mount=pki_external_ca[\"path\"],\n role_name=example_vault_pki_external_ca_secret_backend_role[\"name\"],\n csr=example_cert_request[\"certRequestPem\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Tls = Pulumi.Tls;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Tls.PrivateKey(\"example\", new()\n {\n Algorithm = \"RSA\",\n RsaBits = 2048,\n });\n\n var exampleCertRequest = new Tls.CertRequest(\"example\", new()\n {\n PrivateKeyPem = example.PrivateKeyPem,\n Subject = new[]\n {\n \n {\n { \"commonName\", \"www.example.com\" },\n },\n },\n DnsNames = new[]\n {\n \"www.example.com\",\n \"api.example.com\",\n },\n });\n\n var withCsr = new Vault.PkiExternalCa.SecretBackendOrder(\"with_csr\", new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleVaultPkiExternalCaSecretBackendRole.Name,\n Csr = exampleCertRequest.CertRequestPem,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-tls/sdk/go/tls\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := tls.NewPrivateKey(ctx, \"example\", \u0026tls.PrivateKeyArgs{\n\t\t\tAlgorithm: \"RSA\",\n\t\t\tRsaBits: 2048,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleCertRequest, err := tls.NewCertRequest(ctx, \"example\", \u0026tls.CertRequestArgs{\n\t\t\tPrivateKeyPem: example.PrivateKeyPem,\n\t\t\tSubject: []map[string]string{\n\t\t\t\t{\n\t\t\t\t\t\"commonName\": \"www.example.com\",\n\t\t\t\t},\n\t\t\t},\n\t\t\tDnsNames: []string{\n\t\t\t\t\"www.example.com\",\n\t\t\t\t\"api.example.com\",\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkiexternalca.NewSecretBackendOrder(ctx, \"with_csr\", \u0026pkiexternalca.SecretBackendOrderArgs{\n\t\t\tMount: pulumi.Any(pki_external_ca.Path),\n\t\t\tRoleName: pulumi.Any(exampleVaultPkiExternalCaSecretBackendRole.Name),\n\t\t\tCsr: exampleCertRequest.CertRequestPem,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"tls_privatekey\" \"example\" {\n algorithm = \"RSA\"\n rsa_bits = 2048\n}\nresource \"tls_certrequest\" \"example\" {\n private_key_pem = tls_privatekey.example.privateKeyPem\n subject = [{\n \"commonName\" = \"www.example.com\"\n }]\n dns_names = [\"www.example.com\", \"api.example.com\"]\n}\nresource \"vault_pkiexternalca_secretbackendorder\" \"with_csr\" {\n mount = pki-external-ca.path\n role_name = exampleVaultPkiExternalCaSecretBackendRole.name\n csr = tls_certrequest.example.certRequestPem\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.tls.PrivateKey;\nimport com.pulumi.tls.PrivateKeyArgs;\nimport com.pulumi.tls.CertRequest;\nimport com.pulumi.tls.CertRequestArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrder;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new PrivateKey(\"example\", PrivateKeyArgs.builder()\n .algorithm(\"RSA\")\n .rsaBits(2048)\n .build());\n\n var exampleCertRequest = new CertRequest(\"exampleCertRequest\", CertRequestArgs.builder()\n .privateKeyPem(example.privateKeyPem())\n .subject(Arrays.asList(Map.of(\"commonName\", \"www.example.com\")))\n .dnsNames(Arrays.asList( \n \"www.example.com\",\n \"api.example.com\"))\n .build());\n\n var withCsr = new SecretBackendOrder(\"withCsr\", SecretBackendOrderArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleVaultPkiExternalCaSecretBackendRole.name())\n .csr(exampleCertRequest.certRequestPem())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: tls:PrivateKey\n properties:\n algorithm: RSA\n rsaBits: 2048\n exampleCertRequest:\n type: tls:CertRequest\n name: example\n properties:\n privateKeyPem: ${example.privateKeyPem}\n subject:\n - commonName: www.example.com\n dnsNames:\n - www.example.com\n - api.example.com\n withCsr:\n type: vault:pkiexternalca:SecretBackendOrder\n name: with_csr\n properties:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleVaultPkiExternalCaSecretBackendRole.name}\n csr: ${exampleCertRequest.certRequestPem}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPKI External CA orders can be imported using the format `\u003cmount\u003e/role/\u003crole_name\u003e/order/\u003corder_id\u003e`, e.g.\n\n```sh\n$ pulumi import vault:pkiexternalca/secretBackendOrder:SecretBackendOrder example pki-external-ca/role/example-role/order/abc123\n```\n\n\u003e **Note** Orders are immutable once created. Any changes to the configuration will require creating a new order.\n\n", "properties": { "challenges": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of identifiers to their ACME challenges (simplified representation).\n" }, "creationDate": { "type": "string", "description": "The date and time the order was created in RFC3339 format.\n" }, "csr": { "type": "string", "description": "PEM-encoded Certificate Signing Request containing identifiers. Required if \u003cspan pulumi-lang-nodejs=\"`identifiers`\" pulumi-lang-dotnet=\"`Identifiers`\" pulumi-lang-go=\"`identifiers`\" pulumi-lang-python=\"`identifiers`\" pulumi-lang-yaml=\"`identifiers`\" pulumi-lang-java=\"`identifiers`\" pulumi-lang-hcl=\"`identifiers`\"\u003e`identifiers`\u003c/span\u003e is not provided. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`identifiers`\" pulumi-lang-dotnet=\"`Identifiers`\" pulumi-lang-go=\"`identifiers`\" pulumi-lang-python=\"`identifiers`\" pulumi-lang-yaml=\"`identifiers`\" pulumi-lang-java=\"`identifiers`\" pulumi-lang-hcl=\"`identifiers`\"\u003e`identifiers`\u003c/span\u003e.\n" }, "expires": { "type": "string", "description": "The expiration date of the order in RFC3339 format.\n" }, "identifiers": { "type": "array", "items": { "type": "string" }, "description": "List of identifiers (domain names) for the certificate order. Required if \u003cspan pulumi-lang-nodejs=\"`csr`\" pulumi-lang-dotnet=\"`Csr`\" pulumi-lang-go=\"`csr`\" pulumi-lang-python=\"`csr`\" pulumi-lang-yaml=\"`csr`\" pulumi-lang-java=\"`csr`\" pulumi-lang-hcl=\"`csr`\"\u003e`csr`\u003c/span\u003e is not provided. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`csr`\" pulumi-lang-dotnet=\"`Csr`\" pulumi-lang-go=\"`csr`\" pulumi-lang-python=\"`csr`\" pulumi-lang-yaml=\"`csr`\" pulumi-lang-java=\"`csr`\" pulumi-lang-hcl=\"`csr`\"\u003e`csr`\u003c/span\u003e.\n" }, "lastError": { "type": "string", "description": "The last error message encountered during order processing, if any.\n" }, "lastUpdate": { "type": "string", "description": "The date and time the order was last updated in RFC3339 format.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "nextWorkDate": { "type": "string", "description": "The next scheduled work date for this order in RFC3339 format.\n" }, "orderId": { "type": "string", "description": "The unique identifier for this ACME order.\n" }, "orderStatus": { "type": "string", "description": "Current status of the order. Possible values include:\n" }, "roleName": { "type": "string", "description": "Name of the role to create the order for.\n" }, "serialNumber": { "type": "string", "description": "The serial number of the issued certificate (available when order is completed).\n" } }, "required": [ "challenges", "creationDate", "expires", "identifiers", "lastError", "lastUpdate", "mount", "nextWorkDate", "orderId", "orderStatus", "roleName", "serialNumber" ], "inputProperties": { "csr": { "type": "string", "description": "PEM-encoded Certificate Signing Request containing identifiers. Required if \u003cspan pulumi-lang-nodejs=\"`identifiers`\" pulumi-lang-dotnet=\"`Identifiers`\" pulumi-lang-go=\"`identifiers`\" pulumi-lang-python=\"`identifiers`\" pulumi-lang-yaml=\"`identifiers`\" pulumi-lang-java=\"`identifiers`\" pulumi-lang-hcl=\"`identifiers`\"\u003e`identifiers`\u003c/span\u003e is not provided. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`identifiers`\" pulumi-lang-dotnet=\"`Identifiers`\" pulumi-lang-go=\"`identifiers`\" pulumi-lang-python=\"`identifiers`\" pulumi-lang-yaml=\"`identifiers`\" pulumi-lang-java=\"`identifiers`\" pulumi-lang-hcl=\"`identifiers`\"\u003e`identifiers`\u003c/span\u003e.\n" }, "identifiers": { "type": "array", "items": { "type": "string" }, "description": "List of identifiers (domain names) for the certificate order. Required if \u003cspan pulumi-lang-nodejs=\"`csr`\" pulumi-lang-dotnet=\"`Csr`\" pulumi-lang-go=\"`csr`\" pulumi-lang-python=\"`csr`\" pulumi-lang-yaml=\"`csr`\" pulumi-lang-java=\"`csr`\" pulumi-lang-hcl=\"`csr`\"\u003e`csr`\u003c/span\u003e is not provided. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`csr`\" pulumi-lang-dotnet=\"`Csr`\" pulumi-lang-go=\"`csr`\" pulumi-lang-python=\"`csr`\" pulumi-lang-yaml=\"`csr`\" pulumi-lang-java=\"`csr`\" pulumi-lang-hcl=\"`csr`\"\u003e`csr`\u003c/span\u003e.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "roleName": { "type": "string", "description": "Name of the role to create the order for.\n" } }, "requiredInputs": [ "mount", "roleName" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendOrder resources.\n", "properties": { "challenges": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of identifiers to their ACME challenges (simplified representation).\n" }, "creationDate": { "type": "string", "description": "The date and time the order was created in RFC3339 format.\n" }, "csr": { "type": "string", "description": "PEM-encoded Certificate Signing Request containing identifiers. Required if \u003cspan pulumi-lang-nodejs=\"`identifiers`\" pulumi-lang-dotnet=\"`Identifiers`\" pulumi-lang-go=\"`identifiers`\" pulumi-lang-python=\"`identifiers`\" pulumi-lang-yaml=\"`identifiers`\" pulumi-lang-java=\"`identifiers`\" pulumi-lang-hcl=\"`identifiers`\"\u003e`identifiers`\u003c/span\u003e is not provided. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`identifiers`\" pulumi-lang-dotnet=\"`Identifiers`\" pulumi-lang-go=\"`identifiers`\" pulumi-lang-python=\"`identifiers`\" pulumi-lang-yaml=\"`identifiers`\" pulumi-lang-java=\"`identifiers`\" pulumi-lang-hcl=\"`identifiers`\"\u003e`identifiers`\u003c/span\u003e.\n" }, "expires": { "type": "string", "description": "The expiration date of the order in RFC3339 format.\n" }, "identifiers": { "type": "array", "items": { "type": "string" }, "description": "List of identifiers (domain names) for the certificate order. Required if \u003cspan pulumi-lang-nodejs=\"`csr`\" pulumi-lang-dotnet=\"`Csr`\" pulumi-lang-go=\"`csr`\" pulumi-lang-python=\"`csr`\" pulumi-lang-yaml=\"`csr`\" pulumi-lang-java=\"`csr`\" pulumi-lang-hcl=\"`csr`\"\u003e`csr`\u003c/span\u003e is not provided. Mutually exclusive with \u003cspan pulumi-lang-nodejs=\"`csr`\" pulumi-lang-dotnet=\"`Csr`\" pulumi-lang-go=\"`csr`\" pulumi-lang-python=\"`csr`\" pulumi-lang-yaml=\"`csr`\" pulumi-lang-java=\"`csr`\" pulumi-lang-hcl=\"`csr`\"\u003e`csr`\u003c/span\u003e.\n" }, "lastError": { "type": "string", "description": "The last error message encountered during order processing, if any.\n" }, "lastUpdate": { "type": "string", "description": "The date and time the order was last updated in RFC3339 format.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "nextWorkDate": { "type": "string", "description": "The next scheduled work date for this order in RFC3339 format.\n" }, "orderId": { "type": "string", "description": "The unique identifier for this ACME order.\n" }, "orderStatus": { "type": "string", "description": "Current status of the order. Possible values include:\n" }, "roleName": { "type": "string", "description": "Name of the role to create the order for.\n" }, "serialNumber": { "type": "string", "description": "The serial number of the issued certificate (available when order is completed).\n" } }, "type": "object" } }, "vault:pkiexternalca/secretBackendOrderCertificate:SecretBackendOrderCertificate": { "description": "Polls the order status endpoint until the order is completed, then fetches the certificate. This resource waits for all ACME challenges to be validated and the certificate to be issued by the external CA.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n\u003e **Note** This resource should be used after all challenges have been fulfilled using \u003cspan pulumi-lang-nodejs=\"`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-dotnet=\"`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-go=\"`pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-python=\"`pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-yaml=\"`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-java=\"`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\" pulumi-lang-hcl=\"`vault_pki_external_ca_secret_backend_order_challenge_fulfilled`\"\u003e`vault.pkiexternalca.SecretBackendOrderChallengeFulfilled`\u003c/span\u003e. It will poll the order status and wait for completion before fetching the certificate.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as _null from \"@pulumi/null\";\nimport * as command from \"@pulumi/command\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki_external_ca = new vault.Mount(\"pki-external-ca\", {\n path: \"pki-external-ca\",\n type: \"pki-external-ca\",\n});\nconst exampleSecretBackendAcmeAccount = new vault.pkiexternalca.SecretBackendAcmeAccount(\"example\", {\n mount: pki_external_ca.path,\n name: \"my-acme-account\",\n directoryUrl: \"https://acme-v02.api.letsencrypt.org/directory\",\n emailContacts: [\"admin@example.com\"],\n});\nconst exampleSecretBackendRole = new vault.pkiexternalca.SecretBackendRole(\"example\", {\n mount: pki_external_ca.path,\n name: \"example-role\",\n acmeAccountName: exampleSecretBackendAcmeAccount.name,\n allowedDomains: [\"example.com\"],\n allowedDomainOptions: [\n \"bare_domains\",\n \"subdomains\",\n ],\n});\nconst exampleSecretBackendOrder = new vault.pkiexternalca.SecretBackendOrder(\"example\", {\n mount: pki_external_ca.path,\n roleName: exampleSecretBackendRole.name,\n identifiers: [\"www.example.com\"],\n});\n// Retrieve and fulfill challenges (simplified)\nconst example = vault.pkiexternalca.getSecretBackendOrderChallengeOutput({\n mount: pki_external_ca.path,\n roleName: exampleSecretBackendRole.name,\n orderId: exampleSecretBackendOrder.orderId,\n challengeType: \"http-01\",\n identifier: \"www.example.com\",\n});\n// This is an example of fulfilling the http-01 challenge using pebble, an \n// acme testing tool which verifies challenges on port 5002 by default.\n// A real acme server would require the http-01 challenge be fulfilled on\n// port 80, of the real domain name for which the certificate is tied to.\nconst acmeChallengeServer = new _null.index.Resource(\"acme_challenge_server\", {triggers: {\n token: example.token,\n keyAuthorization: example.keyAuthorization,\n}});\nconst acmeChallengeServerProvisioner0 = new command.local.Command(\"acmeChallengeServerProvisioner0\", {create: `(\n mkdir -p /tmp/acme-challenge/.well-known/acme-challenge\n /bin/echo -n '${example.keyAuthorization}' \u003e /tmp/acme-challenge/.well-known/acme-challenge/${example.token}\n cd /tmp/acme-challenge \n (nohup python3 -m http.server 5002 \u003e/dev/null 2\u003e\u00261) \u0026 \n echo $! \u003e /tmp/acme-challenge-server.pid\n sleep 2\n) \u0026\n`}, {\n dependsOn: [acmeChallengeServer],\n});\nconst acmeChallengeServerProvisioner1 = new command.local.Command(\"acmeChallengeServerProvisioner1\", {\n create: \"true\",\n update: \"true\",\n \"delete\": `if [ -f /tmp/acme-challenge-server.pid ]; then\n kill (cat /tmp/acme-challenge-server.pid) 2\u003e/dev/null || true\n rm -f /tmp/acme-challenge-server.pid\nfi\nrm -rf /tmp/acme-challenge\n`,\n}, {\n dependsOn: [acmeChallengeServerProvisioner0],\n});\nconst exampleSecretBackendOrderChallengeFulfilled = new vault.pkiexternalca.SecretBackendOrderChallengeFulfilled(\"example\", {\n mount: pki_external_ca.path,\n roleName: exampleSecretBackendRole.name,\n orderId: exampleSecretBackendOrder.orderId,\n challengeType: \"http-01\",\n identifier: \"www.example.com\",\n}, {\n dependsOn: [acmeChallengeServer],\n});\n// Fetch the certificate after challenges are fulfilled\nconst exampleSecretBackendOrderCertificate = new vault.pkiexternalca.SecretBackendOrderCertificate(\"example\", {\n mount: pki_external_ca.path,\n roleName: exampleSecretBackendRole.name,\n orderId: exampleSecretBackendOrder.orderId,\n}, {\n dependsOn: [exampleSecretBackendOrderChallengeFulfilled],\n});\nexport const certificate = exampleSecretBackendOrderCertificate.certificate;\nexport const privateKey = exampleSecretBackendOrderCertificate.privateKey;\n```\n```python\nimport pulumi\nimport pulumi_command as command\nimport pulumi_null as null\nimport pulumi_vault as vault\n\npki_external_ca = vault.Mount(\"pki-external-ca\",\n path=\"pki-external-ca\",\n type=\"pki-external-ca\")\nexample_secret_backend_acme_account = vault.pkiexternalca.SecretBackendAcmeAccount(\"example\",\n mount=pki_external_ca.path,\n name=\"my-acme-account\",\n directory_url=\"https://acme-v02.api.letsencrypt.org/directory\",\n email_contacts=[\"admin@example.com\"])\nexample_secret_backend_role = vault.pkiexternalca.SecretBackendRole(\"example\",\n mount=pki_external_ca.path,\n name=\"example-role\",\n acme_account_name=example_secret_backend_acme_account.name,\n allowed_domains=[\"example.com\"],\n allowed_domain_options=[\n \"bare_domains\",\n \"subdomains\",\n ])\nexample_secret_backend_order = vault.pkiexternalca.SecretBackendOrder(\"example\",\n mount=pki_external_ca.path,\n role_name=example_secret_backend_role.name,\n identifiers=[\"www.example.com\"])\n# Retrieve and fulfill challenges (simplified)\nexample = vault.pkiexternalca.get_secret_backend_order_challenge_output(mount=pki_external_ca.path,\n role_name=example_secret_backend_role.name,\n order_id=example_secret_backend_order.order_id,\n challenge_type=\"http-01\",\n identifier=\"www.example.com\")\n# This is an example of fulfilling the http-01 challenge using pebble, an \n# acme testing tool which verifies challenges on port 5002 by default.\n# A real acme server would require the http-01 challenge be fulfilled on\n# port 80, of the real domain name for which the certificate is tied to.\nacme_challenge_server = null.Resource(\"acme_challenge_server\", triggers={\n token: example.token,\n keyAuthorization: example.key_authorization,\n})\nacme_challenge_server_provisioner0 = command.local.Command(\"acmeChallengeServerProvisioner0\", create=f(\n mkdir -p /tmp/acme-challenge/.well-known/acme-challenge\n /bin/echo -n '{example.key_authorization}' \u003e /tmp/acme-challenge/.well-known/acme-challenge/{example.token}\n cd /tmp/acme-challenge \n (nohup python3 -m http.server 5002 \u003e/dev/null 2\u003e\u00261) \u0026 \n echo $! \u003e /tmp/acme-challenge-server.pid\n sleep 2\n) \u0026\n,\nopts = pulumi.ResourceOptions(depends_on=[acme_challenge_server]))\nacme_challenge_server_provisioner1 = command.local.Command(\"acmeChallengeServerProvisioner1\",\n create=true,\n update=true,\n delete=if [ -f /tmp/acme-challenge-server.pid ]; then\n kill $(cat /tmp/acme-challenge-server.pid) 2\u003e/dev/null || true\n rm -f /tmp/acme-challenge-server.pid\nfi\nrm -rf /tmp/acme-challenge\n,\n opts = pulumi.ResourceOptions(depends_on=[acme_challenge_server_provisioner0]))\nexample_secret_backend_order_challenge_fulfilled = vault.pkiexternalca.SecretBackendOrderChallengeFulfilled(\"example\",\n mount=pki_external_ca.path,\n role_name=example_secret_backend_role.name,\n order_id=example_secret_backend_order.order_id,\n challenge_type=\"http-01\",\n identifier=\"www.example.com\",\n opts = pulumi.ResourceOptions(depends_on=[acme_challenge_server]))\n# Fetch the certificate after challenges are fulfilled\nexample_secret_backend_order_certificate = vault.pkiexternalca.SecretBackendOrderCertificate(\"example\",\n mount=pki_external_ca.path,\n role_name=example_secret_backend_role.name,\n order_id=example_secret_backend_order.order_id,\n opts = pulumi.ResourceOptions(depends_on=[example_secret_backend_order_challenge_fulfilled]))\npulumi.export(\"certificate\", example_secret_backend_order_certificate.certificate)\npulumi.export(\"privateKey\", example_secret_backend_order_certificate.private_key)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Command = Pulumi.Command;\nusing Null = Pulumi.Null;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki_external_ca = new Vault.Mount(\"pki-external-ca\", new()\n {\n Path = \"pki-external-ca\",\n Type = \"pki-external-ca\",\n });\n\n var exampleSecretBackendAcmeAccount = new Vault.PkiExternalCa.SecretBackendAcmeAccount(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"my-acme-account\",\n DirectoryUrl = \"https://acme-v02.api.letsencrypt.org/directory\",\n EmailContacts = new[]\n {\n \"admin@example.com\",\n },\n });\n\n var exampleSecretBackendRole = new Vault.PkiExternalCa.SecretBackendRole(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"example-role\",\n AcmeAccountName = exampleSecretBackendAcmeAccount.Name,\n AllowedDomains = new[]\n {\n \"example.com\",\n },\n AllowedDomainOptions = new[]\n {\n \"bare_domains\",\n \"subdomains\",\n },\n });\n\n var exampleSecretBackendOrder = new Vault.PkiExternalCa.SecretBackendOrder(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleSecretBackendRole.Name,\n Identifiers = new[]\n {\n \"www.example.com\",\n },\n });\n\n // Retrieve and fulfill challenges (simplified)\n var example = Vault.PkiExternalCa.GetSecretBackendOrderChallenge.Invoke(new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleSecretBackendRole.Name,\n OrderId = exampleSecretBackendOrder.OrderId,\n ChallengeType = \"http-01\",\n Identifier = \"www.example.com\",\n });\n\n // This is an example of fulfilling the http-01 challenge using pebble, an \n // acme testing tool which verifies challenges on port 5002 by default.\n // A real acme server would require the http-01 challenge be fulfilled on\n // port 80, of the real domain name for which the certificate is tied to.\n var acmeChallengeServer = new Null.Resource(\"acme_challenge_server\", new()\n {\n Triggers = \n {\n { \"token\", example.Apply(getSecretBackendOrderChallengeResult =\u003e getSecretBackendOrderChallengeResult.Token) },\n { \"keyAuthorization\", example.Apply(getSecretBackendOrderChallengeResult =\u003e getSecretBackendOrderChallengeResult.KeyAuthorization) },\n },\n });\n\n var acmeChallengeServerProvisioner0 = new Command.Local.Command(\"acmeChallengeServerProvisioner0\", new()\n {\n Create = @$\"(\n mkdir -p /tmp/acme-challenge/.well-known/acme-challenge\n /bin/echo -n '{example.Apply(getSecretBackendOrderChallengeResult =\u003e getSecretBackendOrderChallengeResult.KeyAuthorization)}' \u003e /tmp/acme-challenge/.well-known/acme-challenge/{example.Apply(getSecretBackendOrderChallengeResult =\u003e getSecretBackendOrderChallengeResult.Token)}\n cd /tmp/acme-challenge \n (nohup python3 -m http.server 5002 \u003e/dev/null 2\u003e\u00261) \u0026 \n echo $! \u003e /tmp/acme-challenge-server.pid\n sleep 2\n) \u0026\n\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n acmeChallengeServer,\n },\n });\n\n var acmeChallengeServerProvisioner1 = new Command.Local.Command(\"acmeChallengeServerProvisioner1\", new()\n {\n Create = \"true\",\n Update = \"true\",\n Delete = @\"if [ -f /tmp/acme-challenge-server.pid ]; then\n kill $(cat /tmp/acme-challenge-server.pid) 2\u003e/dev/null || true\n rm -f /tmp/acme-challenge-server.pid\nfi\nrm -rf /tmp/acme-challenge\n\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n acmeChallengeServerProvisioner0,\n },\n });\n\n var exampleSecretBackendOrderChallengeFulfilled = new Vault.PkiExternalCa.SecretBackendOrderChallengeFulfilled(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleSecretBackendRole.Name,\n OrderId = exampleSecretBackendOrder.OrderId,\n ChallengeType = \"http-01\",\n Identifier = \"www.example.com\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n acmeChallengeServer,\n },\n });\n\n // Fetch the certificate after challenges are fulfilled\n var exampleSecretBackendOrderCertificate = new Vault.PkiExternalCa.SecretBackendOrderCertificate(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleSecretBackendRole.Name,\n OrderId = exampleSecretBackendOrder.OrderId,\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n exampleSecretBackendOrderChallengeFulfilled,\n },\n });\n\n return new Dictionary\u003cstring, object?\u003e\n {\n [\"certificate\"] = exampleSecretBackendOrderCertificate.Certificate,\n [\"privateKey\"] = exampleSecretBackendOrderCertificate.PrivateKey,\n };\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-command/sdk/go/command/local\"\n\t\"github.com/pulumi/pulumi-null/sdk/go/null\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki_external_ca, err := vault.NewMount(ctx, \"pki-external-ca\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-external-ca\"),\n\t\t\tType: pulumi.String(\"pki-external-ca\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendAcmeAccount, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, \"example\", \u0026pkiexternalca.SecretBackendAcmeAccountArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tName: pulumi.String(\"my-acme-account\"),\n\t\t\tDirectoryUrl: pulumi.String(\"https://acme-v02.api.letsencrypt.org/directory\"),\n\t\t\tEmailContacts: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"admin@example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendRole, err := pkiexternalca.NewSecretBackendRole(ctx, \"example\", \u0026pkiexternalca.SecretBackendRoleArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tName: pulumi.String(\"example-role\"),\n\t\t\tAcmeAccountName: exampleSecretBackendAcmeAccount.Name,\n\t\t\tAllowedDomains: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"example.com\"),\n\t\t\t},\n\t\t\tAllowedDomainOptions: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"bare_domains\"),\n\t\t\t\tpulumi.String(\"subdomains\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendOrder, err := pkiexternalca.NewSecretBackendOrder(ctx, \"example\", \u0026pkiexternalca.SecretBackendOrderArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tRoleName: exampleSecretBackendRole.Name,\n\t\t\tIdentifiers: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"www.example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// Retrieve and fulfill challenges (simplified)\n\t\texample := pkiexternalca.GetSecretBackendOrderChallengeOutput(ctx, pkiexternalca.GetSecretBackendOrderChallengeOutputArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tRoleName: exampleSecretBackendRole.Name,\n\t\t\tOrderId: exampleSecretBackendOrder.OrderId,\n\t\t\tChallengeType: pulumi.String(\"http-01\"),\n\t\t\tIdentifier: pulumi.String(\"www.example.com\"),\n\t\t}, nil)\n\t\t// This is an example of fulfilling the http-01 challenge using pebble, an\n\t\t// acme testing tool which verifies challenges on port 5002 by default.\n\t\t// A real acme server would require the http-01 challenge be fulfilled on\n\t\t// port 80, of the real domain name for which the certificate is tied to.\n\t\tacmeChallengeServer, err := null.NewResource(ctx, \"acme_challenge_server\", \u0026null.ResourceArgs{\n\t\t\tTriggers: map[string]interface{}{\n\t\t\t\t\"token\": example.Token,\n\t\t\t\t\"keyAuthorization\": example.KeyAuthorization,\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tacmeChallengeServerProvisioner0, err := local.NewCommand(ctx, \"acmeChallengeServerProvisioner0\", \u0026local.CommandArgs{\n\t\t\tCreate: pulumi.Sprintf(`(\n mkdir -p /tmp/acme-challenge/.well-known/acme-challenge\n /bin/echo -n '%v' \u003e /tmp/acme-challenge/.well-known/acme-challenge/%v\n cd /tmp/acme-challenge \n (nohup python3 -m http.server 5002 \u003e/dev/null 2\u003e\u00261) \u0026 \n echo $! \u003e /tmp/acme-challenge-server.pid\n sleep 2\n) \u0026\n`, example.KeyAuthorization, example.Token),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tacmeChallengeServer,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = local.NewCommand(ctx, \"acmeChallengeServerProvisioner1\", \u0026local.CommandArgs{\n\t\t\tCreate: \"true\",\n\t\t\tUpdate: \"true\",\n\t\t\tDelete: `if [ -f /tmp/acme-challenge-server.pid ]; then\n kill $(cat /tmp/acme-challenge-server.pid) 2\u003e/dev/null || true\n rm -f /tmp/acme-challenge-server.pid\nfi\nrm -rf /tmp/acme-challenge\n`,\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tacmeChallengeServerProvisioner0,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendOrderChallengeFulfilled, err := pkiexternalca.NewSecretBackendOrderChallengeFulfilled(ctx, \"example\", \u0026pkiexternalca.SecretBackendOrderChallengeFulfilledArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tRoleName: exampleSecretBackendRole.Name,\n\t\t\tOrderId: exampleSecretBackendOrder.OrderId,\n\t\t\tChallengeType: pulumi.String(\"http-01\"),\n\t\t\tIdentifier: pulumi.String(\"www.example.com\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tacmeChallengeServer,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// Fetch the certificate after challenges are fulfilled\n\t\texampleSecretBackendOrderCertificate, err := pkiexternalca.NewSecretBackendOrderCertificate(ctx, \"example\", \u0026pkiexternalca.SecretBackendOrderCertificateArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tRoleName: exampleSecretBackendRole.Name,\n\t\t\tOrderId: exampleSecretBackendOrder.OrderId,\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\texampleSecretBackendOrderChallengeFulfilled,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tctx.Export(\"certificate\", exampleSecretBackendOrderCertificate.Certificate)\n\t\tctx.Export(\"privateKey\", exampleSecretBackendOrderCertificate.PrivateKey)\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\ndata \"vault_pkiexternalca_getsecretbackendorderchallenge\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n role_name = vault_pkiexternalca_secretbackendrole.example.name\n order_id = vault_pkiexternalca_secretbackendorder.example.order_id\n challenge_type = \"http-01\"\n identifier = \"www.example.com\"\n}\n\nresource \"vault_mount\" \"pki-external-ca\" {\n path = \"pki-external-ca\"\n type = \"pki-external-ca\"\n}\nresource \"vault_pkiexternalca_secretbackendacmeaccount\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n name = \"my-acme-account\"\n directory_url = \"https://acme-v02.api.letsencrypt.org/directory\"\n email_contacts = [\"admin@example.com\"]\n}\nresource \"vault_pkiexternalca_secretbackendrole\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n name = \"example-role\"\n acme_account_name = vault_pkiexternalca_secretbackendacmeaccount.example.name\n allowed_domains = [\"example.com\"]\n allowed_domain_options = [\"bare_domains\", \"subdomains\"]\n}\nresource \"vault_pkiexternalca_secretbackendorder\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n role_name = vault_pkiexternalca_secretbackendrole.example.name\n identifiers = [\"www.example.com\"]\n}\n# This is an example of fulfilling the http-01 challenge using pebble, an \n# acme testing tool which verifies challenges on port 5002 by default.\n# A real acme server would require the http-01 challenge be fulfilled on\n# port 80, of the real domain name for which the certificate is tied to.\nresource \"null_resource\" \"acme_challenge_server\" {\n triggers = {\n \"token\" = data.vault_pkiexternalca_getsecretbackendorderchallenge.example.token\n \"keyAuthorization\" = data.vault_pkiexternalca_getsecretbackendorderchallenge.example.key_authorization\n }\n}\nresource \"command_local_command\" \"acmeChallengeServerProvisioner0\" {\n depends_on = [null_resource.acme_challenge_server]\n create =\"(\n mkdir -p /tmp/acme-challenge/.well-known/acme-challenge\n /bin/echo -n '${data.vault_pkiexternalca_getsecretbackendorderchallenge.example.key_authorization}' \u003e /tmp/acme-challenge/.well-known/acme-challenge/${data.vault_pkiexternalca_getsecretbackendorderchallenge.example.token}\n cd /tmp/acme-challenge \n (nohup python3 -m http.server 5002 \u003e/dev/null 2\u003e\u00261) \u0026 \n echo $! \u003e /tmp/acme-challenge-server.pid\n sleep 2\n) \u0026\n\"\n}\nresource \"command_local_command\" \"acmeChallengeServerProvisioner1\" {\n depends_on = [command_local_command.acmeChallengeServerProvisioner0]\n create = \"true\"\n update = \"true\"\n delete = \"if [ -f /tmp/acme-challenge-server.pid ]; then\\n kill $(cat /tmp/acme-challenge-server.pid) 2\u003e/dev/null || true\\n rm -f /tmp/acme-challenge-server.pid\\nfi\\nrm -rf /tmp/acme-challenge\\n\"\n}\nresource \"vault_pkiexternalca_secretbackendorderchallengefulfilled\" \"example\" {\n depends_on = [null_resource.acme_challenge_server]\n mount = vault_mount.pki-external-ca.path\n role_name = vault_pkiexternalca_secretbackendrole.example.name\n order_id = vault_pkiexternalca_secretbackendorder.example.order_id\n challenge_type = \"http-01\"\n identifier = \"www.example.com\"\n}\n# Fetch the certificate after challenges are fulfilled\nresource \"vault_pkiexternalca_secretbackendordercertificate\" \"example\" {\n depends_on = [vault_pkiexternalca_secretbackendorderchallengefulfilled.example]\n mount = vault_mount.pki-external-ca.path\n role_name = vault_pkiexternalca_secretbackendrole.example.name\n order_id = vault_pkiexternalca_secretbackendorder.example.order_id\n}\n# Retrieve and fulfill challenges (simplified)\n# Use the certificate\noutput \"certificate\" {\n value = vault_pkiexternalca_secretbackendordercertificate.example.certificate\n}\noutput \"privateKey\" {\n value = vault_pkiexternalca_secretbackendordercertificate.example.private_key\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRole;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrder;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderArgs;\nimport com.pulumi.vault.pkiexternalca.PkiexternalcaFunctions;\nimport com.pulumi.vault.pkiexternalca.inputs.GetSecretBackendOrderChallengeArgs;\nimport com.pulumi.null.Resource;\nimport com.pulumi.null.ResourceArgs;\nimport com.pulumi.command.local.Command;\nimport com.pulumi.command.local.CommandArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilled;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilledArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderCertificate;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderCertificateArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki_external_ca = new Mount(\"pki-external-ca\", MountArgs.builder()\n .path(\"pki-external-ca\")\n .type(\"pki-external-ca\")\n .build());\n\n var exampleSecretBackendAcmeAccount = new SecretBackendAcmeAccount(\"exampleSecretBackendAcmeAccount\", SecretBackendAcmeAccountArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"my-acme-account\")\n .directoryUrl(\"https://acme-v02.api.letsencrypt.org/directory\")\n .emailContacts(\"admin@example.com\")\n .build());\n\n var exampleSecretBackendRole = new SecretBackendRole(\"exampleSecretBackendRole\", SecretBackendRoleArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"example-role\")\n .acmeAccountName(exampleSecretBackendAcmeAccount.name())\n .allowedDomains(\"example.com\")\n .allowedDomainOptions( \n \"bare_domains\",\n \"subdomains\")\n .build());\n\n var exampleSecretBackendOrder = new SecretBackendOrder(\"exampleSecretBackendOrder\", SecretBackendOrderArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleSecretBackendRole.name())\n .identifiers(\"www.example.com\")\n .build());\n\n // Retrieve and fulfill challenges (simplified)\n final var example = PkiexternalcaFunctions.getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleSecretBackendRole.name())\n .orderId(exampleSecretBackendOrder.orderId())\n .challengeType(\"http-01\")\n .identifier(\"www.example.com\")\n .build());\n\n // This is an example of fulfilling the http-01 challenge using pebble, an \n // acme testing tool which verifies challenges on port 5002 by default.\n // A real acme server would require the http-01 challenge be fulfilled on\n // port 80, of the real domain name for which the certificate is tied to.\n var acmeChallengeServer = new Resource(\"acmeChallengeServer\", ResourceArgs.builder()\n .triggers(Map.ofEntries(\n Map.entry(\"token\", example.token()),\n Map.entry(\"keyAuthorization\", example.keyAuthorization())\n ))\n .build());\n\n var acmeChallengeServerProvisioner0 = new Command(\"acmeChallengeServerProvisioner0\", CommandArgs.builder()\n .create(\"\"\"\n(\n mkdir -p /tmp/acme-challenge/.well-known/acme-challenge\n /bin/echo -n '%s' \u003e /tmp/acme-challenge/.well-known/acme-challenge/%s\n cd /tmp/acme-challenge \n (nohup python3 -m http.server 5002 \u003e/dev/null 2\u003e\u00261) \u0026 \n echo $! \u003e /tmp/acme-challenge-server.pid\n sleep 2\n) \u0026\n\", example.keyAuthorization(),example.token()))\n .build(), CustomResourceOptions.builder()\n .dependsOn(Arrays.asList(acmeChallengeServer))\n .build());\n\n var acmeChallengeServerProvisioner1 = new Command(\"acmeChallengeServerProvisioner1\", CommandArgs.builder()\n .create(\"true\")\n .update(\"true\")\n .delete(\"\"\"\nif [ -f /tmp/acme-challenge-server.pid ]; then\n kill $(cat /tmp/acme-challenge-server.pid) 2\u003e/dev/null || true\n rm -f /tmp/acme-challenge-server.pid\nfi\nrm -rf /tmp/acme-challenge\n \"\"\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(Arrays.asList(acmeChallengeServerProvisioner0))\n .build());\n\n var exampleSecretBackendOrderChallengeFulfilled = new SecretBackendOrderChallengeFulfilled(\"exampleSecretBackendOrderChallengeFulfilled\", SecretBackendOrderChallengeFulfilledArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleSecretBackendRole.name())\n .orderId(exampleSecretBackendOrder.orderId())\n .challengeType(\"http-01\")\n .identifier(\"www.example.com\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(acmeChallengeServer)\n .build());\n\n // Fetch the certificate after challenges are fulfilled\n var exampleSecretBackendOrderCertificate = new SecretBackendOrderCertificate(\"exampleSecretBackendOrderCertificate\", SecretBackendOrderCertificateArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleSecretBackendRole.name())\n .orderId(exampleSecretBackendOrder.orderId())\n .build(), CustomResourceOptions.builder()\n .dependsOn(exampleSecretBackendOrderChallengeFulfilled)\n .build());\n\n ctx.export(\"certificate\", exampleSecretBackendOrderCertificate.certificate());\n ctx.export(\"privateKey\", exampleSecretBackendOrderCertificate.privateKey());\n }\n}\n```\n```yaml\nresources:\n pki-external-ca:\n type: vault:Mount\n properties:\n path: pki-external-ca\n type: pki-external-ca\n exampleSecretBackendAcmeAccount:\n type: vault:pkiexternalca:SecretBackendAcmeAccount\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: my-acme-account\n directoryUrl: https://acme-v02.api.letsencrypt.org/directory\n emailContacts:\n - admin@example.com\n exampleSecretBackendRole:\n type: vault:pkiexternalca:SecretBackendRole\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: example-role\n acmeAccountName: ${exampleSecretBackendAcmeAccount.name}\n allowedDomains:\n - example.com\n allowedDomainOptions:\n - bare_domains\n - subdomains\n exampleSecretBackendOrder:\n type: vault:pkiexternalca:SecretBackendOrder\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleSecretBackendRole.name}\n identifiers:\n - www.example.com\n # This is an example of fulfilling the http-01 challenge using pebble, an \n # acme testing tool which verifies challenges on port 5002 by default.\n # A real acme server would require the http-01 challenge be fulfilled on\n # port 80, of the real domain name for which the certificate is tied to.\n acmeChallengeServer:\n type: null:Resource\n name: acme_challenge_server\n properties:\n triggers:\n token: ${example.token}\n keyAuthorization: ${example.keyAuthorization}\n acmeChallengeServerProvisioner0:\n type: command:local:Command\n properties:\n create: \"(\\n mkdir -p /tmp/acme-challenge/.well-known/acme-challenge\\n /bin/echo -n '${example.keyAuthorization}' \u003e /tmp/acme-challenge/.well-known/acme-challenge/${example.token}\\n cd /tmp/acme-challenge \\n (nohup python3 -m http.server 5002 \u003e/dev/null 2\u003e\u00261) \u0026 \\n echo $! \u003e /tmp/acme-challenge-server.pid\\n sleep 2\\n) \u0026\\n\"\n options:\n dependsOn:\n - ${acmeChallengeServer}\n acmeChallengeServerProvisioner1:\n type: command:local:Command\n properties:\n create: 'true'\n update: 'true'\n delete: |\n if [ -f /tmp/acme-challenge-server.pid ]; then\n kill $(cat /tmp/acme-challenge-server.pid) 2\u003e/dev/null || true\n rm -f /tmp/acme-challenge-server.pid\n fi\n rm -rf /tmp/acme-challenge\n options:\n dependsOn:\n - ${acmeChallengeServerProvisioner0}\n exampleSecretBackendOrderChallengeFulfilled:\n type: vault:pkiexternalca:SecretBackendOrderChallengeFulfilled\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleSecretBackendRole.name}\n orderId: ${exampleSecretBackendOrder.orderId}\n challengeType: http-01\n identifier: www.example.com\n options:\n dependsOn:\n - ${acmeChallengeServer}\n # Fetch the certificate after challenges are fulfilled\n exampleSecretBackendOrderCertificate:\n type: vault:pkiexternalca:SecretBackendOrderCertificate\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleSecretBackendRole.name}\n orderId: ${exampleSecretBackendOrder.orderId}\n options:\n dependsOn:\n - ${exampleSecretBackendOrderChallengeFulfilled}\nvariables:\n # Retrieve and fulfill challenges (simplified)\n example:\n fn::invoke:\n function: vault:pkiexternalca:getSecretBackendOrderChallenge\n arguments:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleSecretBackendRole.name}\n orderId: ${exampleSecretBackendOrder.orderId}\n challengeType: http-01\n identifier: www.example.com\noutputs:\n # Use the certificate\n certificate: ${exampleSecretBackendOrderCertificate.certificate}\n privateKey: ${exampleSecretBackendOrderCertificate.privateKey}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPKI External CA order certificates can be imported using the format `\u003cmount\u003e/role/\u003crole_name\u003e/order/\u003corder_id\u003e/certificate`, e.g.\n\n```sh\n$ pulumi import vault:pkiexternalca/secretBackendOrderCertificate:SecretBackendOrderCertificate example pki-external-ca/role/example-role/order/abc123/certificate\n```\n\n\u003e **Note** This resource polls the order status with a timeout. If the order does not complete within the polling period, the resource creation will fail. Ensure all challenges are properly fulfilled before creating this resource.\n\n", "properties": { "caChains": { "type": "array", "items": { "type": "string" }, "description": "List of PEM-encoded certificates in the CA chain.\n" }, "certificate": { "type": "string", "description": "The PEM-encoded certificate issued by the external CA.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "orderId": { "type": "string", "description": "The unique identifier for the ACME order.\n" }, "privateKey": { "type": "string", "description": "The PEM-encoded private key. This is only available if the order was created using the identifier workflow (not with a CSR). If a CSR was provided, the private key must be managed separately.\n", "secret": true }, "roleName": { "type": "string", "description": "Name of the role associated with the order.\n" }, "serialNumber": { "type": "string", "description": "The serial number of the issued certificate.\n" } }, "required": [ "caChains", "certificate", "mount", "orderId", "privateKey", "roleName", "serialNumber" ], "inputProperties": { "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "orderId": { "type": "string", "description": "The unique identifier for the ACME order.\n" }, "roleName": { "type": "string", "description": "Name of the role associated with the order.\n" } }, "requiredInputs": [ "mount", "orderId", "roleName" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendOrderCertificate resources.\n", "properties": { "caChains": { "type": "array", "items": { "type": "string" }, "description": "List of PEM-encoded certificates in the CA chain.\n" }, "certificate": { "type": "string", "description": "The PEM-encoded certificate issued by the external CA.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "orderId": { "type": "string", "description": "The unique identifier for the ACME order.\n" }, "privateKey": { "type": "string", "description": "The PEM-encoded private key. This is only available if the order was created using the identifier workflow (not with a CSR). If a CSR was provided, the private key must be managed separately.\n", "secret": true }, "roleName": { "type": "string", "description": "Name of the role associated with the order.\n" }, "serialNumber": { "type": "string", "description": "The serial number of the issued certificate.\n" } }, "type": "object" } }, "vault:pkiexternalca/secretBackendOrderChallengeFulfilled:SecretBackendOrderChallengeFulfilled": { "description": "Marks an ACME challenge as fulfilled for a specific identifier in an order. This resource notifies Vault that the challenge has been completed and the ACME server can now validate it.\n\n\u003e **Note** This resource should be used after you have completed the challenge requirements (e.g., placed the HTTP-01 challenge file, created the DNS-01 TXT record, or configured the TLS-ALPN-01 certificate). Use the \u003cspan pulumi-lang-nodejs=\"`vault.pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-dotnet=\"`vault.pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-go=\"`pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-python=\"`pkiexternalca_get_secret_backend_order_challenge`\" pulumi-lang-yaml=\"`vault.pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-java=\"`vault.pkiexternalca.getSecretBackendOrderChallenge`\" pulumi-lang-hcl=\"`data.vault_pki_external_ca_secret_backend_order_challenge`\"\u003e`vault.pkiexternalca.getSecretBackendOrderChallenge`\u003c/span\u003e data source to retrieve the challenge details first.\n\n## Example Usage\n\n### With HTTP-01 Challenge\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as local from \"@pulumi/local\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki_external_ca = new vault.Mount(\"pki-external-ca\", {\n path: \"pki-external-ca\",\n type: \"pki-external-ca\",\n});\nconst exampleSecretBackendAcmeAccount = new vault.pkiexternalca.SecretBackendAcmeAccount(\"example\", {\n mount: pki_external_ca.path,\n name: \"my-acme-account\",\n directoryUrl: \"https://acme-v02.api.letsencrypt.org/directory\",\n emailContacts: [\"admin@example.com\"],\n});\nconst exampleSecretBackendRole = new vault.pkiexternalca.SecretBackendRole(\"example\", {\n mount: pki_external_ca.path,\n name: \"example-role\",\n acmeAccountName: exampleSecretBackendAcmeAccount.name,\n allowedDomains: [\"example.com\"],\n allowedDomainOptions: [\n \"bare_domains\",\n \"subdomains\",\n ],\n allowedChallengeTypes: [\"http-01\"],\n});\nconst exampleSecretBackendOrder = new vault.pkiexternalca.SecretBackendOrder(\"example\", {\n mount: pki_external_ca.path,\n roleName: exampleSecretBackendRole.name,\n identifiers: [\"www.example.com\"],\n});\n// Retrieve challenge details\nconst example = vault.pkiexternalca.getSecretBackendOrderChallengeOutput({\n mount: pki_external_ca.path,\n roleName: exampleSecretBackendRole.name,\n orderId: exampleSecretBackendOrder.orderId,\n challengeType: \"http-01\",\n identifier: \"www.example.com\",\n});\n// Deploy the challenge (example using local_file)\nconst challenge = new local.index.File(\"challenge\", {\n filename: `/var/www/html/.well-known/acme-challenge/${example.token}`,\n content: example.keyAuthorization,\n});\n// Mark challenge as fulfilled after deployment\nconst exampleSecretBackendOrderChallengeFulfilled = new vault.pkiexternalca.SecretBackendOrderChallengeFulfilled(\"example\", {\n mount: pki_external_ca.path,\n roleName: exampleSecretBackendRole.name,\n orderId: exampleSecretBackendOrder.orderId,\n challengeType: \"http-01\",\n identifier: \"www.example.com\",\n}, {\n dependsOn: [challenge],\n});\n```\n```python\nimport pulumi\nimport pulumi_local as local\nimport pulumi_vault as vault\n\npki_external_ca = vault.Mount(\"pki-external-ca\",\n path=\"pki-external-ca\",\n type=\"pki-external-ca\")\nexample_secret_backend_acme_account = vault.pkiexternalca.SecretBackendAcmeAccount(\"example\",\n mount=pki_external_ca.path,\n name=\"my-acme-account\",\n directory_url=\"https://acme-v02.api.letsencrypt.org/directory\",\n email_contacts=[\"admin@example.com\"])\nexample_secret_backend_role = vault.pkiexternalca.SecretBackendRole(\"example\",\n mount=pki_external_ca.path,\n name=\"example-role\",\n acme_account_name=example_secret_backend_acme_account.name,\n allowed_domains=[\"example.com\"],\n allowed_domain_options=[\n \"bare_domains\",\n \"subdomains\",\n ],\n allowed_challenge_types=[\"http-01\"])\nexample_secret_backend_order = vault.pkiexternalca.SecretBackendOrder(\"example\",\n mount=pki_external_ca.path,\n role_name=example_secret_backend_role.name,\n identifiers=[\"www.example.com\"])\n# Retrieve challenge details\nexample = vault.pkiexternalca.get_secret_backend_order_challenge_output(mount=pki_external_ca.path,\n role_name=example_secret_backend_role.name,\n order_id=example_secret_backend_order.order_id,\n challenge_type=\"http-01\",\n identifier=\"www.example.com\")\n# Deploy the challenge (example using local_file)\nchallenge = local.File(\"challenge\",\n filename=f/var/www/html/.well-known/acme-challenge/{example.token},\n content=example.key_authorization)\n# Mark challenge as fulfilled after deployment\nexample_secret_backend_order_challenge_fulfilled = vault.pkiexternalca.SecretBackendOrderChallengeFulfilled(\"example\",\n mount=pki_external_ca.path,\n role_name=example_secret_backend_role.name,\n order_id=example_secret_backend_order.order_id,\n challenge_type=\"http-01\",\n identifier=\"www.example.com\",\n opts = pulumi.ResourceOptions(depends_on=[challenge]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Local = Pulumi.Local;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki_external_ca = new Vault.Mount(\"pki-external-ca\", new()\n {\n Path = \"pki-external-ca\",\n Type = \"pki-external-ca\",\n });\n\n var exampleSecretBackendAcmeAccount = new Vault.PkiExternalCa.SecretBackendAcmeAccount(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"my-acme-account\",\n DirectoryUrl = \"https://acme-v02.api.letsencrypt.org/directory\",\n EmailContacts = new[]\n {\n \"admin@example.com\",\n },\n });\n\n var exampleSecretBackendRole = new Vault.PkiExternalCa.SecretBackendRole(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"example-role\",\n AcmeAccountName = exampleSecretBackendAcmeAccount.Name,\n AllowedDomains = new[]\n {\n \"example.com\",\n },\n AllowedDomainOptions = new[]\n {\n \"bare_domains\",\n \"subdomains\",\n },\n AllowedChallengeTypes = new[]\n {\n \"http-01\",\n },\n });\n\n var exampleSecretBackendOrder = new Vault.PkiExternalCa.SecretBackendOrder(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleSecretBackendRole.Name,\n Identifiers = new[]\n {\n \"www.example.com\",\n },\n });\n\n // Retrieve challenge details\n var example = Vault.PkiExternalCa.GetSecretBackendOrderChallenge.Invoke(new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleSecretBackendRole.Name,\n OrderId = exampleSecretBackendOrder.OrderId,\n ChallengeType = \"http-01\",\n Identifier = \"www.example.com\",\n });\n\n // Deploy the challenge (example using local_file)\n var challenge = new Local.File(\"challenge\", new()\n {\n Filename = $\"/var/www/html/.well-known/acme-challenge/{example.Apply(getSecretBackendOrderChallengeResult =\u003e getSecretBackendOrderChallengeResult.Token)}\",\n Content = example.Apply(getSecretBackendOrderChallengeResult =\u003e getSecretBackendOrderChallengeResult.KeyAuthorization),\n });\n\n // Mark challenge as fulfilled after deployment\n var exampleSecretBackendOrderChallengeFulfilled = new Vault.PkiExternalCa.SecretBackendOrderChallengeFulfilled(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleSecretBackendRole.Name,\n OrderId = exampleSecretBackendOrder.OrderId,\n ChallengeType = \"http-01\",\n Identifier = \"www.example.com\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n challenge,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-local/sdk/go/local\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki_external_ca, err := vault.NewMount(ctx, \"pki-external-ca\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-external-ca\"),\n\t\t\tType: pulumi.String(\"pki-external-ca\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendAcmeAccount, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, \"example\", \u0026pkiexternalca.SecretBackendAcmeAccountArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tName: pulumi.String(\"my-acme-account\"),\n\t\t\tDirectoryUrl: pulumi.String(\"https://acme-v02.api.letsencrypt.org/directory\"),\n\t\t\tEmailContacts: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"admin@example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendRole, err := pkiexternalca.NewSecretBackendRole(ctx, \"example\", \u0026pkiexternalca.SecretBackendRoleArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tName: pulumi.String(\"example-role\"),\n\t\t\tAcmeAccountName: exampleSecretBackendAcmeAccount.Name,\n\t\t\tAllowedDomains: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"example.com\"),\n\t\t\t},\n\t\t\tAllowedDomainOptions: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"bare_domains\"),\n\t\t\t\tpulumi.String(\"subdomains\"),\n\t\t\t},\n\t\t\tAllowedChallengeTypes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"http-01\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texampleSecretBackendOrder, err := pkiexternalca.NewSecretBackendOrder(ctx, \"example\", \u0026pkiexternalca.SecretBackendOrderArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tRoleName: exampleSecretBackendRole.Name,\n\t\t\tIdentifiers: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"www.example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// Retrieve challenge details\n\t\texample := pkiexternalca.GetSecretBackendOrderChallengeOutput(ctx, pkiexternalca.GetSecretBackendOrderChallengeOutputArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tRoleName: exampleSecretBackendRole.Name,\n\t\t\tOrderId: exampleSecretBackendOrder.OrderId,\n\t\t\tChallengeType: pulumi.String(\"http-01\"),\n\t\t\tIdentifier: pulumi.String(\"www.example.com\"),\n\t\t}, nil)\n\t\t// Deploy the challenge (example using local_file)\n\t\tchallenge, err := local.NewFile(ctx, \"challenge\", \u0026local.FileArgs{\n\t\t\tFilename: pulumi.Sprintf(\"/var/www/html/.well-known/acme-challenge/%v\", example.Token),\n\t\t\tContent: example.KeyAuthorization,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// Mark challenge as fulfilled after deployment\n\t\t_, err = pkiexternalca.NewSecretBackendOrderChallengeFulfilled(ctx, \"example\", \u0026pkiexternalca.SecretBackendOrderChallengeFulfilledArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tRoleName: exampleSecretBackendRole.Name,\n\t\t\tOrderId: exampleSecretBackendOrder.OrderId,\n\t\t\tChallengeType: pulumi.String(\"http-01\"),\n\t\t\tIdentifier: pulumi.String(\"www.example.com\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tchallenge,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\ndata \"vault_pkiexternalca_getsecretbackendorderchallenge\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n role_name = vault_pkiexternalca_secretbackendrole.example.name\n order_id = vault_pkiexternalca_secretbackendorder.example.order_id\n challenge_type = \"http-01\"\n identifier = \"www.example.com\"\n}\n\nresource \"vault_mount\" \"pki-external-ca\" {\n path = \"pki-external-ca\"\n type = \"pki-external-ca\"\n}\nresource \"vault_pkiexternalca_secretbackendacmeaccount\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n name = \"my-acme-account\"\n directory_url = \"https://acme-v02.api.letsencrypt.org/directory\"\n email_contacts = [\"admin@example.com\"]\n}\nresource \"vault_pkiexternalca_secretbackendrole\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n name = \"example-role\"\n acme_account_name = vault_pkiexternalca_secretbackendacmeaccount.example.name\n allowed_domains = [\"example.com\"]\n allowed_domain_options = [\"bare_domains\", \"subdomains\"]\n allowed_challenge_types = [\"http-01\"]\n}\nresource \"vault_pkiexternalca_secretbackendorder\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n role_name = vault_pkiexternalca_secretbackendrole.example.name\n identifiers = [\"www.example.com\"]\n}\n# Deploy the challenge (example using local_file)\nresource \"local_file\" \"challenge\" {\n filename =\"/var/www/html/.well-known/acme-challenge/${data.vault_pkiexternalca_getsecretbackendorderchallenge.example.token}\"\n content = data.vault_pkiexternalca_getsecretbackendorderchallenge.example.key_authorization\n}\n# Mark challenge as fulfilled after deployment\nresource \"vault_pkiexternalca_secretbackendorderchallengefulfilled\" \"example\" {\n depends_on = [local_file.challenge]\n mount = vault_mount.pki-external-ca.path\n role_name = vault_pkiexternalca_secretbackendrole.example.name\n order_id = vault_pkiexternalca_secretbackendorder.example.order_id\n challenge_type = \"http-01\"\n identifier = \"www.example.com\"\n}\n# Retrieve challenge details\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRole;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrder;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderArgs;\nimport com.pulumi.vault.pkiexternalca.PkiexternalcaFunctions;\nimport com.pulumi.vault.pkiexternalca.inputs.GetSecretBackendOrderChallengeArgs;\nimport com.pulumi.local.File;\nimport com.pulumi.local.FileArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilled;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilledArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki_external_ca = new Mount(\"pki-external-ca\", MountArgs.builder()\n .path(\"pki-external-ca\")\n .type(\"pki-external-ca\")\n .build());\n\n var exampleSecretBackendAcmeAccount = new SecretBackendAcmeAccount(\"exampleSecretBackendAcmeAccount\", SecretBackendAcmeAccountArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"my-acme-account\")\n .directoryUrl(\"https://acme-v02.api.letsencrypt.org/directory\")\n .emailContacts(\"admin@example.com\")\n .build());\n\n var exampleSecretBackendRole = new SecretBackendRole(\"exampleSecretBackendRole\", SecretBackendRoleArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"example-role\")\n .acmeAccountName(exampleSecretBackendAcmeAccount.name())\n .allowedDomains(\"example.com\")\n .allowedDomainOptions( \n \"bare_domains\",\n \"subdomains\")\n .allowedChallengeTypes(\"http-01\")\n .build());\n\n var exampleSecretBackendOrder = new SecretBackendOrder(\"exampleSecretBackendOrder\", SecretBackendOrderArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleSecretBackendRole.name())\n .identifiers(\"www.example.com\")\n .build());\n\n // Retrieve challenge details\n final var example = PkiexternalcaFunctions.getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleSecretBackendRole.name())\n .orderId(exampleSecretBackendOrder.orderId())\n .challengeType(\"http-01\")\n .identifier(\"www.example.com\")\n .build());\n\n // Deploy the challenge (example using local_file)\n var challenge = new File(\"challenge\", FileArgs.builder()\n .filename(String.format(\"/var/www/html/.well-known/acme-challenge/%s\", example.token()))\n .content(example.keyAuthorization())\n .build());\n\n // Mark challenge as fulfilled after deployment\n var exampleSecretBackendOrderChallengeFulfilled = new SecretBackendOrderChallengeFulfilled(\"exampleSecretBackendOrderChallengeFulfilled\", SecretBackendOrderChallengeFulfilledArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleSecretBackendRole.name())\n .orderId(exampleSecretBackendOrder.orderId())\n .challengeType(\"http-01\")\n .identifier(\"www.example.com\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(challenge)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki-external-ca:\n type: vault:Mount\n properties:\n path: pki-external-ca\n type: pki-external-ca\n exampleSecretBackendAcmeAccount:\n type: vault:pkiexternalca:SecretBackendAcmeAccount\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: my-acme-account\n directoryUrl: https://acme-v02.api.letsencrypt.org/directory\n emailContacts:\n - admin@example.com\n exampleSecretBackendRole:\n type: vault:pkiexternalca:SecretBackendRole\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: example-role\n acmeAccountName: ${exampleSecretBackendAcmeAccount.name}\n allowedDomains:\n - example.com\n allowedDomainOptions:\n - bare_domains\n - subdomains\n allowedChallengeTypes:\n - http-01\n exampleSecretBackendOrder:\n type: vault:pkiexternalca:SecretBackendOrder\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleSecretBackendRole.name}\n identifiers:\n - www.example.com\n # Deploy the challenge (example using local_file)\n challenge:\n type: local:File\n properties:\n filename: /var/www/html/.well-known/acme-challenge/${example.token}\n content: ${example.keyAuthorization}\n # Mark challenge as fulfilled after deployment\n exampleSecretBackendOrderChallengeFulfilled:\n type: vault:pkiexternalca:SecretBackendOrderChallengeFulfilled\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleSecretBackendRole.name}\n orderId: ${exampleSecretBackendOrder.orderId}\n challengeType: http-01\n identifier: www.example.com\n options:\n dependsOn:\n - ${challenge}\nvariables:\n # Retrieve challenge details\n example:\n fn::invoke:\n function: vault:pkiexternalca:getSecretBackendOrderChallenge\n arguments:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleSecretBackendRole.name}\n orderId: ${exampleSecretBackendOrder.orderId}\n challengeType: http-01\n identifier: www.example.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\n### With DNS-01 Challenge\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as aws from \"@pulumi/aws\";\nimport * as vault from \"@pulumi/vault\";\n\n// Retrieve DNS challenge details\nconst dns = vault.pkiexternalca.getSecretBackendOrderChallenge({\n mount: pki_external_ca.path,\n roleName: exampleVaultPkiExternalCaSecretBackendRole.name,\n orderId: example.orderId,\n challengeType: \"dns-01\",\n identifier: \"www.example.com\",\n});\n// Create DNS TXT record (example using AWS Route53)\nconst acmeChallenge = new aws.index.Route53Record(\"acme_challenge\", {\n zoneId: exampleAwsRoute53Zone.zoneId,\n name: \"_acme-challenge.www.example.com\",\n type: \"TXT\",\n ttl: 60,\n records: [dns.keyAuthorization],\n});\n// Mark challenge as fulfilled\nconst dnsSecretBackendOrderChallengeFulfilled = new vault.pkiexternalca.SecretBackendOrderChallengeFulfilled(\"dns\", {\n mount: pki_external_ca.path,\n roleName: exampleVaultPkiExternalCaSecretBackendRole.name,\n orderId: example.orderId,\n challengeType: \"dns-01\",\n identifier: \"www.example.com\",\n}, {\n dependsOn: [acmeChallenge],\n});\n```\n```python\nimport pulumi\nimport pulumi_aws as aws\nimport pulumi_vault as vault\n\n# Retrieve DNS challenge details\ndns = vault.pkiexternalca.get_secret_backend_order_challenge(mount=pki_external_ca[\"path\"],\n role_name=example_vault_pki_external_ca_secret_backend_role[\"name\"],\n order_id=example[\"orderId\"],\n challenge_type=\"dns-01\",\n identifier=\"www.example.com\")\n# Create DNS TXT record (example using AWS Route53)\nacme_challenge = aws.Route53Record(\"acme_challenge\",\n zone_id=example_aws_route53_zone.zone_id,\n name=_acme-challenge.www.example.com,\n type=TXT,\n ttl=60,\n records=[dns.key_authorization])\n# Mark challenge as fulfilled\ndns_secret_backend_order_challenge_fulfilled = vault.pkiexternalca.SecretBackendOrderChallengeFulfilled(\"dns\",\n mount=pki_external_ca[\"path\"],\n role_name=example_vault_pki_external_ca_secret_backend_role[\"name\"],\n order_id=example[\"orderId\"],\n challenge_type=\"dns-01\",\n identifier=\"www.example.com\",\n opts = pulumi.ResourceOptions(depends_on=[acme_challenge]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Aws = Pulumi.Aws;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n // Retrieve DNS challenge details\n var dns = Vault.PkiExternalCa.GetSecretBackendOrderChallenge.Invoke(new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleVaultPkiExternalCaSecretBackendRole.Name,\n OrderId = example.OrderId,\n ChallengeType = \"dns-01\",\n Identifier = \"www.example.com\",\n });\n\n // Create DNS TXT record (example using AWS Route53)\n var acmeChallenge = new Aws.Route53Record(\"acme_challenge\", new()\n {\n ZoneId = exampleAwsRoute53Zone.ZoneId,\n Name = \"_acme-challenge.www.example.com\",\n Type = \"TXT\",\n Ttl = 60,\n Records = new[]\n {\n dns.Apply(getSecretBackendOrderChallengeResult =\u003e getSecretBackendOrderChallengeResult.KeyAuthorization),\n },\n });\n\n // Mark challenge as fulfilled\n var dnsSecretBackendOrderChallengeFulfilled = new Vault.PkiExternalCa.SecretBackendOrderChallengeFulfilled(\"dns\", new()\n {\n Mount = pki_external_ca.Path,\n RoleName = exampleVaultPkiExternalCaSecretBackendRole.Name,\n OrderId = example.OrderId,\n ChallengeType = \"dns-01\",\n Identifier = \"www.example.com\",\n }, new CustomResourceOptions\n {\n DependsOn =\n {\n acmeChallenge,\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-aws/sdk/v7/go/aws\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t// Retrieve DNS challenge details\n\t\tdns, err := pkiexternalca.GetSecretBackendOrderChallenge(ctx, \u0026pkiexternalca.GetSecretBackendOrderChallengeArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tRoleName: exampleVaultPkiExternalCaSecretBackendRole.Name,\n\t\t\tOrderId: example.OrderId,\n\t\t\tChallengeType: \"dns-01\",\n\t\t\tIdentifier: \"www.example.com\",\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// Create DNS TXT record (example using AWS Route53)\n\t\tacmeChallenge, err := aws.NewRoute53Record(ctx, \"acme_challenge\", \u0026aws.Route53RecordArgs{\n\t\t\tZoneId: exampleAwsRoute53Zone.ZoneId,\n\t\t\tName: \"_acme-challenge.www.example.com\",\n\t\t\tType: \"TXT\",\n\t\t\tTtl: 60,\n\t\t\tRecords: []*string{\n\t\t\t\tdns.KeyAuthorization,\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t// Mark challenge as fulfilled\n\t\t_, err = pkiexternalca.NewSecretBackendOrderChallengeFulfilled(ctx, \"dns\", \u0026pkiexternalca.SecretBackendOrderChallengeFulfilledArgs{\n\t\t\tMount: pulumi.Any(pki_external_ca.Path),\n\t\t\tRoleName: pulumi.Any(exampleVaultPkiExternalCaSecretBackendRole.Name),\n\t\t\tOrderId: pulumi.Any(example.OrderId),\n\t\t\tChallengeType: pulumi.String(\"dns-01\"),\n\t\t\tIdentifier: pulumi.String(\"www.example.com\"),\n\t\t}, pulumi.DependsOn([]pulumi.Resource{\n\t\t\tacmeChallenge,\n\t\t}))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n aws = {\n source = \"pulumi/aws\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\ndata \"vault_pkiexternalca_getsecretbackendorderchallenge\" \"dns\" {\n mount = pki-external-ca.path\n role_name = exampleVaultPkiExternalCaSecretBackendRole.name\n order_id = example.orderId\n challenge_type = \"dns-01\"\n identifier = \"www.example.com\"\n}\n\n# Create DNS TXT record (example using AWS Route53)\nresource \"aws_route53record\" \"acme_challenge\" {\n zone_id = exampleAwsRoute53Zone.zoneId\n name = \"_acme-challenge.www.example.com\"\n type = \"TXT\"\n ttl = 60\n records = [data.vault_pkiexternalca_getsecretbackendorderchallenge.dns.key_authorization]\n}\n# Mark challenge as fulfilled\nresource \"vault_pkiexternalca_secretbackendorderchallengefulfilled\" \"dns\" {\n depends_on = [aws_route53record.acme_challenge]\n mount = pki-external-ca.path\n role_name = exampleVaultPkiExternalCaSecretBackendRole.name\n order_id = example.orderId\n challenge_type = \"dns-01\"\n identifier = \"www.example.com\"\n}\n# Retrieve DNS challenge details\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.pkiexternalca.PkiexternalcaFunctions;\nimport com.pulumi.vault.pkiexternalca.inputs.GetSecretBackendOrderChallengeArgs;\nimport com.pulumi.aws.Route53Record;\nimport com.pulumi.aws.Route53RecordArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilled;\nimport com.pulumi.vault.pkiexternalca.SecretBackendOrderChallengeFulfilledArgs;\nimport com.pulumi.resources.CustomResourceOptions;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n // Retrieve DNS challenge details\n final var dns = PkiexternalcaFunctions.getSecretBackendOrderChallenge(GetSecretBackendOrderChallengeArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleVaultPkiExternalCaSecretBackendRole.name())\n .orderId(example.orderId())\n .challengeType(\"dns-01\")\n .identifier(\"www.example.com\")\n .build());\n\n // Create DNS TXT record (example using AWS Route53)\n var acmeChallenge = new Route53Record(\"acmeChallenge\", Route53RecordArgs.builder()\n .zoneId(exampleAwsRoute53Zone.zoneId())\n .name(\"_acme-challenge.www.example.com\")\n .type(\"TXT\")\n .ttl(60)\n .records(Arrays.asList(dns.keyAuthorization()))\n .build());\n\n // Mark challenge as fulfilled\n var dnsSecretBackendOrderChallengeFulfilled = new SecretBackendOrderChallengeFulfilled(\"dnsSecretBackendOrderChallengeFulfilled\", SecretBackendOrderChallengeFulfilledArgs.builder()\n .mount(pki_external_ca.path())\n .roleName(exampleVaultPkiExternalCaSecretBackendRole.name())\n .orderId(example.orderId())\n .challengeType(\"dns-01\")\n .identifier(\"www.example.com\")\n .build(), CustomResourceOptions.builder()\n .dependsOn(acmeChallenge)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n # Create DNS TXT record (example using AWS Route53)\n acmeChallenge:\n type: aws:Route53Record\n name: acme_challenge\n properties:\n zoneId: ${exampleAwsRoute53Zone.zoneId}\n name: _acme-challenge.www.example.com\n type: TXT\n ttl: 60\n records:\n - ${dns.keyAuthorization}\n # Mark challenge as fulfilled\n dnsSecretBackendOrderChallengeFulfilled:\n type: vault:pkiexternalca:SecretBackendOrderChallengeFulfilled\n name: dns\n properties:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleVaultPkiExternalCaSecretBackendRole.name}\n orderId: ${example.orderId}\n challengeType: dns-01\n identifier: www.example.com\n options:\n dependsOn:\n - ${acmeChallenge}\nvariables:\n # Retrieve DNS challenge details\n dns:\n fn::invoke:\n function: vault:pkiexternalca:getSecretBackendOrderChallenge\n arguments:\n mount: ${[\"pki-external-ca\"].path}\n roleName: ${exampleVaultPkiExternalCaSecretBackendRole.name}\n orderId: ${example.orderId}\n challengeType: dns-01\n identifier: www.example.com\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPKI External CA order challenge fulfilled resources can be imported using the format `\u003cmount\u003e/role/\u003crole_name\u003e/order/\u003corder_id\u003e/fulfilled-challenge/\u003cchallenge_type\u003e/\u003cidentifier\u003e`, e.g.\n\n```sh\n$ pulumi import vault:pkiexternalca/secretBackendOrderChallengeFulfilled:SecretBackendOrderChallengeFulfilled example pki-external-ca/role/example-role/order/abc123/fulfilled-challenge/http-01/www.example.com\n```\n\n\u003e **Note** This resource represents an action (marking a challenge as fulfilled) rather than a persistent object. Deletion removes it from state without making any API calls, as the action cannot be undone.\n\n", "properties": { "challengeType": { "type": "string", "description": "The type of ACME challenge that was fulfilled. Valid values are `http-01`, `dns-01`, `tls-alpn-01`.\n" }, "identifier": { "type": "string", "description": "The identifier (domain name) for which the challenge was fulfilled.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "orderId": { "type": "string", "description": "The unique identifier for the ACME order.\n" }, "roleName": { "type": "string", "description": "Name of the role associated with the order.\n" } }, "required": [ "challengeType", "identifier", "mount", "orderId", "roleName" ], "inputProperties": { "challengeType": { "type": "string", "description": "The type of ACME challenge that was fulfilled. Valid values are `http-01`, `dns-01`, `tls-alpn-01`.\n" }, "identifier": { "type": "string", "description": "The identifier (domain name) for which the challenge was fulfilled.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "orderId": { "type": "string", "description": "The unique identifier for the ACME order.\n" }, "roleName": { "type": "string", "description": "Name of the role associated with the order.\n" } }, "requiredInputs": [ "challengeType", "identifier", "mount", "orderId", "roleName" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendOrderChallengeFulfilled resources.\n", "properties": { "challengeType": { "type": "string", "description": "The type of ACME challenge that was fulfilled. Valid values are `http-01`, `dns-01`, `tls-alpn-01`.\n" }, "identifier": { "type": "string", "description": "The identifier (domain name) for which the challenge was fulfilled.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "orderId": { "type": "string", "description": "The unique identifier for the ACME order.\n" }, "roleName": { "type": "string", "description": "Name of the role associated with the order.\n" } }, "type": "object" } }, "vault:pkiexternalca/secretBackendRole:SecretBackendRole": { "description": "Manages PKI External CA roles for certificate issuance via ACME. This resource defines the configuration for obtaining certificates from external Certificate Authorities through the ACME protocol.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst pki_external_ca = new vault.Mount(\"pki-external-ca\", {\n path: \"pki-external-ca\",\n type: \"pki-external-ca\",\n});\nconst example = new vault.pkiexternalca.SecretBackendAcmeAccount(\"example\", {\n mount: pki_external_ca.path,\n name: \"my-acme-account\",\n directoryUrl: \"https://acme-v02.api.letsencrypt.org/directory\",\n emailContacts: [\"admin@example.com\"],\n});\nconst exampleSecretBackendRole = new vault.pkiexternalca.SecretBackendRole(\"example\", {\n mount: pki_external_ca.path,\n name: \"example-role\",\n acmeAccountName: example.name,\n allowedDomains: [\n \"example.com\",\n \"*.example.com\",\n ],\n allowedDomainOptions: [\n \"bare_domains\",\n \"subdomains\",\n \"wildcards\",\n ],\n allowedChallengeTypes: [\n \"http-01\",\n \"dns-01\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\npki_external_ca = vault.Mount(\"pki-external-ca\",\n path=\"pki-external-ca\",\n type=\"pki-external-ca\")\nexample = vault.pkiexternalca.SecretBackendAcmeAccount(\"example\",\n mount=pki_external_ca.path,\n name=\"my-acme-account\",\n directory_url=\"https://acme-v02.api.letsencrypt.org/directory\",\n email_contacts=[\"admin@example.com\"])\nexample_secret_backend_role = vault.pkiexternalca.SecretBackendRole(\"example\",\n mount=pki_external_ca.path,\n name=\"example-role\",\n acme_account_name=example.name,\n allowed_domains=[\n \"example.com\",\n \"*.example.com\",\n ],\n allowed_domain_options=[\n \"bare_domains\",\n \"subdomains\",\n \"wildcards\",\n ],\n allowed_challenge_types=[\n \"http-01\",\n \"dns-01\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var pki_external_ca = new Vault.Mount(\"pki-external-ca\", new()\n {\n Path = \"pki-external-ca\",\n Type = \"pki-external-ca\",\n });\n\n var example = new Vault.PkiExternalCa.SecretBackendAcmeAccount(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"my-acme-account\",\n DirectoryUrl = \"https://acme-v02.api.letsencrypt.org/directory\",\n EmailContacts = new[]\n {\n \"admin@example.com\",\n },\n });\n\n var exampleSecretBackendRole = new Vault.PkiExternalCa.SecretBackendRole(\"example\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"example-role\",\n AcmeAccountName = example.Name,\n AllowedDomains = new[]\n {\n \"example.com\",\n \"*.example.com\",\n },\n AllowedDomainOptions = new[]\n {\n \"bare_domains\",\n \"subdomains\",\n \"wildcards\",\n },\n AllowedChallengeTypes = new[]\n {\n \"http-01\",\n \"dns-01\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tpki_external_ca, err := vault.NewMount(ctx, \"pki-external-ca\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"pki-external-ca\"),\n\t\t\tType: pulumi.String(\"pki-external-ca\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\texample, err := pkiexternalca.NewSecretBackendAcmeAccount(ctx, \"example\", \u0026pkiexternalca.SecretBackendAcmeAccountArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tName: pulumi.String(\"my-acme-account\"),\n\t\t\tDirectoryUrl: pulumi.String(\"https://acme-v02.api.letsencrypt.org/directory\"),\n\t\t\tEmailContacts: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"admin@example.com\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = pkiexternalca.NewSecretBackendRole(ctx, \"example\", \u0026pkiexternalca.SecretBackendRoleArgs{\n\t\t\tMount: pki_external_ca.Path,\n\t\t\tName: pulumi.String(\"example-role\"),\n\t\t\tAcmeAccountName: example.Name,\n\t\t\tAllowedDomains: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"example.com\"),\n\t\t\t\tpulumi.String(\"*.example.com\"),\n\t\t\t},\n\t\t\tAllowedDomainOptions: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"bare_domains\"),\n\t\t\t\tpulumi.String(\"subdomains\"),\n\t\t\t\tpulumi.String(\"wildcards\"),\n\t\t\t},\n\t\t\tAllowedChallengeTypes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"http-01\"),\n\t\t\t\tpulumi.String(\"dns-01\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"pki-external-ca\" {\n path = \"pki-external-ca\"\n type = \"pki-external-ca\"\n}\nresource \"vault_pkiexternalca_secretbackendacmeaccount\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n name = \"my-acme-account\"\n directory_url = \"https://acme-v02.api.letsencrypt.org/directory\"\n email_contacts = [\"admin@example.com\"]\n}\nresource \"vault_pkiexternalca_secretbackendrole\" \"example\" {\n mount = vault_mount.pki-external-ca.path\n name = \"example-role\"\n acme_account_name = vault_pkiexternalca_secretbackendacmeaccount.example.name\n allowed_domains = [\"example.com\", \"*.example.com\"]\n allowed_domain_options = [\"bare_domains\", \"subdomains\", \"wildcards\"]\n allowed_challenge_types = [\"http-01\", \"dns-01\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccount;\nimport com.pulumi.vault.pkiexternalca.SecretBackendAcmeAccountArgs;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRole;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var pki_external_ca = new Mount(\"pki-external-ca\", MountArgs.builder()\n .path(\"pki-external-ca\")\n .type(\"pki-external-ca\")\n .build());\n\n var example = new SecretBackendAcmeAccount(\"example\", SecretBackendAcmeAccountArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"my-acme-account\")\n .directoryUrl(\"https://acme-v02.api.letsencrypt.org/directory\")\n .emailContacts(\"admin@example.com\")\n .build());\n\n var exampleSecretBackendRole = new SecretBackendRole(\"exampleSecretBackendRole\", SecretBackendRoleArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"example-role\")\n .acmeAccountName(example.name())\n .allowedDomains( \n \"example.com\",\n \"*.example.com\")\n .allowedDomainOptions( \n \"bare_domains\",\n \"subdomains\",\n \"wildcards\")\n .allowedChallengeTypes( \n \"http-01\",\n \"dns-01\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n pki-external-ca:\n type: vault:Mount\n properties:\n path: pki-external-ca\n type: pki-external-ca\n example:\n type: vault:pkiexternalca:SecretBackendAcmeAccount\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: my-acme-account\n directoryUrl: https://acme-v02.api.letsencrypt.org/directory\n emailContacts:\n - admin@example.com\n exampleSecretBackendRole:\n type: vault:pkiexternalca:SecretBackendRole\n name: example\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: example-role\n acmeAccountName: ${example.name}\n allowedDomains:\n - example.com\n - '*.example.com'\n allowedDomainOptions:\n - bare_domains\n - subdomains\n - wildcards\n allowedChallengeTypes:\n - http-01\n - dns-01\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n\n### With Identity Templates\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst templated = new vault.pkiexternalca.SecretBackendRole(\"templated\", {\n mount: pki_external_ca.path,\n name: \"user-role\",\n acmeAccountName: example.name,\n allowedDomains: [\"{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com\"],\n allowedDomainOptions: [\"bare_domains\"],\n csrGenerateKeyType: \"rsa-2048\",\n csrIdentifierPopulation: \"cn_first\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntemplated = vault.pkiexternalca.SecretBackendRole(\"templated\",\n mount=pki_external_ca[\"path\"],\n name=\"user-role\",\n acme_account_name=example[\"name\"],\n allowed_domains=[\"{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com\"],\n allowed_domain_options=[\"bare_domains\"],\n csr_generate_key_type=\"rsa-2048\",\n csr_identifier_population=\"cn_first\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var templated = new Vault.PkiExternalCa.SecretBackendRole(\"templated\", new()\n {\n Mount = pki_external_ca.Path,\n Name = \"user-role\",\n AcmeAccountName = example.Name,\n AllowedDomains = new[]\n {\n \"{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com\",\n },\n AllowedDomainOptions = new[]\n {\n \"bare_domains\",\n },\n CsrGenerateKeyType = \"rsa-2048\",\n CsrIdentifierPopulation = \"cn_first\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/pkiexternalca\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := pkiexternalca.NewSecretBackendRole(ctx, \"templated\", \u0026pkiexternalca.SecretBackendRoleArgs{\n\t\t\tMount: pulumi.Any(pki_external_ca.Path),\n\t\t\tName: pulumi.String(\"user-role\"),\n\t\t\tAcmeAccountName: pulumi.Any(example.Name),\n\t\t\tAllowedDomains: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com\"),\n\t\t\t},\n\t\t\tAllowedDomainOptions: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"bare_domains\"),\n\t\t\t},\n\t\t\tCsrGenerateKeyType: pulumi.String(\"rsa-2048\"),\n\t\t\tCsrIdentifierPopulation: pulumi.String(\"cn_first\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_pkiexternalca_secretbackendrole\" \"templated\" {\n mount = pki-external-ca.path\n name = \"user-role\"\n acme_account_name = example.name\n allowed_domains = [\"{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com\"]\n allowed_domain_options = [\"bare_domains\"]\n csr_generate_key_type = \"rsa-2048\"\n csr_identifier_population = \"cn_first\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRole;\nimport com.pulumi.vault.pkiexternalca.SecretBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var templated = new SecretBackendRole(\"templated\", SecretBackendRoleArgs.builder()\n .mount(pki_external_ca.path())\n .name(\"user-role\")\n .acmeAccountName(example.name())\n .allowedDomains(\"{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com\")\n .allowedDomainOptions(\"bare_domains\")\n .csrGenerateKeyType(\"rsa-2048\")\n .csrIdentifierPopulation(\"cn_first\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n templated:\n type: vault:pkiexternalca:SecretBackendRole\n properties:\n mount: ${[\"pki-external-ca\"].path}\n name: user-role\n acmeAccountName: ${example.name}\n allowedDomains:\n - '{{identity.entity.aliases.auth_userpass_xxxxx.name}}.example.com'\n allowedDomainOptions:\n - bare_domains\n csrGenerateKeyType: rsa-2048\n csrIdentifierPopulation: cn_first\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nPKI External CA roles can be imported using the format `\u003cmount\u003e/role/\u003cname\u003e`, e.g.\n\n```\n$ terraform import vault_pki_external_ca_secret_backend_role.example pki-external-ca/role/example-role\n\n```", "properties": { "acmeAccountName": { "type": "string", "description": "The ACME account to use when validating certificates.\n" }, "allowedChallengeTypes": { "type": "array", "items": { "type": "string" }, "description": "The list of challenge types that are allowed to be used. Valid values are `http-01`, `dns-01`, `tls-alpn-01`. Defaults to all challenge types.\n" }, "allowedDomainOptions": { "type": "array", "items": { "type": "string" }, "description": "A list of keyword options that influence how values within \u003cspan pulumi-lang-nodejs=\"`allowedDomains`\" pulumi-lang-dotnet=\"`AllowedDomains`\" pulumi-lang-go=\"`allowedDomains`\" pulumi-lang-python=\"`allowed_domains`\" pulumi-lang-yaml=\"`allowedDomains`\" pulumi-lang-java=\"`allowedDomains`\" pulumi-lang-hcl=\"`allowed_domains`\"\u003e`allowedDomains`\u003c/span\u003e are interpreted against the requested set of identifiers from the client. Valid values are:\n" }, "allowedDomains": { "type": "array", "items": { "type": "string" }, "description": "A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., `{{identity.entity.aliases.\u003cmount accessor\u003e.name}}`).\n" }, "creationDate": { "type": "string", "description": "The date and time the role was created in RFC3339 format.\n" }, "csrGenerateKeyType": { "type": "string", "description": "The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are `ec-256`, `ec-384`, `ec-521`, `rsa-2048`, `rsa-4096`. Defaults to `ec-256`.\n" }, "csrIdentifierPopulation": { "type": "string", "description": "The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:\n" }, "force": { "type": "boolean", "description": "Force deletion even when active orders exist. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "lastUpdateDate": { "type": "string", "description": "The date and time the role was last updated in RFC3339 format.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "name": { "type": "string", "description": "Name of the role. Must be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "required": [ "acmeAccountName", "allowedChallengeTypes", "allowedDomainOptions", "creationDate", "csrGenerateKeyType", "csrIdentifierPopulation", "force", "lastUpdateDate", "mount", "name" ], "inputProperties": { "acmeAccountName": { "type": "string", "description": "The ACME account to use when validating certificates.\n" }, "allowedChallengeTypes": { "type": "array", "items": { "type": "string" }, "description": "The list of challenge types that are allowed to be used. Valid values are `http-01`, `dns-01`, `tls-alpn-01`. Defaults to all challenge types.\n" }, "allowedDomainOptions": { "type": "array", "items": { "type": "string" }, "description": "A list of keyword options that influence how values within \u003cspan pulumi-lang-nodejs=\"`allowedDomains`\" pulumi-lang-dotnet=\"`AllowedDomains`\" pulumi-lang-go=\"`allowedDomains`\" pulumi-lang-python=\"`allowed_domains`\" pulumi-lang-yaml=\"`allowedDomains`\" pulumi-lang-java=\"`allowedDomains`\" pulumi-lang-hcl=\"`allowed_domains`\"\u003e`allowedDomains`\u003c/span\u003e are interpreted against the requested set of identifiers from the client. Valid values are:\n" }, "allowedDomains": { "type": "array", "items": { "type": "string" }, "description": "A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., `{{identity.entity.aliases.\u003cmount accessor\u003e.name}}`).\n" }, "csrGenerateKeyType": { "type": "string", "description": "The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are `ec-256`, `ec-384`, `ec-521`, `rsa-2048`, `rsa-4096`. Defaults to `ec-256`.\n" }, "csrIdentifierPopulation": { "type": "string", "description": "The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:\n" }, "force": { "type": "boolean", "description": "Force deletion even when active orders exist. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "name": { "type": "string", "description": "Name of the role. Must be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "requiredInputs": [ "acmeAccountName", "mount" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRole resources.\n", "properties": { "acmeAccountName": { "type": "string", "description": "The ACME account to use when validating certificates.\n" }, "allowedChallengeTypes": { "type": "array", "items": { "type": "string" }, "description": "The list of challenge types that are allowed to be used. Valid values are `http-01`, `dns-01`, `tls-alpn-01`. Defaults to all challenge types.\n" }, "allowedDomainOptions": { "type": "array", "items": { "type": "string" }, "description": "A list of keyword options that influence how values within \u003cspan pulumi-lang-nodejs=\"`allowedDomains`\" pulumi-lang-dotnet=\"`AllowedDomains`\" pulumi-lang-go=\"`allowedDomains`\" pulumi-lang-python=\"`allowed_domains`\" pulumi-lang-yaml=\"`allowedDomains`\" pulumi-lang-java=\"`allowedDomains`\" pulumi-lang-hcl=\"`allowed_domains`\"\u003e`allowedDomains`\u003c/span\u003e are interpreted against the requested set of identifiers from the client. Valid values are:\n" }, "allowedDomains": { "type": "array", "items": { "type": "string" }, "description": "A list of domains the role will accept certificates for. May contain templates, as with ACL Path Templating (e.g., `{{identity.entity.aliases.\u003cmount accessor\u003e.name}}`).\n" }, "creationDate": { "type": "string", "description": "The date and time the role was created in RFC3339 format.\n" }, "csrGenerateKeyType": { "type": "string", "description": "The key type and size/parameters to use when generating a new key if running in the identifier workflow. Valid values are `ec-256`, `ec-384`, `ec-521`, `rsa-2048`, `rsa-4096`. Defaults to `ec-256`.\n" }, "csrIdentifierPopulation": { "type": "string", "description": "The technique used to populate a CSR from the provided identifiers in the identifier workflow. Valid values are:\n" }, "force": { "type": "boolean", "description": "Force deletion even when active orders exist. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "lastUpdateDate": { "type": "string", "description": "The date and time the role was last updated in RFC3339 format.\n" }, "mount": { "type": "string", "description": "The path where the PKI External CA secret backend is mounted.\n" }, "name": { "type": "string", "description": "Name of the role. Must be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" } }, "type": "object" } }, "vault:rabbitMq/secretBackend:SecretBackend": { "description": "Creates an RabbitMQ Secret Backend for Vault. RabbitMQ secret backends can then issue RabbitMQ credentials,\n once a role has been added to the backend.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst rabbitmq = new vault.rabbitmq.SecretBackend(\"rabbitmq\", {\n connectionUri: \"https://.....\",\n username: \"user\",\n password: \"password\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nrabbitmq = vault.rabbitmq.SecretBackend(\"rabbitmq\",\n connection_uri=\"https://.....\",\n username=\"user\",\n password=\"password\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var rabbitmq = new Vault.RabbitMQ.SecretBackend(\"rabbitmq\", new()\n {\n ConnectionUri = \"https://.....\",\n Username = \"user\",\n Password = \"password\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/rabbitmq\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := rabbitmq.NewSecretBackend(ctx, \"rabbitmq\", \u0026rabbitmq.SecretBackendArgs{\n\t\t\tConnectionUri: pulumi.String(\"https://.....\"),\n\t\t\tUsername: pulumi.String(\"user\"),\n\t\t\tPassword: pulumi.String(\"password\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_rabbitmq_secretbackend\" \"rabbitmq\" {\n connection_uri = \"https://.....\"\n username = \"user\"\n password = \"password\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.rabbitMq.SecretBackend;\nimport com.pulumi.vault.rabbitMq.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var rabbitmq = new SecretBackend(\"rabbitmq\", SecretBackendArgs.builder()\n .connectionUri(\"https://.....\")\n .username(\"user\")\n .password(\"password\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n rabbitmq:\n type: vault:rabbitMq:SecretBackend\n properties:\n connectionUri: https://.....\n username: user\n password: password\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\nUsing \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e to configure the password as a write-only attribute (requires Terraform 1.11+):\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst rabbitmq = new vault.rabbitmq.SecretBackend(\"rabbitmq\", {\n connectionUri: \"https://.....\",\n username: \"user\",\n passwordWo: rabbitmqPassword,\n passwordWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nrabbitmq = vault.rabbitmq.SecretBackend(\"rabbitmq\",\n connection_uri=\"https://.....\",\n username=\"user\",\n password_wo=rabbitmq_password,\n password_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var rabbitmq = new Vault.RabbitMQ.SecretBackend(\"rabbitmq\", new()\n {\n ConnectionUri = \"https://.....\",\n Username = \"user\",\n PasswordWo = rabbitmqPassword,\n PasswordWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/rabbitmq\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := rabbitmq.NewSecretBackend(ctx, \"rabbitmq\", \u0026rabbitmq.SecretBackendArgs{\n\t\t\tConnectionUri: pulumi.String(\"https://.....\"),\n\t\t\tUsername: pulumi.String(\"user\"),\n\t\t\tPasswordWo: pulumi.Any(rabbitmqPassword),\n\t\t\tPasswordWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_rabbitmq_secretbackend\" \"rabbitmq\" {\n connection_uri = \"https://.....\"\n username = \"user\"\n password_wo = rabbitmqPassword\n password_wo_version = 1\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.rabbitMq.SecretBackend;\nimport com.pulumi.vault.rabbitMq.SecretBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var rabbitmq = new SecretBackend(\"rabbitmq\", SecretBackendArgs.builder()\n .connectionUri(\"https://.....\")\n .username(\"user\")\n .passwordWo(rabbitmqPassword)\n .passwordWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n rabbitmq:\n type: vault:rabbitMq:SecretBackend\n properties:\n connectionUri: https://.....\n username: user\n passwordWo: ${rabbitmqPassword}\n passwordWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Ephemeral Attributes Reference\n\nThese attributes are write-only and will not be persisted to Terraform state.\nRequires Terraform 1.11+.\n\n* \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e - (Optional) Specifies the RabbitMQ management administrator password.\n This is a write-only field and will not be read back from Vault.\n Conflicts with \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e.\n\n* \u003cspan pulumi-lang-nodejs=\"`passwordWoVersion`\" pulumi-lang-dotnet=\"`PasswordWoVersion`\" pulumi-lang-go=\"`passwordWoVersion`\" pulumi-lang-python=\"`password_wo_version`\" pulumi-lang-yaml=\"`passwordWoVersion`\" pulumi-lang-java=\"`passwordWoVersion`\" pulumi-lang-hcl=\"`password_wo_version`\"\u003e`passwordWoVersion`\u003c/span\u003e - (Optional) A version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e field.\n Incrementing this value will trigger an update to the password.\n Required when using \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e.\n\n## Import\n\nRabbitMQ secret backends can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:rabbitMq/secretBackend:SecretBackend rabbitmq rabbitmq\n```\n\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "connectionUri": { "type": "string", "description": "Specifies the RabbitMQ connection URI.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source" }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment" }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "password": { "type": "string", "description": "Specifies the RabbitMQ management administrator password.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e.\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "Specifies a password policy to use when creating dynamic credentials. Defaults to generating an alphanumeric password if not set.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nSpecifies the RabbitMQ management administrator password. This is a write-only field and will not be read back from Vault.", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" passwordWo \" pulumi-lang-dotnet=\" PasswordWo \" pulumi-lang-go=\" passwordWo \" pulumi-lang-python=\" password_wo \" pulumi-lang-yaml=\" passwordWo \" pulumi-lang-java=\" passwordWo \" pulumi-lang-hcl=\" password_wo \"\u003e passwordWo \u003c/span\u003efield. Incrementing this value will trigger an update to the password." }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`rabbitmq`\" pulumi-lang-dotnet=\"`Rabbitmq`\" pulumi-lang-go=\"`rabbitmq`\" pulumi-lang-python=\"`rabbitmq`\" pulumi-lang-yaml=\"`rabbitmq`\" pulumi-lang-java=\"`rabbitmq`\" pulumi-lang-hcl=\"`rabbitmq`\"\u003e`rabbitmq`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability" }, "username": { "type": "string", "description": "Specifies the RabbitMQ management administrator username.\n", "secret": true }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n\n\u003e **Important** Because Vault does not support reading the configured\ncredentials back from the API, Terraform cannot detect and correct drift\non \u003cspan pulumi-lang-nodejs=\"`connectionUri`\" pulumi-lang-dotnet=\"`ConnectionUri`\" pulumi-lang-go=\"`connectionUri`\" pulumi-lang-python=\"`connection_uri`\" pulumi-lang-yaml=\"`connectionUri`\" pulumi-lang-java=\"`connectionUri`\" pulumi-lang-hcl=\"`connection_uri`\"\u003e`connectionUri`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`username`\" pulumi-lang-dotnet=\"`Username`\" pulumi-lang-go=\"`username`\" pulumi-lang-python=\"`username`\" pulumi-lang-yaml=\"`username`\" pulumi-lang-java=\"`username`\" pulumi-lang-hcl=\"`username`\"\u003e`username`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`verifyConnection`\" pulumi-lang-dotnet=\"`VerifyConnection`\" pulumi-lang-go=\"`verifyConnection`\" pulumi-lang-python=\"`verify_connection`\" pulumi-lang-yaml=\"`verifyConnection`\" pulumi-lang-java=\"`verifyConnection`\" pulumi-lang-hcl=\"`verify_connection`\"\u003e`verifyConnection`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`usernameTemplate`\" pulumi-lang-dotnet=\"`UsernameTemplate`\" pulumi-lang-go=\"`usernameTemplate`\" pulumi-lang-python=\"`username_template`\" pulumi-lang-yaml=\"`usernameTemplate`\" pulumi-lang-java=\"`usernameTemplate`\" pulumi-lang-hcl=\"`username_template`\"\u003e`usernameTemplate`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`passwordPolicy`\" pulumi-lang-dotnet=\"`PasswordPolicy`\" pulumi-lang-go=\"`passwordPolicy`\" pulumi-lang-python=\"`password_policy`\" pulumi-lang-yaml=\"`passwordPolicy`\" pulumi-lang-java=\"`passwordPolicy`\" pulumi-lang-hcl=\"`password_policy`\"\u003e`passwordPolicy`\u003c/span\u003e. Changing the values, however, _will_\noverwrite the previously stored values.\n" }, "verifyConnection": { "type": "boolean", "description": "Specifies whether to verify connection URI, username, and password.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" } }, "required": [ "accessor", "auditNonHmacRequestKeys", "auditNonHmacResponseKeys", "connectionUri", "defaultLeaseTtlSeconds", "forceNoCache", "maxLeaseTtlSeconds", "sealWrap", "username" ], "inputProperties": { "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "connectionUri": { "type": "string", "description": "Specifies the RabbitMQ connection URI.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "password": { "type": "string", "description": "Specifies the RabbitMQ management administrator password.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e.\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "Specifies a password policy to use when creating dynamic credentials. Defaults to generating an alphanumeric password if not set.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nSpecifies the RabbitMQ management administrator password. This is a write-only field and will not be read back from Vault.", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" passwordWo \" pulumi-lang-dotnet=\" PasswordWo \" pulumi-lang-go=\" passwordWo \" pulumi-lang-python=\" password_wo \" pulumi-lang-yaml=\" passwordWo \" pulumi-lang-java=\" passwordWo \" pulumi-lang-hcl=\" password_wo \"\u003e passwordWo \u003c/span\u003efield. Incrementing this value will trigger an update to the password." }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`rabbitmq`\" pulumi-lang-dotnet=\"`Rabbitmq`\" pulumi-lang-go=\"`rabbitmq`\" pulumi-lang-python=\"`rabbitmq`\" pulumi-lang-yaml=\"`rabbitmq`\" pulumi-lang-java=\"`rabbitmq`\" pulumi-lang-hcl=\"`rabbitmq`\"\u003e`rabbitmq`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "username": { "type": "string", "description": "Specifies the RabbitMQ management administrator username.\n", "secret": true }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n\n\u003e **Important** Because Vault does not support reading the configured\ncredentials back from the API, Terraform cannot detect and correct drift\non \u003cspan pulumi-lang-nodejs=\"`connectionUri`\" pulumi-lang-dotnet=\"`ConnectionUri`\" pulumi-lang-go=\"`connectionUri`\" pulumi-lang-python=\"`connection_uri`\" pulumi-lang-yaml=\"`connectionUri`\" pulumi-lang-java=\"`connectionUri`\" pulumi-lang-hcl=\"`connection_uri`\"\u003e`connectionUri`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`username`\" pulumi-lang-dotnet=\"`Username`\" pulumi-lang-go=\"`username`\" pulumi-lang-python=\"`username`\" pulumi-lang-yaml=\"`username`\" pulumi-lang-java=\"`username`\" pulumi-lang-hcl=\"`username`\"\u003e`username`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`verifyConnection`\" pulumi-lang-dotnet=\"`VerifyConnection`\" pulumi-lang-go=\"`verifyConnection`\" pulumi-lang-python=\"`verify_connection`\" pulumi-lang-yaml=\"`verifyConnection`\" pulumi-lang-java=\"`verifyConnection`\" pulumi-lang-hcl=\"`verify_connection`\"\u003e`verifyConnection`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`usernameTemplate`\" pulumi-lang-dotnet=\"`UsernameTemplate`\" pulumi-lang-go=\"`usernameTemplate`\" pulumi-lang-python=\"`username_template`\" pulumi-lang-yaml=\"`usernameTemplate`\" pulumi-lang-java=\"`usernameTemplate`\" pulumi-lang-hcl=\"`username_template`\"\u003e`usernameTemplate`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`passwordPolicy`\" pulumi-lang-dotnet=\"`PasswordPolicy`\" pulumi-lang-go=\"`passwordPolicy`\" pulumi-lang-python=\"`password_policy`\" pulumi-lang-yaml=\"`passwordPolicy`\" pulumi-lang-java=\"`passwordPolicy`\" pulumi-lang-hcl=\"`password_policy`\"\u003e`passwordPolicy`\u003c/span\u003e. Changing the values, however, _will_\noverwrite the previously stored values.\n" }, "verifyConnection": { "type": "boolean", "description": "Specifies whether to verify connection URI, username, and password.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" } }, "requiredInputs": [ "connectionUri", "username" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackend resources.\n", "properties": { "accessor": { "type": "string", "description": "Accessor of the mount" }, "allowedManagedKeys": { "type": "array", "items": { "type": "string" }, "description": "List of managed key registry entry names that the mount in question is allowed to access" }, "allowedResponseHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "auditNonHmacRequestKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the request data object." }, "auditNonHmacResponseKeys": { "type": "array", "items": { "type": "string" }, "description": "Specifies the list of keys that will not be HMAC'd by audit devices in the response data object." }, "connectionUri": { "type": "string", "description": "Specifies the RabbitMQ connection URI.\n" }, "defaultLeaseTtlSeconds": { "type": "integer", "description": "Default lease duration for secrets in seconds" }, "delegatedAuthAccessors": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "description": { "type": "string", "description": "Human-friendly description of the mount for the backend." }, "disableRemount": { "type": "boolean", "description": "If set, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "externalEntropyAccess": { "type": "boolean", "description": "Enable the secrets engine to access Vault's external entropy source", "willReplaceOnChanges": true }, "forceNoCache": { "type": "boolean", "description": "If set to true, disables caching." }, "identityTokenKey": { "type": "string", "description": "The key to use for signing plugin workload identity tokens" }, "listingVisibility": { "type": "string", "description": "Specifies whether to show this mount in the UI-specific listing endpoint" }, "local": { "type": "boolean", "description": "Local mount flag that can be explicitly set to true to enforce local mount in HA environment", "willReplaceOnChanges": true }, "maxLeaseTtlSeconds": { "type": "integer", "description": "Maximum possible lease duration for secrets in seconds" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "options": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Specifies mount type specific options that are passed to the backend" }, "passthroughRequestHeaders": { "type": "array", "items": { "type": "string" }, "description": "List of headers to allow and pass from the request to the plugin" }, "password": { "type": "string", "description": "Specifies the RabbitMQ management administrator password.\nConflicts with \u003cspan pulumi-lang-nodejs=\"`passwordWo`\" pulumi-lang-dotnet=\"`PasswordWo`\" pulumi-lang-go=\"`passwordWo`\" pulumi-lang-python=\"`password_wo`\" pulumi-lang-yaml=\"`passwordWo`\" pulumi-lang-java=\"`passwordWo`\" pulumi-lang-hcl=\"`password_wo`\"\u003e`passwordWo`\u003c/span\u003e.\n", "secret": true }, "passwordPolicy": { "type": "string", "description": "Specifies a password policy to use when creating dynamic credentials. Defaults to generating an alphanumeric password if not set.\n" }, "passwordWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nSpecifies the RabbitMQ management administrator password. This is a write-only field and will not be read back from Vault.", "secret": true }, "passwordWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" passwordWo \" pulumi-lang-dotnet=\" PasswordWo \" pulumi-lang-go=\" passwordWo \" pulumi-lang-python=\" password_wo \" pulumi-lang-yaml=\" passwordWo \" pulumi-lang-java=\" passwordWo \" pulumi-lang-hcl=\" password_wo \"\u003e passwordWo \u003c/span\u003efield. Incrementing this value will trigger an update to the password." }, "path": { "type": "string", "description": "The unique path this backend should be mounted at. Must\nnot begin or end with a `/`. Defaults to \u003cspan pulumi-lang-nodejs=\"`rabbitmq`\" pulumi-lang-dotnet=\"`Rabbitmq`\" pulumi-lang-go=\"`rabbitmq`\" pulumi-lang-python=\"`rabbitmq`\" pulumi-lang-yaml=\"`rabbitmq`\" pulumi-lang-java=\"`rabbitmq`\" pulumi-lang-hcl=\"`rabbitmq`\"\u003e`rabbitmq`\u003c/span\u003e.\n" }, "pluginVersion": { "type": "string", "description": "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'" }, "sealWrap": { "type": "boolean", "description": "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability", "willReplaceOnChanges": true }, "username": { "type": "string", "description": "Specifies the RabbitMQ management administrator username.\n", "secret": true }, "usernameTemplate": { "type": "string", "description": "Template describing how dynamic usernames are generated.\n\n\u003e **Important** Because Vault does not support reading the configured\ncredentials back from the API, Terraform cannot detect and correct drift\non \u003cspan pulumi-lang-nodejs=\"`connectionUri`\" pulumi-lang-dotnet=\"`ConnectionUri`\" pulumi-lang-go=\"`connectionUri`\" pulumi-lang-python=\"`connection_uri`\" pulumi-lang-yaml=\"`connectionUri`\" pulumi-lang-java=\"`connectionUri`\" pulumi-lang-hcl=\"`connection_uri`\"\u003e`connectionUri`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`username`\" pulumi-lang-dotnet=\"`Username`\" pulumi-lang-go=\"`username`\" pulumi-lang-python=\"`username`\" pulumi-lang-yaml=\"`username`\" pulumi-lang-java=\"`username`\" pulumi-lang-hcl=\"`username`\"\u003e`username`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`password`\" pulumi-lang-dotnet=\"`Password`\" pulumi-lang-go=\"`password`\" pulumi-lang-python=\"`password`\" pulumi-lang-yaml=\"`password`\" pulumi-lang-java=\"`password`\" pulumi-lang-hcl=\"`password`\"\u003e`password`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`verifyConnection`\" pulumi-lang-dotnet=\"`VerifyConnection`\" pulumi-lang-go=\"`verifyConnection`\" pulumi-lang-python=\"`verify_connection`\" pulumi-lang-yaml=\"`verifyConnection`\" pulumi-lang-java=\"`verifyConnection`\" pulumi-lang-hcl=\"`verify_connection`\"\u003e`verifyConnection`\u003c/span\u003e, \u003cspan pulumi-lang-nodejs=\"`usernameTemplate`\" pulumi-lang-dotnet=\"`UsernameTemplate`\" pulumi-lang-go=\"`usernameTemplate`\" pulumi-lang-python=\"`username_template`\" pulumi-lang-yaml=\"`usernameTemplate`\" pulumi-lang-java=\"`usernameTemplate`\" pulumi-lang-hcl=\"`username_template`\"\u003e`usernameTemplate`\u003c/span\u003e, and \u003cspan pulumi-lang-nodejs=\"`passwordPolicy`\" pulumi-lang-dotnet=\"`PasswordPolicy`\" pulumi-lang-go=\"`passwordPolicy`\" pulumi-lang-python=\"`password_policy`\" pulumi-lang-yaml=\"`passwordPolicy`\" pulumi-lang-java=\"`passwordPolicy`\" pulumi-lang-hcl=\"`password_policy`\"\u003e`passwordPolicy`\u003c/span\u003e. Changing the values, however, _will_\noverwrite the previously stored values.\n" }, "verifyConnection": { "type": "boolean", "description": "Specifies whether to verify connection URI, username, and password.\nDefaults to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e.\n" } }, "type": "object" } }, "vault:rabbitMq/secretBackendRole:SecretBackendRole": { "description": "Creates a role on an RabbitMQ Secret Backend for Vault. Roles are\nused to map credentials to the policies that generated them.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst rabbitmq = new vault.rabbitmq.SecretBackend(\"rabbitmq\", {\n connectionUri: \"https://.....\",\n username: \"user\",\n password: \"password\",\n});\nconst role = new vault.rabbitmq.SecretBackendRole(\"role\", {\n backend: rabbitmq.path,\n name: \"deploy\",\n tags: \"tag1,tag2\",\n vhosts: [{\n host: \"/\",\n configure: \"\",\n read: \".*\",\n write: \"\",\n }],\n vhostTopics: [{\n vhosts: [{\n topic: \"amq.topic\",\n read: \".*\",\n write: \"\",\n }],\n host: \"/\",\n }],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nrabbitmq = vault.rabbitmq.SecretBackend(\"rabbitmq\",\n connection_uri=\"https://.....\",\n username=\"user\",\n password=\"password\")\nrole = vault.rabbitmq.SecretBackendRole(\"role\",\n backend=rabbitmq.path,\n name=\"deploy\",\n tags=\"tag1,tag2\",\n vhosts=[{\n \"host\": \"/\",\n \"configure\": \"\",\n \"read\": \".*\",\n \"write\": \"\",\n }],\n vhost_topics=[{\n \"vhosts\": [{\n \"topic\": \"amq.topic\",\n \"read\": \".*\",\n \"write\": \"\",\n }],\n \"host\": \"/\",\n }])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var rabbitmq = new Vault.RabbitMQ.SecretBackend(\"rabbitmq\", new()\n {\n ConnectionUri = \"https://.....\",\n Username = \"user\",\n Password = \"password\",\n });\n\n var role = new Vault.RabbitMQ.SecretBackendRole(\"role\", new()\n {\n Backend = rabbitmq.Path,\n Name = \"deploy\",\n Tags = \"tag1,tag2\",\n Vhosts = new[]\n {\n new Vault.RabbitMQ.Inputs.SecretBackendRoleVhostArgs\n {\n Host = \"/\",\n Configure = \"\",\n Read = \".*\",\n Write = \"\",\n },\n },\n VhostTopics = new[]\n {\n new Vault.RabbitMQ.Inputs.SecretBackendRoleVhostTopicArgs\n {\n Vhosts = new[]\n {\n new Vault.RabbitMQ.Inputs.SecretBackendRoleVhostTopicVhostArgs\n {\n Topic = \"amq.topic\",\n Read = \".*\",\n Write = \"\",\n },\n },\n Host = \"/\",\n },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/rabbitmq\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\trabbitmq2, err := rabbitmq.NewSecretBackend(ctx, \"rabbitmq\", \u0026rabbitmq.SecretBackendArgs{\n\t\t\tConnectionUri: pulumi.String(\"https://.....\"),\n\t\t\tUsername: pulumi.String(\"user\"),\n\t\t\tPassword: pulumi.String(\"password\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = rabbitmq.NewSecretBackendRole(ctx, \"role\", \u0026rabbitmq.SecretBackendRoleArgs{\n\t\t\tBackend: rabbitmq2.Path,\n\t\t\tName: pulumi.String(\"deploy\"),\n\t\t\tTags: pulumi.String(\"tag1,tag2\"),\n\t\t\tVhosts: rabbitmq.SecretBackendRoleVhostArray{\n\t\t\t\t\u0026rabbitmq.SecretBackendRoleVhostArgs{\n\t\t\t\t\tHost: pulumi.String(\"/\"),\n\t\t\t\t\tConfigure: pulumi.String(\"\"),\n\t\t\t\t\tRead: pulumi.String(\".*\"),\n\t\t\t\t\tWrite: pulumi.String(\"\"),\n\t\t\t\t},\n\t\t\t},\n\t\t\tVhostTopics: rabbitmq.SecretBackendRoleVhostTopicArray{\n\t\t\t\t\u0026rabbitmq.SecretBackendRoleVhostTopicArgs{\n\t\t\t\t\tVhosts: rabbitmq.SecretBackendRoleVhostTopicVhostArray{\n\t\t\t\t\t\t\u0026rabbitmq.SecretBackendRoleVhostTopicVhostArgs{\n\t\t\t\t\t\t\tTopic: pulumi.String(\"amq.topic\"),\n\t\t\t\t\t\t\tRead: pulumi.String(\".*\"),\n\t\t\t\t\t\t\tWrite: pulumi.String(\"\"),\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t\tHost: pulumi.String(\"/\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_rabbitmq_secretbackend\" \"rabbitmq\" {\n connection_uri = \"https://.....\"\n username = \"user\"\n password = \"password\"\n}\nresource \"vault_rabbitmq_secretbackendrole\" \"role\" {\n backend = vault_rabbitmq_secretbackend.rabbitmq.path\n name = \"deploy\"\n tags = \"tag1,tag2\"\n vhosts {\n host = \"/\"\n configure = \"\"\n read = \".*\"\n write = \"\"\n }\n vhost_topics {\n vhosts {\n topic = \"amq.topic\"\n read = \".*\"\n write = \"\"\n }\n host = \"/\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.rabbitMq.SecretBackend;\nimport com.pulumi.vault.rabbitMq.SecretBackendArgs;\nimport com.pulumi.vault.rabbitMq.SecretBackendRole;\nimport com.pulumi.vault.rabbitMq.SecretBackendRoleArgs;\nimport com.pulumi.vault.rabbitMq.inputs.SecretBackendRoleVhostArgs;\nimport com.pulumi.vault.rabbitMq.inputs.SecretBackendRoleVhostTopicArgs;\nimport com.pulumi.vault.rabbitMq.inputs.SecretBackendRoleVhostTopicVhostArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var rabbitmq = new SecretBackend(\"rabbitmq\", SecretBackendArgs.builder()\n .connectionUri(\"https://.....\")\n .username(\"user\")\n .password(\"password\")\n .build());\n\n var role = new SecretBackendRole(\"role\", SecretBackendRoleArgs.builder()\n .backend(rabbitmq.path())\n .name(\"deploy\")\n .tags(\"tag1,tag2\")\n .vhosts(SecretBackendRoleVhostArgs.builder()\n .host(\"/\")\n .configure(\"\")\n .read(\".*\")\n .write(\"\")\n .build())\n .vhostTopics(SecretBackendRoleVhostTopicArgs.builder()\n .vhosts(SecretBackendRoleVhostTopicVhostArgs.builder()\n .topic(\"amq.topic\")\n .read(\".*\")\n .write(\"\")\n .build())\n .host(\"/\")\n .build())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n rabbitmq:\n type: vault:rabbitMq:SecretBackend\n properties:\n connectionUri: https://.....\n username: user\n password: password\n role:\n type: vault:rabbitMq:SecretBackendRole\n properties:\n backend: ${rabbitmq.path}\n name: deploy\n tags: tag1,tag2\n vhosts:\n - host: /\n configure: \"\"\n read: .*\n write: \"\"\n vhostTopics:\n - vhosts:\n - topic: amq.topic\n read: .*\n write: \"\"\n host: /\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nRabbitMQ secret backend roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:rabbitMq/secretBackendRole:SecretBackendRole role rabbitmq/roles/deploy\n```\n\n", "properties": { "backend": { "type": "string", "description": "The path the RabbitMQ secret backend is mounted at,\nwith no leading or trailing `/`s.\n" }, "name": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "tags": { "type": "string", "description": "Specifies a comma-separated RabbitMQ management tags.\n" }, "vhostTopics": { "type": "array", "items": { "$ref": "#/types/vault:rabbitMq/SecretBackendRoleVhostTopic:SecretBackendRoleVhostTopic" }, "description": "Specifies a map of virtual hosts and exchanges to topic permissions. This option requires RabbitMQ 3.7.0 or later.\n" }, "vhosts": { "type": "array", "items": { "$ref": "#/types/vault:rabbitMq/SecretBackendRoleVhost:SecretBackendRoleVhost" }, "description": "Specifies a map of virtual hosts to permissions.\n" } }, "required": [ "backend", "name" ], "inputProperties": { "backend": { "type": "string", "description": "The path the RabbitMQ secret backend is mounted at,\nwith no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "tags": { "type": "string", "description": "Specifies a comma-separated RabbitMQ management tags.\n" }, "vhostTopics": { "type": "array", "items": { "$ref": "#/types/vault:rabbitMq/SecretBackendRoleVhostTopic:SecretBackendRoleVhostTopic" }, "description": "Specifies a map of virtual hosts and exchanges to topic permissions. This option requires RabbitMQ 3.7.0 or later.\n" }, "vhosts": { "type": "array", "items": { "$ref": "#/types/vault:rabbitMq/SecretBackendRoleVhost:SecretBackendRoleVhost" }, "description": "Specifies a map of virtual hosts to permissions.\n" } }, "requiredInputs": [ "backend" ], "stateInputs": { "description": "Input properties used for looking up and filtering SecretBackendRole resources.\n", "properties": { "backend": { "type": "string", "description": "The path the RabbitMQ secret backend is mounted at,\nwith no leading or trailing `/`s.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "The name to identify this role within the backend.\nMust be unique within the backend.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "tags": { "type": "string", "description": "Specifies a comma-separated RabbitMQ management tags.\n" }, "vhostTopics": { "type": "array", "items": { "$ref": "#/types/vault:rabbitMq/SecretBackendRoleVhostTopic:SecretBackendRoleVhostTopic" }, "description": "Specifies a map of virtual hosts and exchanges to topic permissions. This option requires RabbitMQ 3.7.0 or later.\n" }, "vhosts": { "type": "array", "items": { "$ref": "#/types/vault:rabbitMq/SecretBackendRoleVhost:SecretBackendRoleVhost" }, "description": "Specifies a map of virtual hosts to permissions.\n" } }, "type": "object" } }, "vault:radius/authBackend:AuthBackend": { "description": "Configures an existing RADIUS auth backend mount in Vault.\n\nThe RADIUS auth method allows users to authenticate with Vault using an \nexisting RADIUS server that accepts the PAP authentication scheme.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst radius = new vault.AuthBackend(\"radius\", {\n type: \"radius\",\n path: \"radius\",\n});\nconst example = new vault.radius.AuthBackend(\"example\", {\n mount: radius.path,\n host: \"radius.example.com\",\n secretWo: \"supersecretpassword\",\n secretWoVersion: 1,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nradius = vault.AuthBackend(\"radius\",\n type=\"radius\",\n path=\"radius\")\nexample = vault.radius.AuthBackend(\"example\",\n mount=radius.path,\n host=\"radius.example.com\",\n secret_wo=\"supersecretpassword\",\n secret_wo_version=1)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var radius = new Vault.AuthBackend(\"radius\", new()\n {\n Type = \"radius\",\n Path = \"radius\",\n });\n\n var example = new Vault.Radius.AuthBackend(\"example\", new()\n {\n Mount = radius.Path,\n Host = \"radius.example.com\",\n SecretWo = \"supersecretpassword\",\n SecretWoVersion = 1,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/radius\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tradius2, err := vault.NewAuthBackend(ctx, \"radius\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"radius\"),\n\t\t\tPath: pulumi.String(\"radius\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = radius.NewAuthBackend(ctx, \"example\", \u0026radius.AuthBackendArgs{\n\t\t\tMount: radius2.Path,\n\t\t\tHost: pulumi.String(\"radius.example.com\"),\n\t\t\tSecretWo: pulumi.String(\"supersecretpassword\"),\n\t\t\tSecretWoVersion: pulumi.Int(1),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"radius\" {\n type = \"radius\"\n path = \"radius\"\n}\nresource \"vault_radius_authbackend\" \"example\" {\n mount = vault_authbackend.radius.path\n host = \"radius.example.com\"\n secret_wo = \"supersecretpassword\"\n secret_wo_version = 1\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var radius = new com.pulumi.vault.AuthBackend(\"radius\", com.pulumi.vault.AuthBackendArgs.builder()\n .type(\"radius\")\n .path(\"radius\")\n .build());\n\n var example = new com.pulumi.vault.radius.AuthBackend(\"example\", com.pulumi.vault.radius.AuthBackendArgs.builder()\n .mount(radius.path())\n .host(\"radius.example.com\")\n .secretWo(\"supersecretpassword\")\n .secretWoVersion(1)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n radius:\n type: vault:AuthBackend\n properties:\n type: radius\n path: radius\n example:\n type: vault:radius:AuthBackend\n properties:\n mount: ${radius.path}\n host: radius.example.com\n secretWo: supersecretpassword\n secretWoVersion: 1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With All Options\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst radius = new vault.AuthBackend(\"radius\", {\n type: \"radius\",\n path: \"my-radius\",\n});\nconst example = new vault.radius.AuthBackend(\"example\", {\n mount: radius.path,\n host: \"radius.example.com\",\n port: 1812,\n secretWo: \"supersecretpassword\",\n secretWoVersion: 1,\n unregisteredUserPolicies: [\n \"default\",\n \"guest\",\n ],\n dialTimeout: 10,\n readTimeout: 10,\n nasPort: 10,\n tokenTtl: 3600,\n tokenMaxTtl: 7200,\n tokenPolicies: [\n \"default\",\n \"radius-users\",\n ],\n aliasMetadata: {\n username: \"name\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nradius = vault.AuthBackend(\"radius\",\n type=\"radius\",\n path=\"my-radius\")\nexample = vault.radius.AuthBackend(\"example\",\n mount=radius.path,\n host=\"radius.example.com\",\n port=1812,\n secret_wo=\"supersecretpassword\",\n secret_wo_version=1,\n unregistered_user_policies=[\n \"default\",\n \"guest\",\n ],\n dial_timeout=10,\n read_timeout=10,\n nas_port=10,\n token_ttl=3600,\n token_max_ttl=7200,\n token_policies=[\n \"default\",\n \"radius-users\",\n ],\n alias_metadata={\n \"username\": \"name\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var radius = new Vault.AuthBackend(\"radius\", new()\n {\n Type = \"radius\",\n Path = \"my-radius\",\n });\n\n var example = new Vault.Radius.AuthBackend(\"example\", new()\n {\n Mount = radius.Path,\n Host = \"radius.example.com\",\n Port = 1812,\n SecretWo = \"supersecretpassword\",\n SecretWoVersion = 1,\n UnregisteredUserPolicies = new[]\n {\n \"default\",\n \"guest\",\n },\n DialTimeout = 10,\n ReadTimeout = 10,\n NasPort = 10,\n TokenTtl = 3600,\n TokenMaxTtl = 7200,\n TokenPolicies = new[]\n {\n \"default\",\n \"radius-users\",\n },\n AliasMetadata = \n {\n { \"username\", \"name\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/radius\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tradius2, err := vault.NewAuthBackend(ctx, \"radius\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"radius\"),\n\t\t\tPath: pulumi.String(\"my-radius\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = radius.NewAuthBackend(ctx, \"example\", \u0026radius.AuthBackendArgs{\n\t\t\tMount: radius2.Path,\n\t\t\tHost: pulumi.String(\"radius.example.com\"),\n\t\t\tPort: pulumi.Int(1812),\n\t\t\tSecretWo: pulumi.String(\"supersecretpassword\"),\n\t\t\tSecretWoVersion: pulumi.Int(1),\n\t\t\tUnregisteredUserPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"guest\"),\n\t\t\t},\n\t\t\tDialTimeout: pulumi.Int(10),\n\t\t\tReadTimeout: pulumi.Int(10),\n\t\t\tNasPort: pulumi.Int(10),\n\t\t\tTokenTtl: pulumi.Int(3600),\n\t\t\tTokenMaxTtl: pulumi.Int(7200),\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"radius-users\"),\n\t\t\t},\n\t\t\tAliasMetadata: pulumi.StringMap{\n\t\t\t\t\"username\": pulumi.String(\"name\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"radius\" {\n type = \"radius\"\n path = \"my-radius\"\n}\nresource \"vault_radius_authbackend\" \"example\" {\n mount = vault_authbackend.radius.path\n host = \"radius.example.com\"\n port = 1812\n secret_wo = \"supersecretpassword\"\n secret_wo_version = 1\n unregistered_user_policies = [\"default\", \"guest\"]\n dial_timeout = 10\n read_timeout = 10\n nas_port = 10\n token_ttl = 3600\n token_max_ttl = 7200\n token_policies = [\"default\", \"radius-users\"]\n alias_metadata = {\n \"username\" = \"name\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var radius = new com.pulumi.vault.AuthBackend(\"radius\", com.pulumi.vault.AuthBackendArgs.builder()\n .type(\"radius\")\n .path(\"my-radius\")\n .build());\n\n var example = new com.pulumi.vault.radius.AuthBackend(\"example\", com.pulumi.vault.radius.AuthBackendArgs.builder()\n .mount(radius.path())\n .host(\"radius.example.com\")\n .port(1812)\n .secretWo(\"supersecretpassword\")\n .secretWoVersion(1)\n .unregisteredUserPolicies( \n \"default\",\n \"guest\")\n .dialTimeout(10)\n .readTimeout(10)\n .nasPort(10)\n .tokenTtl(3600)\n .tokenMaxTtl(7200)\n .tokenPolicies( \n \"default\",\n \"radius-users\")\n .aliasMetadata(Map.of(\"username\", \"name\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n radius:\n type: vault:AuthBackend\n properties:\n type: radius\n path: my-radius\n example:\n type: vault:radius:AuthBackend\n properties:\n mount: ${radius.path}\n host: radius.example.com\n port: 1812\n secretWo: supersecretpassword\n secretWoVersion: 1\n unregisteredUserPolicies:\n - default\n - guest\n dialTimeout: 10\n readTimeout: 10\n nasPort: 10\n tokenTtl: 3600\n tokenMaxTtl: 7200\n tokenPolicies:\n - default\n - radius-users\n aliasMetadata:\n username: name\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nRADIUS auth backend configurations can be imported using the full config API path:\n\n```sh\n$ pulumi import vault:radius/authBackend:AuthBackend example auth/radius/config\n$ pulumi import vault:radius/authBackend:AuthBackend example auth/my-radius/config\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "dialTimeout": { "type": "integer", "description": "Number of seconds to wait for a backend connection before timing out. Defaults to \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If removed from configuration after being set, Vault retains the previously stored value." }, "host": { "type": "string", "description": "The RADIUS server to connect to. Examples: `radius.myorg.com`, `127.0.0.1`." }, "mount": { "type": "string", "description": "Path of the enabled RADIUS auth backend mount to configure." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "nasIdentifier": { "type": "string", "description": "The NAS identifier field for the RADIUS authentication.\n" }, "nasPort": { "type": "integer", "description": "The NAS-Port attribute of the RADIUS request. Defaults to \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If removed from configuration after being set, Vault retains the previously stored value." }, "port": { "type": "integer", "description": "The UDP port where the RADIUS server is listening on. Defaults to \u003cspan pulumi-lang-nodejs=\"`1812`\" pulumi-lang-dotnet=\"`1812`\" pulumi-lang-go=\"`1812`\" pulumi-lang-python=\"`1812`\" pulumi-lang-yaml=\"`1812`\" pulumi-lang-java=\"`1812`\" pulumi-lang-hcl=\"`1812`\"\u003e`1812`\u003c/span\u003e." }, "readTimeout": { "type": "integer", "description": "Number of seconds to wait for a response from the RADIUS server. Defaults to \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If removed from configuration after being set, Vault retains the previously stored value." }, "secretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe RADIUS shared secret. This is a write-only field and will not be read back from Vault.", "secret": true }, "secretWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`secretWo`\" pulumi-lang-dotnet=\"`SecretWo`\" pulumi-lang-go=\"`secretWo`\" pulumi-lang-python=\"`secret_wo`\" pulumi-lang-yaml=\"`secretWo`\" pulumi-lang-java=\"`secretWo`\" pulumi-lang-hcl=\"`secret_wo`\"\u003e`secretWo`\u003c/span\u003e field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update \u003cspan pulumi-lang-nodejs=\"`secretWo`\" pulumi-lang-dotnet=\"`SecretWo`\" pulumi-lang-go=\"`secretWo`\" pulumi-lang-python=\"`secret_wo`\" pulumi-lang-yaml=\"`secretWo`\" pulumi-lang-java=\"`secretWo`\" pulumi-lang-hcl=\"`secret_wo`\"\u003e`secretWo`\u003c/span\u003e so Terraform detects the change and applies an update." }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "unregisteredUserPolicies": { "type": "array", "items": { "type": "string" }, "description": "A set of policies to be granted to unregistered users." } }, "required": [ "dialTimeout", "host", "mount", "nasIdentifier", "nasPort", "port", "readTimeout", "secretWo", "secretWoVersion", "tokenType" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "dialTimeout": { "type": "integer", "description": "Number of seconds to wait for a backend connection before timing out. Defaults to \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If removed from configuration after being set, Vault retains the previously stored value." }, "host": { "type": "string", "description": "The RADIUS server to connect to. Examples: `radius.myorg.com`, `127.0.0.1`." }, "mount": { "type": "string", "description": "Path of the enabled RADIUS auth backend mount to configure." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "nasPort": { "type": "integer", "description": "The NAS-Port attribute of the RADIUS request. Defaults to \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If removed from configuration after being set, Vault retains the previously stored value." }, "port": { "type": "integer", "description": "The UDP port where the RADIUS server is listening on. Defaults to \u003cspan pulumi-lang-nodejs=\"`1812`\" pulumi-lang-dotnet=\"`1812`\" pulumi-lang-go=\"`1812`\" pulumi-lang-python=\"`1812`\" pulumi-lang-yaml=\"`1812`\" pulumi-lang-java=\"`1812`\" pulumi-lang-hcl=\"`1812`\"\u003e`1812`\u003c/span\u003e." }, "readTimeout": { "type": "integer", "description": "Number of seconds to wait for a response from the RADIUS server. Defaults to \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If removed from configuration after being set, Vault retains the previously stored value." }, "secretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe RADIUS shared secret. This is a write-only field and will not be read back from Vault.", "secret": true }, "secretWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`secretWo`\" pulumi-lang-dotnet=\"`SecretWo`\" pulumi-lang-go=\"`secretWo`\" pulumi-lang-python=\"`secret_wo`\" pulumi-lang-yaml=\"`secretWo`\" pulumi-lang-java=\"`secretWo`\" pulumi-lang-hcl=\"`secret_wo`\"\u003e`secretWo`\u003c/span\u003e field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update \u003cspan pulumi-lang-nodejs=\"`secretWo`\" pulumi-lang-dotnet=\"`SecretWo`\" pulumi-lang-go=\"`secretWo`\" pulumi-lang-python=\"`secret_wo`\" pulumi-lang-yaml=\"`secretWo`\" pulumi-lang-java=\"`secretWo`\" pulumi-lang-hcl=\"`secret_wo`\"\u003e`secretWo`\u003c/span\u003e so Terraform detects the change and applies an update." }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "unregisteredUserPolicies": { "type": "array", "items": { "type": "string" }, "description": "A set of policies to be granted to unregistered users." } }, "requiredInputs": [ "host", "mount", "secretWo", "secretWoVersion" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackend resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "A map of string to string that will be set as metadata on the identity alias" }, "dialTimeout": { "type": "integer", "description": "Number of seconds to wait for a backend connection before timing out. Defaults to \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If removed from configuration after being set, Vault retains the previously stored value." }, "host": { "type": "string", "description": "The RADIUS server to connect to. Examples: `radius.myorg.com`, `127.0.0.1`." }, "mount": { "type": "string", "description": "Path of the enabled RADIUS auth backend mount to configure." }, "namespace": { "type": "string", "description": "Target namespace. (requires Enterprise)" }, "nasIdentifier": { "type": "string", "description": "The NAS identifier field for the RADIUS authentication.\n" }, "nasPort": { "type": "integer", "description": "The NAS-Port attribute of the RADIUS request. Defaults to \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If removed from configuration after being set, Vault retains the previously stored value." }, "port": { "type": "integer", "description": "The UDP port where the RADIUS server is listening on. Defaults to \u003cspan pulumi-lang-nodejs=\"`1812`\" pulumi-lang-dotnet=\"`1812`\" pulumi-lang-go=\"`1812`\" pulumi-lang-python=\"`1812`\" pulumi-lang-yaml=\"`1812`\" pulumi-lang-java=\"`1812`\" pulumi-lang-hcl=\"`1812`\"\u003e`1812`\u003c/span\u003e." }, "readTimeout": { "type": "integer", "description": "Number of seconds to wait for a response from the RADIUS server. Defaults to \u003cspan pulumi-lang-nodejs=\"`10`\" pulumi-lang-dotnet=\"`10`\" pulumi-lang-go=\"`10`\" pulumi-lang-python=\"`10`\" pulumi-lang-yaml=\"`10`\" pulumi-lang-java=\"`10`\" pulumi-lang-hcl=\"`10`\"\u003e`10`\u003c/span\u003e. If removed from configuration after being set, Vault retains the previously stored value." }, "secretWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe RADIUS shared secret. This is a write-only field and will not be read back from Vault.", "secret": true }, "secretWoVersion": { "type": "integer", "description": "Version counter for the write-only \u003cspan pulumi-lang-nodejs=\"`secretWo`\" pulumi-lang-dotnet=\"`SecretWo`\" pulumi-lang-go=\"`secretWo`\" pulumi-lang-python=\"`secret_wo`\" pulumi-lang-yaml=\"`secretWo`\" pulumi-lang-java=\"`secretWo`\" pulumi-lang-hcl=\"`secret_wo`\"\u003e`secretWo`\u003c/span\u003e field. Since write-only values are not stored in state, Terraform cannot detect when the secret changes. Increment this value whenever you update \u003cspan pulumi-lang-nodejs=\"`secretWo`\" pulumi-lang-dotnet=\"`SecretWo`\" pulumi-lang-go=\"`secretWo`\" pulumi-lang-python=\"`secret_wo`\" pulumi-lang-yaml=\"`secretWo`\" pulumi-lang-java=\"`secretWo`\" pulumi-lang-hcl=\"`secret_wo`\"\u003e`secretWo`\u003c/span\u003e so Terraform detects the change and applies an update." }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" }, "unregisteredUserPolicies": { "type": "array", "items": { "type": "string" }, "description": "A set of policies to be granted to unregistered users." } }, "type": "object" } }, "vault:radius/authBackendUser:AuthBackendUser": { "description": "Provides a resource to create a user in a [RADIUS auth backend within Vault](https://www.vaultproject.io/docs/auth/radius.html).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst radius = new vault.AuthBackend(\"radius\", {\n type: \"radius\",\n path: \"radius\",\n});\nconst user = new vault.radius.AuthBackendUser(\"user\", {\n mount: radius.path,\n username: \"test-user\",\n policies: [\n \"default\",\n \"dev-policy\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nradius = vault.AuthBackend(\"radius\",\n type=\"radius\",\n path=\"radius\")\nuser = vault.radius.AuthBackendUser(\"user\",\n mount=radius.path,\n username=\"test-user\",\n policies=[\n \"default\",\n \"dev-policy\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var radius = new Vault.AuthBackend(\"radius\", new()\n {\n Type = \"radius\",\n Path = \"radius\",\n });\n\n var user = new Vault.Radius.AuthBackendUser(\"user\", new()\n {\n Mount = radius.Path,\n Username = \"test-user\",\n Policies = new[]\n {\n \"default\",\n \"dev-policy\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/radius\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tradius2, err := vault.NewAuthBackend(ctx, \"radius\", \u0026vault.AuthBackendArgs{\n\t\t\tType: pulumi.String(\"radius\"),\n\t\t\tPath: pulumi.String(\"radius\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = radius.NewAuthBackendUser(ctx, \"user\", \u0026radius.AuthBackendUserArgs{\n\t\t\tMount: radius2.Path,\n\t\t\tUsername: pulumi.String(\"test-user\"),\n\t\t\tPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"default\"),\n\t\t\t\tpulumi.String(\"dev-policy\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_authbackend\" \"radius\" {\n type = \"radius\"\n path = \"radius\"\n}\nresource \"vault_radius_authbackenduser\" \"user\" {\n mount = vault_authbackend.radius.path\n username = \"test-user\"\n policies = [\"default\", \"dev-policy\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.AuthBackend;\nimport com.pulumi.vault.AuthBackendArgs;\nimport com.pulumi.vault.radius.AuthBackendUser;\nimport com.pulumi.vault.radius.AuthBackendUserArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var radius = new AuthBackend(\"radius\", AuthBackendArgs.builder()\n .type(\"radius\")\n .path(\"radius\")\n .build());\n\n var user = new AuthBackendUser(\"user\", AuthBackendUserArgs.builder()\n .mount(radius.path())\n .username(\"test-user\")\n .policies( \n \"default\",\n \"dev-policy\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n radius:\n type: vault:AuthBackend\n properties:\n type: radius\n path: radius\n user:\n type: vault:radius:AuthBackendUser\n properties:\n mount: ${radius.path}\n username: test-user\n policies:\n - default\n - dev-policy\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nRADIUS authentication backend users can be imported using the full user API path, e.g.\n\n```sh\n$ pulumi import vault:radius/authBackendUser:AuthBackendUser user auth/radius/users/test-user\n```\n\n", "properties": { "mount": { "type": "string", "description": "Path to the RADIUS auth mount where the user will be registered.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A set of Vault policies to associate with this user. If not set, only the \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e policy will be applicable to the user.\n\nFor more details on the usage of each argument consult the [Vault RADIUS API documentation](https://developer.hashicorp.com/vault/api-docs/auth/radius).\n" }, "username": { "type": "string", "description": "The username to register with the RADIUS auth backend.\n" } }, "required": [ "mount", "username" ], "inputProperties": { "mount": { "type": "string", "description": "Path to the RADIUS auth mount where the user will be registered.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A set of Vault policies to associate with this user. If not set, only the \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e policy will be applicable to the user.\n\nFor more details on the usage of each argument consult the [Vault RADIUS API documentation](https://developer.hashicorp.com/vault/api-docs/auth/radius).\n" }, "username": { "type": "string", "description": "The username to register with the RADIUS auth backend.\n" } }, "requiredInputs": [ "mount", "username" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendUser resources.\n", "properties": { "mount": { "type": "string", "description": "Path to the RADIUS auth mount where the user will be registered.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "policies": { "type": "array", "items": { "type": "string" }, "description": "A set of Vault policies to associate with this user. If not set, only the \u003cspan pulumi-lang-nodejs=\"`default`\" pulumi-lang-dotnet=\"`Default`\" pulumi-lang-go=\"`default`\" pulumi-lang-python=\"`default`\" pulumi-lang-yaml=\"`default`\" pulumi-lang-java=\"`default`\" pulumi-lang-hcl=\"`default`\"\u003e`default`\u003c/span\u003e policy will be applicable to the user.\n\nFor more details on the usage of each argument consult the [Vault RADIUS API documentation](https://developer.hashicorp.com/vault/api-docs/auth/radius).\n" }, "username": { "type": "string", "description": "The username to register with the RADIUS auth backend.\n" } }, "type": "object" } }, "vault:saml/authBackend:AuthBackend": { "description": "Manages a SAML Auth mount in a Vault server. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/saml/) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst test = new vault.saml.AuthBackend(\"test\", {\n path: \"saml\",\n idpMetadataUrl: \"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\",\n entityId: \"https://my.vault/v1/auth/saml\",\n acsUrls: [\"https://my.vault.primary/v1/auth/saml/callback\"],\n defaultRole: \"admin\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ntest = vault.saml.AuthBackend(\"test\",\n path=\"saml\",\n idp_metadata_url=\"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\",\n entity_id=\"https://my.vault/v1/auth/saml\",\n acs_urls=[\"https://my.vault.primary/v1/auth/saml/callback\"],\n default_role=\"admin\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var test = new Vault.Saml.AuthBackend(\"test\", new()\n {\n Path = \"saml\",\n IdpMetadataUrl = \"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\",\n EntityId = \"https://my.vault/v1/auth/saml\",\n AcsUrls = new[]\n {\n \"https://my.vault.primary/v1/auth/saml/callback\",\n },\n DefaultRole = \"admin\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/saml\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := saml.NewAuthBackend(ctx, \"test\", \u0026saml.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"saml\"),\n\t\t\tIdpMetadataUrl: pulumi.String(\"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\"),\n\t\t\tEntityId: pulumi.String(\"https://my.vault/v1/auth/saml\"),\n\t\t\tAcsUrls: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://my.vault.primary/v1/auth/saml/callback\"),\n\t\t\t},\n\t\t\tDefaultRole: pulumi.String(\"admin\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_saml_authbackend\" \"test\" {\n path = \"saml\"\n idp_metadata_url = \"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\"\n entity_id = \"https://my.vault/v1/auth/saml\"\n acs_urls = [\"https://my.vault.primary/v1/auth/saml/callback\"]\n default_role = \"admin\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.saml.AuthBackend;\nimport com.pulumi.vault.saml.AuthBackendArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var test = new AuthBackend(\"test\", AuthBackendArgs.builder()\n .path(\"saml\")\n .idpMetadataUrl(\"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\")\n .entityId(\"https://my.vault/v1/auth/saml\")\n .acsUrls(\"https://my.vault.primary/v1/auth/saml/callback\")\n .defaultRole(\"admin\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n test:\n type: vault:saml:AuthBackend\n properties:\n path: saml\n idpMetadataUrl: https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\n entityId: https://my.vault/v1/auth/saml\n acsUrls:\n - https://my.vault.primary/v1/auth/saml/callback\n defaultRole: admin\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nSAML authentication mounts can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:saml/authBackend:AuthBackend example saml\n```\n\n", "properties": { "acsUrls": { "type": "array", "items": { "type": "string" }, "description": "The well-formatted URLs of your Assertion Consumer Service (ACS)\nthat should receive a response from the identity provider.\n" }, "defaultRole": { "type": "string", "description": "The role to use if no role is provided during login.\n" }, "disableRemount": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "entityId": { "type": "string", "description": "The entity ID of the SAML authentication service provider.\n" }, "idpCert": { "type": "string", "description": "The PEM encoded certificate of the identity provider. Mutually exclusive\nwith \u003cspan pulumi-lang-nodejs=\"`idpMetadataUrl`\" pulumi-lang-dotnet=\"`IdpMetadataUrl`\" pulumi-lang-go=\"`idpMetadataUrl`\" pulumi-lang-python=\"`idp_metadata_url`\" pulumi-lang-yaml=\"`idpMetadataUrl`\" pulumi-lang-java=\"`idpMetadataUrl`\" pulumi-lang-hcl=\"`idp_metadata_url`\"\u003e`idpMetadataUrl`\u003c/span\u003e.\n" }, "idpEntityId": { "type": "string", "description": "The entity ID of the identity provider. Mutually exclusive with\n\u003cspan pulumi-lang-nodejs=\"`idpMetadataUrl`\" pulumi-lang-dotnet=\"`IdpMetadataUrl`\" pulumi-lang-go=\"`idpMetadataUrl`\" pulumi-lang-python=\"`idp_metadata_url`\" pulumi-lang-yaml=\"`idpMetadataUrl`\" pulumi-lang-java=\"`idpMetadataUrl`\" pulumi-lang-hcl=\"`idp_metadata_url`\"\u003e`idpMetadataUrl`\u003c/span\u003e.\n" }, "idpMetadataUrl": { "type": "string", "description": "The metadata URL of the identity provider.\n" }, "idpSsoUrl": { "type": "string", "description": "The SSO URL of the identity provider. Mutually exclusive with \n\u003cspan pulumi-lang-nodejs=\"`idpMetadataUrl`\" pulumi-lang-dotnet=\"`IdpMetadataUrl`\" pulumi-lang-go=\"`idpMetadataUrl`\" pulumi-lang-python=\"`idp_metadata_url`\" pulumi-lang-yaml=\"`idpMetadataUrl`\" pulumi-lang-java=\"`idpMetadataUrl`\" pulumi-lang-hcl=\"`idp_metadata_url`\"\u003e`idpMetadataUrl`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Path where the auth backend will be mounted. Defaults to `auth/saml`\nif not specified.\n" }, "tune": { "$ref": "#/types/vault:saml/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "validateAssertionSignature": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, validates the signature of \nthe SAML assertion. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 1.19+.\n" }, "validateResponseSignature": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, validates the signature of \nthe SAML response. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 1.19+.\n" }, "verboseLogging": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, logs additional, potentially sensitive\ninformation during the SAML exchange according to the current logging level. Not\nrecommended for production.\n" } }, "required": [ "acsUrls", "entityId", "tune", "validateAssertionSignature", "validateResponseSignature", "verboseLogging" ], "inputProperties": { "acsUrls": { "type": "array", "items": { "type": "string" }, "description": "The well-formatted URLs of your Assertion Consumer Service (ACS)\nthat should receive a response from the identity provider.\n" }, "defaultRole": { "type": "string", "description": "The role to use if no role is provided during login.\n" }, "disableRemount": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "entityId": { "type": "string", "description": "The entity ID of the SAML authentication service provider.\n" }, "idpCert": { "type": "string", "description": "The PEM encoded certificate of the identity provider. Mutually exclusive\nwith \u003cspan pulumi-lang-nodejs=\"`idpMetadataUrl`\" pulumi-lang-dotnet=\"`IdpMetadataUrl`\" pulumi-lang-go=\"`idpMetadataUrl`\" pulumi-lang-python=\"`idp_metadata_url`\" pulumi-lang-yaml=\"`idpMetadataUrl`\" pulumi-lang-java=\"`idpMetadataUrl`\" pulumi-lang-hcl=\"`idp_metadata_url`\"\u003e`idpMetadataUrl`\u003c/span\u003e.\n" }, "idpEntityId": { "type": "string", "description": "The entity ID of the identity provider. Mutually exclusive with\n\u003cspan pulumi-lang-nodejs=\"`idpMetadataUrl`\" pulumi-lang-dotnet=\"`IdpMetadataUrl`\" pulumi-lang-go=\"`idpMetadataUrl`\" pulumi-lang-python=\"`idp_metadata_url`\" pulumi-lang-yaml=\"`idpMetadataUrl`\" pulumi-lang-java=\"`idpMetadataUrl`\" pulumi-lang-hcl=\"`idp_metadata_url`\"\u003e`idpMetadataUrl`\u003c/span\u003e.\n" }, "idpMetadataUrl": { "type": "string", "description": "The metadata URL of the identity provider.\n" }, "idpSsoUrl": { "type": "string", "description": "The SSO URL of the identity provider. Mutually exclusive with \n\u003cspan pulumi-lang-nodejs=\"`idpMetadataUrl`\" pulumi-lang-dotnet=\"`IdpMetadataUrl`\" pulumi-lang-go=\"`idpMetadataUrl`\" pulumi-lang-python=\"`idp_metadata_url`\" pulumi-lang-yaml=\"`idpMetadataUrl`\" pulumi-lang-java=\"`idpMetadataUrl`\" pulumi-lang-hcl=\"`idp_metadata_url`\"\u003e`idpMetadataUrl`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path where the auth backend will be mounted. Defaults to `auth/saml`\nif not specified.\n", "willReplaceOnChanges": true }, "tune": { "$ref": "#/types/vault:saml/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "validateAssertionSignature": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, validates the signature of \nthe SAML assertion. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 1.19+.\n" }, "validateResponseSignature": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, validates the signature of \nthe SAML response. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 1.19+.\n" }, "verboseLogging": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, logs additional, potentially sensitive\ninformation during the SAML exchange according to the current logging level. Not\nrecommended for production.\n" } }, "requiredInputs": [ "acsUrls", "entityId" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackend resources.\n", "properties": { "acsUrls": { "type": "array", "items": { "type": "string" }, "description": "The well-formatted URLs of your Assertion Consumer Service (ACS)\nthat should receive a response from the identity provider.\n" }, "defaultRole": { "type": "string", "description": "The role to use if no role is provided during login.\n" }, "disableRemount": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, opts out of mount migration on path updates.\nSee here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)\n" }, "entityId": { "type": "string", "description": "The entity ID of the SAML authentication service provider.\n" }, "idpCert": { "type": "string", "description": "The PEM encoded certificate of the identity provider. Mutually exclusive\nwith \u003cspan pulumi-lang-nodejs=\"`idpMetadataUrl`\" pulumi-lang-dotnet=\"`IdpMetadataUrl`\" pulumi-lang-go=\"`idpMetadataUrl`\" pulumi-lang-python=\"`idp_metadata_url`\" pulumi-lang-yaml=\"`idpMetadataUrl`\" pulumi-lang-java=\"`idpMetadataUrl`\" pulumi-lang-hcl=\"`idp_metadata_url`\"\u003e`idpMetadataUrl`\u003c/span\u003e.\n" }, "idpEntityId": { "type": "string", "description": "The entity ID of the identity provider. Mutually exclusive with\n\u003cspan pulumi-lang-nodejs=\"`idpMetadataUrl`\" pulumi-lang-dotnet=\"`IdpMetadataUrl`\" pulumi-lang-go=\"`idpMetadataUrl`\" pulumi-lang-python=\"`idp_metadata_url`\" pulumi-lang-yaml=\"`idpMetadataUrl`\" pulumi-lang-java=\"`idpMetadataUrl`\" pulumi-lang-hcl=\"`idp_metadata_url`\"\u003e`idpMetadataUrl`\u003c/span\u003e.\n" }, "idpMetadataUrl": { "type": "string", "description": "The metadata URL of the identity provider.\n" }, "idpSsoUrl": { "type": "string", "description": "The SSO URL of the identity provider. Mutually exclusive with \n\u003cspan pulumi-lang-nodejs=\"`idpMetadataUrl`\" pulumi-lang-dotnet=\"`IdpMetadataUrl`\" pulumi-lang-go=\"`idpMetadataUrl`\" pulumi-lang-python=\"`idp_metadata_url`\" pulumi-lang-yaml=\"`idpMetadataUrl`\" pulumi-lang-java=\"`idpMetadataUrl`\" pulumi-lang-hcl=\"`idp_metadata_url`\"\u003e`idpMetadataUrl`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path where the auth backend will be mounted. Defaults to `auth/saml`\nif not specified.\n", "willReplaceOnChanges": true }, "tune": { "$ref": "#/types/vault:saml/AuthBackendTune:AuthBackendTune", "description": "Extra configuration block. Structure is documented below.\n\nThe \u003cspan pulumi-lang-nodejs=\"`tune`\" pulumi-lang-dotnet=\"`Tune`\" pulumi-lang-go=\"`tune`\" pulumi-lang-python=\"`tune`\" pulumi-lang-yaml=\"`tune`\" pulumi-lang-java=\"`tune`\" pulumi-lang-hcl=\"`tune`\"\u003e`tune`\u003c/span\u003e block is used to tune the auth backend:\n" }, "validateAssertionSignature": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, validates the signature of \nthe SAML assertion. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 1.19+.\n" }, "validateResponseSignature": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, validates the signature of \nthe SAML response. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e. Requires Vault 1.19+.\n" }, "verboseLogging": { "type": "boolean", "description": "If set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, logs additional, potentially sensitive\ninformation during the SAML exchange according to the current logging level. Not\nrecommended for production.\n" } }, "type": "object" } }, "vault:saml/authBackendRole:AuthBackendRole": { "description": "Manages an SAML auth backend role in a Vault server. See the [Vault\ndocumentation](https://www.vaultproject.io/docs/auth/saml.html) for more\ninformation.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst example = new vault.saml.AuthBackend(\"example\", {\n path: \"saml\",\n idpMetadataUrl: \"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\",\n entityId: \"https://my.vault/v1/auth/saml\",\n acsUrls: [\"https://my.vault.primary/v1/auth/saml/callback\"],\n defaultRole: \"default-role\",\n});\nconst exampleAuthBackendRole = new vault.saml.AuthBackendRole(\"example\", {\n path: example.path,\n name: \"my-role\",\n groupsAttribute: \"groups\",\n boundAttributes: {\n group: \"admin\",\n },\n boundSubjects: [\"*example.com\"],\n tokenPolicies: [\"writer\"],\n tokenTtl: 86400,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nexample = vault.saml.AuthBackend(\"example\",\n path=\"saml\",\n idp_metadata_url=\"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\",\n entity_id=\"https://my.vault/v1/auth/saml\",\n acs_urls=[\"https://my.vault.primary/v1/auth/saml/callback\"],\n default_role=\"default-role\")\nexample_auth_backend_role = vault.saml.AuthBackendRole(\"example\",\n path=example.path,\n name=\"my-role\",\n groups_attribute=\"groups\",\n bound_attributes={\n \"group\": \"admin\",\n },\n bound_subjects=[\"*example.com\"],\n token_policies=[\"writer\"],\n token_ttl=86400)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var example = new Vault.Saml.AuthBackend(\"example\", new()\n {\n Path = \"saml\",\n IdpMetadataUrl = \"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\",\n EntityId = \"https://my.vault/v1/auth/saml\",\n AcsUrls = new[]\n {\n \"https://my.vault.primary/v1/auth/saml/callback\",\n },\n DefaultRole = \"default-role\",\n });\n\n var exampleAuthBackendRole = new Vault.Saml.AuthBackendRole(\"example\", new()\n {\n Path = example.Path,\n Name = \"my-role\",\n GroupsAttribute = \"groups\",\n BoundAttributes = \n {\n { \"group\", \"admin\" },\n },\n BoundSubjects = new[]\n {\n \"*example.com\",\n },\n TokenPolicies = new[]\n {\n \"writer\",\n },\n TokenTtl = 86400,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/saml\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\texample, err := saml.NewAuthBackend(ctx, \"example\", \u0026saml.AuthBackendArgs{\n\t\t\tPath: pulumi.String(\"saml\"),\n\t\t\tIdpMetadataUrl: pulumi.String(\"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\"),\n\t\t\tEntityId: pulumi.String(\"https://my.vault/v1/auth/saml\"),\n\t\t\tAcsUrls: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"https://my.vault.primary/v1/auth/saml/callback\"),\n\t\t\t},\n\t\t\tDefaultRole: pulumi.String(\"default-role\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = saml.NewAuthBackendRole(ctx, \"example\", \u0026saml.AuthBackendRoleArgs{\n\t\t\tPath: example.Path,\n\t\t\tName: pulumi.String(\"my-role\"),\n\t\t\tGroupsAttribute: pulumi.String(\"groups\"),\n\t\t\tBoundAttributes: pulumi.StringMap{\n\t\t\t\t\"group\": pulumi.String(\"admin\"),\n\t\t\t},\n\t\t\tBoundSubjects: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"*example.com\"),\n\t\t\t},\n\t\t\tTokenPolicies: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"writer\"),\n\t\t\t},\n\t\t\tTokenTtl: pulumi.Int(86400),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_saml_authbackend\" \"example\" {\n path = \"saml\"\n idp_metadata_url = \"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\"\n entity_id = \"https://my.vault/v1/auth/saml\"\n acs_urls = [\"https://my.vault.primary/v1/auth/saml/callback\"]\n default_role = \"default-role\"\n}\nresource \"vault_saml_authbackendrole\" \"example\" {\n path = vault_saml_authbackend.example.path\n name = \"my-role\"\n groups_attribute = \"groups\"\n bound_attributes = {\n \"group\" = \"admin\"\n }\n bound_subjects = [\"*example.com\"]\n token_policies = [\"writer\"]\n token_ttl = 86400\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.saml.AuthBackend;\nimport com.pulumi.vault.saml.AuthBackendArgs;\nimport com.pulumi.vault.saml.AuthBackendRole;\nimport com.pulumi.vault.saml.AuthBackendRoleArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var example = new AuthBackend(\"example\", AuthBackendArgs.builder()\n .path(\"saml\")\n .idpMetadataUrl(\"https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\")\n .entityId(\"https://my.vault/v1/auth/saml\")\n .acsUrls(\"https://my.vault.primary/v1/auth/saml/callback\")\n .defaultRole(\"default-role\")\n .build());\n\n var exampleAuthBackendRole = new AuthBackendRole(\"exampleAuthBackendRole\", AuthBackendRoleArgs.builder()\n .path(example.path())\n .name(\"my-role\")\n .groupsAttribute(\"groups\")\n .boundAttributes(Map.of(\"group\", \"admin\"))\n .boundSubjects(\"*example.com\")\n .tokenPolicies(\"writer\")\n .tokenTtl(86400)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n example:\n type: vault:saml:AuthBackend\n properties:\n path: saml\n idpMetadataUrl: https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata\n entityId: https://my.vault/v1/auth/saml\n acsUrls:\n - https://my.vault.primary/v1/auth/saml/callback\n defaultRole: default-role\n exampleAuthBackendRole:\n type: vault:saml:AuthBackendRole\n name: example\n properties:\n path: ${example.path}\n name: my-role\n groupsAttribute: groups\n boundAttributes:\n group: admin\n boundSubjects:\n - '*example.com'\n tokenPolicies:\n - writer\n tokenTtl: 86400\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nSAML authentication backend roles can be imported using the \u003cspan pulumi-lang-nodejs=\"`path`\" pulumi-lang-dotnet=\"`Path`\" pulumi-lang-go=\"`path`\" pulumi-lang-python=\"`path`\" pulumi-lang-yaml=\"`path`\" pulumi-lang-java=\"`path`\" pulumi-lang-hcl=\"`path`\"\u003e`path`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:saml/authBackendRole:AuthBackendRole example auth/saml/role/my-role\n```\n\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "boundAttributes": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Mapping of attribute names to values that are expected to\nexist in the SAML assertion.\n" }, "boundAttributesType": { "type": "string", "description": "The type of matching assertion to perform on\n\u003cspan pulumi-lang-nodejs=\"`boundAttributesType`\" pulumi-lang-dotnet=\"`BoundAttributesType`\" pulumi-lang-go=\"`boundAttributesType`\" pulumi-lang-python=\"`bound_attributes_type`\" pulumi-lang-yaml=\"`boundAttributesType`\" pulumi-lang-java=\"`boundAttributesType`\" pulumi-lang-hcl=\"`bound_attributes_type`\"\u003e`boundAttributesType`\u003c/span\u003e.\n" }, "boundSubjects": { "type": "array", "items": { "type": "string" }, "description": "List of subjects being asserted for SAML authentication.\n" }, "boundSubjectsType": { "type": "string", "description": "The type of matching assertion to perform on \u003cspan pulumi-lang-nodejs=\"`boundSubjects`\" pulumi-lang-dotnet=\"`BoundSubjects`\" pulumi-lang-go=\"`boundSubjects`\" pulumi-lang-python=\"`bound_subjects`\" pulumi-lang-yaml=\"`boundSubjects`\" pulumi-lang-java=\"`boundSubjects`\" pulumi-lang-hcl=\"`bound_subjects`\"\u003e`boundSubjects`\u003c/span\u003e.\n" }, "groupsAttribute": { "type": "string", "description": "The attribute to use to identify the set of groups to which the\nuser belongs.\n" }, "name": { "type": "string", "description": "Unique name of the role.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n" }, "path": { "type": "string", "description": "Path where the auth backend is mounted.\n" }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "required": [ "boundAttributesType", "boundSubjectsType", "name", "path" ], "inputProperties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "boundAttributes": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Mapping of attribute names to values that are expected to\nexist in the SAML assertion.\n" }, "boundAttributesType": { "type": "string", "description": "The type of matching assertion to perform on\n\u003cspan pulumi-lang-nodejs=\"`boundAttributesType`\" pulumi-lang-dotnet=\"`BoundAttributesType`\" pulumi-lang-go=\"`boundAttributesType`\" pulumi-lang-python=\"`bound_attributes_type`\" pulumi-lang-yaml=\"`boundAttributesType`\" pulumi-lang-java=\"`boundAttributesType`\" pulumi-lang-hcl=\"`bound_attributes_type`\"\u003e`boundAttributesType`\u003c/span\u003e.\n" }, "boundSubjects": { "type": "array", "items": { "type": "string" }, "description": "List of subjects being asserted for SAML authentication.\n" }, "boundSubjectsType": { "type": "string", "description": "The type of matching assertion to perform on \u003cspan pulumi-lang-nodejs=\"`boundSubjects`\" pulumi-lang-dotnet=\"`BoundSubjects`\" pulumi-lang-go=\"`boundSubjects`\" pulumi-lang-python=\"`bound_subjects`\" pulumi-lang-yaml=\"`boundSubjects`\" pulumi-lang-java=\"`boundSubjects`\" pulumi-lang-hcl=\"`bound_subjects`\"\u003e`boundSubjects`\u003c/span\u003e.\n" }, "groupsAttribute": { "type": "string", "description": "The attribute to use to identify the set of groups to which the\nuser belongs.\n" }, "name": { "type": "string", "description": "Unique name of the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path where the auth backend is mounted.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "requiredInputs": [ "path" ], "stateInputs": { "description": "Input properties used for looking up and filtering AuthBackendRole resources.\n", "properties": { "aliasMetadata": { "type": "object", "additionalProperties": { "type": "string" }, "description": "The metadata to be tied to generated entity alias.\n This should be a list or map containing the metadata in key value pairs." }, "boundAttributes": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Mapping of attribute names to values that are expected to\nexist in the SAML assertion.\n" }, "boundAttributesType": { "type": "string", "description": "The type of matching assertion to perform on\n\u003cspan pulumi-lang-nodejs=\"`boundAttributesType`\" pulumi-lang-dotnet=\"`BoundAttributesType`\" pulumi-lang-go=\"`boundAttributesType`\" pulumi-lang-python=\"`bound_attributes_type`\" pulumi-lang-yaml=\"`boundAttributesType`\" pulumi-lang-java=\"`boundAttributesType`\" pulumi-lang-hcl=\"`bound_attributes_type`\"\u003e`boundAttributesType`\u003c/span\u003e.\n" }, "boundSubjects": { "type": "array", "items": { "type": "string" }, "description": "List of subjects being asserted for SAML authentication.\n" }, "boundSubjectsType": { "type": "string", "description": "The type of matching assertion to perform on \u003cspan pulumi-lang-nodejs=\"`boundSubjects`\" pulumi-lang-dotnet=\"`BoundSubjects`\" pulumi-lang-go=\"`boundSubjects`\" pulumi-lang-python=\"`bound_subjects`\" pulumi-lang-yaml=\"`boundSubjects`\" pulumi-lang-java=\"`boundSubjects`\" pulumi-lang-hcl=\"`bound_subjects`\"\u003e`boundSubjects`\u003c/span\u003e.\n" }, "groupsAttribute": { "type": "string", "description": "The attribute to use to identify the set of groups to which the\nuser belongs.\n" }, "name": { "type": "string", "description": "Unique name of the role.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "path": { "type": "string", "description": "Path where the auth backend is mounted.\n", "willReplaceOnChanges": true }, "tokenBoundCidrs": { "type": "array", "items": { "type": "string" }, "description": "Specifies the blocks of IP addresses which are allowed to use the generated token" }, "tokenExplicitMaxTtl": { "type": "integer", "description": "Generated Token's Explicit Maximum TTL in seconds" }, "tokenMaxTtl": { "type": "integer", "description": "The maximum lifetime of the generated token" }, "tokenNoDefaultPolicy": { "type": "boolean", "description": "If true, the 'default' policy will not automatically be added to generated tokens" }, "tokenNumUses": { "type": "integer", "description": "The maximum number of times a token may be used, a value of zero means unlimited" }, "tokenPeriod": { "type": "integer", "description": "Generated Token's Period" }, "tokenPolicies": { "type": "array", "items": { "type": "string" }, "description": "Generated Token's Policies" }, "tokenTtl": { "type": "integer", "description": "The initial ttl of the token to generate in seconds" }, "tokenType": { "type": "string", "description": "The type of token to generate, service or batch" } }, "type": "object" } }, "vault:secrets/syncAssociation:SyncAssociation": { "description": "Triggers a sync operation in Vault and links a secret to an existing destination.\nRequires Vault 1.16+. *Available only for Vault Enterprise*.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\nFor more information on associations, please refer to the Vault\n[documentation](https://developer.hashicorp.com/vault/docs/sync#associations).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst kvv2 = new vault.Mount(\"kvv2\", {\n path: \"kvv2\",\n type: \"kv\",\n options: {\n version: \"2\",\n },\n description: \"KV Version 2 secret engine mount\",\n});\nconst token = new vault.kv.SecretV2(\"token\", {\n mount: kvv2.path,\n name: \"token\",\n dataJson: JSON.stringify({\n dev: \"B!gS3cr3t\",\n prod: \"S3cureP4$$\",\n }),\n});\nconst gh = new vault.secrets.SyncGhDestination(\"gh\", {\n name: \"gh-dest\",\n accessToken: accessToken,\n repositoryOwner: repoOwner,\n repositoryName: \"repo-name-example\",\n secretNameTemplate: \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n});\nconst ghToken = new vault.secrets.SyncAssociation(\"gh_token\", {\n name: gh.name,\n type: gh.type,\n mount: kvv2.path,\n secretName: token.name,\n});\n```\n```python\nimport pulumi\nimport json\nimport pulumi_vault as vault\n\nkvv2 = vault.Mount(\"kvv2\",\n path=\"kvv2\",\n type=\"kv\",\n options={\n \"version\": \"2\",\n },\n description=\"KV Version 2 secret engine mount\")\ntoken = vault.kv.SecretV2(\"token\",\n mount=kvv2.path,\n name=\"token\",\n data_json=json.dumps({\n \"dev\": \"B!gS3cr3t\",\n \"prod\": \"S3cureP4$$\",\n }))\ngh = vault.secrets.SyncGhDestination(\"gh\",\n name=\"gh-dest\",\n access_token=access_token,\n repository_owner=repo_owner,\n repository_name=\"repo-name-example\",\n secret_name_template=\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\")\ngh_token = vault.secrets.SyncAssociation(\"gh_token\",\n name=gh.name,\n type=gh.type,\n mount=kvv2.path,\n secret_name=token.name)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing System.Text.Json;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var kvv2 = new Vault.Mount(\"kvv2\", new()\n {\n Path = \"kvv2\",\n Type = \"kv\",\n Options = \n {\n { \"version\", \"2\" },\n },\n Description = \"KV Version 2 secret engine mount\",\n });\n\n var token = new Vault.Kv.SecretV2(\"token\", new()\n {\n Mount = kvv2.Path,\n Name = \"token\",\n DataJson = JsonSerializer.Serialize(new Dictionary\u003cstring, object?\u003e\n {\n [\"dev\"] = \"B!gS3cr3t\",\n [\"prod\"] = \"S3cureP4$$\",\n }),\n });\n\n var gh = new Vault.Secrets.SyncGhDestination(\"gh\", new()\n {\n Name = \"gh-dest\",\n AccessToken = accessToken,\n RepositoryOwner = repoOwner,\n RepositoryName = \"repo-name-example\",\n SecretNameTemplate = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n });\n\n var ghToken = new Vault.Secrets.SyncAssociation(\"gh_token\", new()\n {\n Name = gh.Name,\n Type = gh.Type,\n Mount = kvv2.Path,\n SecretName = token.Name,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"encoding/json\"\n\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/kv\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tkvv2, err := vault.NewMount(ctx, \"kvv2\", \u0026vault.MountArgs{\n\t\t\tPath: pulumi.String(\"kvv2\"),\n\t\t\tType: pulumi.String(\"kv\"),\n\t\t\tOptions: pulumi.StringMap{\n\t\t\t\t\"version\": pulumi.String(\"2\"),\n\t\t\t},\n\t\t\tDescription: pulumi.String(\"KV Version 2 secret engine mount\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttmpJSON0, err := json.Marshal(map[string]string{\n\t\t\t\"dev\": \"B!gS3cr3t\",\n\t\t\t\"prod\": \"S3cureP4$$\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tjson0 := string(tmpJSON0)\n\t\ttoken, err := kv.NewSecretV2(ctx, \"token\", \u0026kv.SecretV2Args{\n\t\t\tMount: kvv2.Path,\n\t\t\tName: pulumi.String(\"token\"),\n\t\t\tDataJson: pulumi.String(json0),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tgh, err := secrets.NewSyncGhDestination(ctx, \"gh\", \u0026secrets.SyncGhDestinationArgs{\n\t\t\tName: pulumi.String(\"gh-dest\"),\n\t\t\tAccessToken: pulumi.Any(accessToken),\n\t\t\tRepositoryOwner: pulumi.Any(repoOwner),\n\t\t\tRepositoryName: pulumi.String(\"repo-name-example\"),\n\t\t\tSecretNameTemplate: pulumi.String(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = secrets.NewSyncAssociation(ctx, \"gh_token\", \u0026secrets.SyncAssociationArgs{\n\t\t\tName: gh.Name,\n\t\t\tType: gh.Type,\n\t\t\tMount: kvv2.Path,\n\t\t\tSecretName: token.Name,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_mount\" \"kvv2\" {\n path = \"kvv2\"\n type = \"kv\"\n options = {\n \"version\" = \"2\"\n }\n description = \"KV Version 2 secret engine mount\"\n}\nresource \"vault_kv_secretv2\" \"token\" {\n mount = vault_mount.kvv2.path\n name = \"token\"\n data_json = jsonencode({\n \"dev\" = \"B!gS3cr3t\"\n \"prod\" = \"S3cureP4$$\"\n })\n}\nresource \"vault_secrets_syncghdestination\" \"gh\" {\n name = \"gh-dest\"\n access_token = accessToken\n repository_owner = repoOwner\n repository_name = \"repo-name-example\"\n secret_name_template = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"\n}\nresource \"vault_secrets_syncassociation\" \"gh_token\" {\n name = vault_secrets_syncghdestination.gh.name\n type = vault_secrets_syncghdestination.gh.type\n mount = vault_mount.kvv2.path\n secret_name = vault_kv_secretv2.token.name\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.Mount;\nimport com.pulumi.vault.MountArgs;\nimport com.pulumi.vault.kv.SecretV2;\nimport com.pulumi.vault.kv.SecretV2Args;\nimport com.pulumi.vault.secrets.SyncGhDestination;\nimport com.pulumi.vault.secrets.SyncGhDestinationArgs;\nimport com.pulumi.vault.secrets.SyncAssociation;\nimport com.pulumi.vault.secrets.SyncAssociationArgs;\nimport static com.pulumi.codegen.internal.Serialization.*;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var kvv2 = new Mount(\"kvv2\", MountArgs.builder()\n .path(\"kvv2\")\n .type(\"kv\")\n .options(Map.of(\"version\", \"2\"))\n .description(\"KV Version 2 secret engine mount\")\n .build());\n\n var token = new SecretV2(\"token\", SecretV2Args.builder()\n .mount(kvv2.path())\n .name(\"token\")\n .dataJson(serializeJson(\n jsonObject(\n jsonProperty(\"dev\", \"B!gS3cr3t\"),\n jsonProperty(\"prod\", \"S3cureP4$$\")\n )))\n .build());\n\n var gh = new SyncGhDestination(\"gh\", SyncGhDestinationArgs.builder()\n .name(\"gh-dest\")\n .accessToken(accessToken)\n .repositoryOwner(repoOwner)\n .repositoryName(\"repo-name-example\")\n .secretNameTemplate(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\")\n .build());\n\n var ghToken = new SyncAssociation(\"ghToken\", SyncAssociationArgs.builder()\n .name(gh.name())\n .type(gh.type())\n .mount(kvv2.path())\n .secretName(token.name())\n .build());\n\n }\n}\n```\n```yaml\nresources:\n kvv2:\n type: vault:Mount\n properties:\n path: kvv2\n type: kv\n options:\n version: '2'\n description: KV Version 2 secret engine mount\n token:\n type: vault:kv:SecretV2\n properties:\n mount: ${kvv2.path}\n name: token\n dataJson:\n fn::toJSON:\n dev: B!gS3cr3t\n prod: S3cureP4$$\n gh:\n type: vault:secrets:SyncGhDestination\n properties:\n name: gh-dest\n accessToken: ${accessToken}\n repositoryOwner: ${repoOwner}\n repositoryName: repo-name-example\n secretNameTemplate: vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\n ghToken:\n type: vault:secrets:SyncAssociation\n name: gh_token\n properties:\n name: ${gh.name}\n type: ${gh.type}\n mount: ${kvv2.path}\n secretName: ${token.name}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n", "properties": { "metadatas": { "type": "array", "items": { "$ref": "#/types/vault:secrets/SyncAssociationMetadata:SyncAssociationMetadata" }, "description": "Metadata for each subkey of the associated secret." }, "mount": { "type": "string", "description": "Specifies the mount where the secret is located.\n" }, "name": { "type": "string", "description": "Specifies the name of the destination.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "secretName": { "type": "string", "description": "Specifies the name of the secret to synchronize.\n" }, "type": { "type": "string", "description": "Specifies the destination type.\n" } }, "required": [ "metadatas", "mount", "name", "secretName", "type" ], "inputProperties": { "mount": { "type": "string", "description": "Specifies the mount where the secret is located.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "Specifies the name of the destination.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n", "willReplaceOnChanges": true }, "secretName": { "type": "string", "description": "Specifies the name of the secret to synchronize.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Specifies the destination type.\n", "willReplaceOnChanges": true } }, "requiredInputs": [ "mount", "secretName", "type" ], "stateInputs": { "description": "Input properties used for looking up and filtering SyncAssociation resources.\n", "properties": { "metadatas": { "type": "array", "items": { "$ref": "#/types/vault:secrets/SyncAssociationMetadata:SyncAssociationMetadata" }, "description": "Metadata for each subkey of the associated secret." }, "mount": { "type": "string", "description": "Specifies the mount where the secret is located.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "Specifies the name of the destination.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n", "willReplaceOnChanges": true }, "secretName": { "type": "string", "description": "Specifies the name of the secret to synchronize.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "Specifies the destination type.\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:secrets/syncAwsDestination:SyncAwsDestination": { "description": "Creates an AWS destination to synchronize secrets in Vault. Requires Vault 1.16+.\n*Available only for Vault Enterprise*.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\nFor more information on syncing secrets with AWS, please refer to the Vault\n[documentation](https://developer.hashicorp.com/vault/docs/sync/awssm).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst aws = new vault.secrets.SyncAwsDestination(\"aws\", {\n name: \"aws-dest\",\n accessKeyId: accessKeyId,\n secretAccessKey: secretAccessKey,\n region: \"us-east-1\",\n roleArn: \"role-arn\",\n externalId: \"external-id\",\n secretNameTemplate: \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n customTags: {\n foo: \"bar\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws = vault.secrets.SyncAwsDestination(\"aws\",\n name=\"aws-dest\",\n access_key_id=access_key_id,\n secret_access_key=secret_access_key,\n region=\"us-east-1\",\n role_arn=\"role-arn\",\n external_id=\"external-id\",\n secret_name_template=\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n custom_tags={\n \"foo\": \"bar\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var aws = new Vault.Secrets.SyncAwsDestination(\"aws\", new()\n {\n Name = \"aws-dest\",\n AccessKeyId = accessKeyId,\n SecretAccessKey = secretAccessKey,\n Region = \"us-east-1\",\n RoleArn = \"role-arn\",\n ExternalId = \"external-id\",\n SecretNameTemplate = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n CustomTags = \n {\n { \"foo\", \"bar\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncAwsDestination(ctx, \"aws\", \u0026secrets.SyncAwsDestinationArgs{\n\t\t\tName: pulumi.String(\"aws-dest\"),\n\t\t\tAccessKeyId: pulumi.Any(accessKeyId),\n\t\t\tSecretAccessKey: pulumi.Any(secretAccessKey),\n\t\t\tRegion: pulumi.String(\"us-east-1\"),\n\t\t\tRoleArn: pulumi.String(\"role-arn\"),\n\t\t\tExternalId: pulumi.String(\"external-id\"),\n\t\t\tSecretNameTemplate: pulumi.String(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"),\n\t\t\tCustomTags: pulumi.StringMap{\n\t\t\t\t\"foo\": pulumi.String(\"bar\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncawsdestination\" \"aws\" {\n name = \"aws-dest\"\n access_key_id = accessKeyId\n secret_access_key = secretAccessKey\n region = \"us-east-1\"\n role_arn = \"role-arn\"\n external_id = \"external-id\"\n secret_name_template = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"\n custom_tags = {\n \"foo\" = \"bar\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncAwsDestination;\nimport com.pulumi.vault.secrets.SyncAwsDestinationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var aws = new SyncAwsDestination(\"aws\", SyncAwsDestinationArgs.builder()\n .name(\"aws-dest\")\n .accessKeyId(accessKeyId)\n .secretAccessKey(secretAccessKey)\n .region(\"us-east-1\")\n .roleArn(\"role-arn\")\n .externalId(\"external-id\")\n .secretNameTemplate(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\")\n .customTags(Map.of(\"foo\", \"bar\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n aws:\n type: vault:secrets:SyncAwsDestination\n properties:\n name: aws-dest\n accessKeyId: ${accessKeyId}\n secretAccessKey: ${secretAccessKey}\n region: us-east-1\n roleArn: role-arn\n externalId: external-id\n secretNameTemplate: vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\n customTags:\n foo: bar\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Example with Networking Restrictions\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst awsRestricted = new vault.secrets.SyncAwsDestination(\"aws_restricted\", {\n name: \"aws-dest-restricted\",\n accessKeyId: accessKeyId,\n secretAccessKey: secretAccessKey,\n region: \"us-east-1\",\n allowedIpv4Addresses: [\n \"192.168.1.0/24\",\n \"10.0.0.0/8\",\n ],\n allowedIpv6Addresses: [\"2001:db8::/32\"],\n allowedPorts: [\n 443,\n 8200,\n ],\n disableStrictNetworking: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws_restricted = vault.secrets.SyncAwsDestination(\"aws_restricted\",\n name=\"aws-dest-restricted\",\n access_key_id=access_key_id,\n secret_access_key=secret_access_key,\n region=\"us-east-1\",\n allowed_ipv4_addresses=[\n \"192.168.1.0/24\",\n \"10.0.0.0/8\",\n ],\n allowed_ipv6_addresses=[\"2001:db8::/32\"],\n allowed_ports=[\n 443,\n 8200,\n ],\n disable_strict_networking=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var awsRestricted = new Vault.Secrets.SyncAwsDestination(\"aws_restricted\", new()\n {\n Name = \"aws-dest-restricted\",\n AccessKeyId = accessKeyId,\n SecretAccessKey = secretAccessKey,\n Region = \"us-east-1\",\n AllowedIpv4Addresses = new[]\n {\n \"192.168.1.0/24\",\n \"10.0.0.0/8\",\n },\n AllowedIpv6Addresses = new[]\n {\n \"2001:db8::/32\",\n },\n AllowedPorts = new[]\n {\n 443,\n 8200,\n },\n DisableStrictNetworking = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncAwsDestination(ctx, \"aws_restricted\", \u0026secrets.SyncAwsDestinationArgs{\n\t\t\tName: pulumi.String(\"aws-dest-restricted\"),\n\t\t\tAccessKeyId: pulumi.Any(accessKeyId),\n\t\t\tSecretAccessKey: pulumi.Any(secretAccessKey),\n\t\t\tRegion: pulumi.String(\"us-east-1\"),\n\t\t\tAllowedIpv4Addresses: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"192.168.1.0/24\"),\n\t\t\t\tpulumi.String(\"10.0.0.0/8\"),\n\t\t\t},\n\t\t\tAllowedIpv6Addresses: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"2001:db8::/32\"),\n\t\t\t},\n\t\t\tAllowedPorts: pulumi.IntArray{\n\t\t\t\tpulumi.Int(443),\n\t\t\t\tpulumi.Int(8200),\n\t\t\t},\n\t\t\tDisableStrictNetworking: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncawsdestination\" \"aws_restricted\" {\n name = \"aws-dest-restricted\"\n access_key_id = accessKeyId\n secret_access_key = secretAccessKey\n region = \"us-east-1\"\n allowed_ipv4_addresses = [\"192.168.1.0/24\", \"10.0.0.0/8\"]\n allowed_ipv6_addresses = [\"2001:db8::/32\"]\n allowed_ports = [443, 8200]\n disable_strict_networking = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncAwsDestination;\nimport com.pulumi.vault.secrets.SyncAwsDestinationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var awsRestricted = new SyncAwsDestination(\"awsRestricted\", SyncAwsDestinationArgs.builder()\n .name(\"aws-dest-restricted\")\n .accessKeyId(accessKeyId)\n .secretAccessKey(secretAccessKey)\n .region(\"us-east-1\")\n .allowedIpv4Addresses( \n \"192.168.1.0/24\",\n \"10.0.0.0/8\")\n .allowedIpv6Addresses(\"2001:db8::/32\")\n .allowedPorts( \n 443,\n 8200)\n .disableStrictNetworking(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n awsRestricted:\n type: vault:secrets:SyncAwsDestination\n name: aws_restricted\n properties:\n name: aws-dest-restricted\n accessKeyId: ${accessKeyId}\n secretAccessKey: ${secretAccessKey}\n region: us-east-1\n allowedIpv4Addresses:\n - 192.168.1.0/24\n - 10.0.0.0/8\n allowedIpv6Addresses:\n - 2001:db8::/32\n allowedPorts:\n - 443\n - 8200\n disableStrictNetworking: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Workload Identity Federation (Vault 2.0.0+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst awsWif = new vault.secrets.SyncAwsDestination(\"aws_wif\", {\n name: \"aws-dest-wif\",\n region: \"us-east-1\",\n roleArn: roleArn,\n identityTokenAudienceWo: identityTokenAudience,\n identityTokenAudienceWoVersion: 1,\n identityTokenTtl: 3600,\n identityTokenKeyWo: \"my-key\",\n identityTokenKeyWoVersion: 1,\n granularity: \"secret-path\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws_wif = vault.secrets.SyncAwsDestination(\"aws_wif\",\n name=\"aws-dest-wif\",\n region=\"us-east-1\",\n role_arn=role_arn,\n identity_token_audience_wo=identity_token_audience,\n identity_token_audience_wo_version=1,\n identity_token_ttl=3600,\n identity_token_key_wo=\"my-key\",\n identity_token_key_wo_version=1,\n granularity=\"secret-path\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var awsWif = new Vault.Secrets.SyncAwsDestination(\"aws_wif\", new()\n {\n Name = \"aws-dest-wif\",\n Region = \"us-east-1\",\n RoleArn = roleArn,\n IdentityTokenAudienceWo = identityTokenAudience,\n IdentityTokenAudienceWoVersion = 1,\n IdentityTokenTtl = 3600,\n IdentityTokenKeyWo = \"my-key\",\n IdentityTokenKeyWoVersion = 1,\n Granularity = \"secret-path\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncAwsDestination(ctx, \"aws_wif\", \u0026secrets.SyncAwsDestinationArgs{\n\t\t\tName: pulumi.String(\"aws-dest-wif\"),\n\t\t\tRegion: pulumi.String(\"us-east-1\"),\n\t\t\tRoleArn: pulumi.Any(roleArn),\n\t\t\tIdentityTokenAudienceWo: pulumi.Any(identityTokenAudience),\n\t\t\tIdentityTokenAudienceWoVersion: pulumi.Int(1),\n\t\t\tIdentityTokenTtl: pulumi.Int(3600),\n\t\t\tIdentityTokenKeyWo: pulumi.String(\"my-key\"),\n\t\t\tIdentityTokenKeyWoVersion: pulumi.Int(1),\n\t\t\tGranularity: pulumi.String(\"secret-path\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncawsdestination\" \"aws_wif\" {\n name = \"aws-dest-wif\"\n region = \"us-east-1\"\n role_arn = roleArn\n identity_token_audience_wo = identityTokenAudience\n identity_token_audience_wo_version = 1\n identity_token_ttl = 3600\n identity_token_key_wo = \"my-key\"\n identity_token_key_wo_version = 1\n granularity = \"secret-path\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncAwsDestination;\nimport com.pulumi.vault.secrets.SyncAwsDestinationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var awsWif = new SyncAwsDestination(\"awsWif\", SyncAwsDestinationArgs.builder()\n .name(\"aws-dest-wif\")\n .region(\"us-east-1\")\n .roleArn(roleArn)\n .identityTokenAudienceWo(identityTokenAudience)\n .identityTokenAudienceWoVersion(1)\n .identityTokenTtl(3600)\n .identityTokenKeyWo(\"my-key\")\n .identityTokenKeyWoVersion(1)\n .granularity(\"secret-path\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n awsWif:\n type: vault:secrets:SyncAwsDestination\n name: aws_wif\n properties:\n name: aws-dest-wif\n region: us-east-1\n roleArn: ${roleArn}\n identityTokenAudienceWo: ${identityTokenAudience}\n identityTokenAudienceWoVersion: 1\n identityTokenTtl: 3600\n identityTokenKeyWo: my-key\n identityTokenKeyWoVersion: 1\n granularity: secret-path\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Custom KMS Key (Vault 2.2.0+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst awsKmsKeyId = new vault.secrets.SyncAwsDestination(\"aws_kms_key_id\", {\n name: \"aws-dest-kms-key-id\",\n accessKeyId: accessKeyId,\n secretAccessKey: secretAccessKey,\n region: \"us-east-1\",\n kmsKeyId: \"arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws_kms_key_id = vault.secrets.SyncAwsDestination(\"aws_kms_key_id\",\n name=\"aws-dest-kms-key-id\",\n access_key_id=access_key_id,\n secret_access_key=secret_access_key,\n region=\"us-east-1\",\n kms_key_id=\"arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var awsKmsKeyId = new Vault.Secrets.SyncAwsDestination(\"aws_kms_key_id\", new()\n {\n Name = \"aws-dest-kms-key-id\",\n AccessKeyId = accessKeyId,\n SecretAccessKey = secretAccessKey,\n Region = \"us-east-1\",\n KmsKeyId = \"arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncAwsDestination(ctx, \"aws_kms_key_id\", \u0026secrets.SyncAwsDestinationArgs{\n\t\t\tName: pulumi.String(\"aws-dest-kms-key-id\"),\n\t\t\tAccessKeyId: pulumi.Any(accessKeyId),\n\t\t\tSecretAccessKey: pulumi.Any(secretAccessKey),\n\t\t\tRegion: pulumi.String(\"us-east-1\"),\n\t\t\tKmsKeyId: pulumi.String(\"arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncawsdestination\" \"aws_kms_key_id\" {\n name = \"aws-dest-kms-key-id\"\n access_key_id = accessKeyId\n secret_access_key = secretAccessKey\n region = \"us-east-1\"\n kms_key_id = \"arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncAwsDestination;\nimport com.pulumi.vault.secrets.SyncAwsDestinationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var awsKmsKeyId = new SyncAwsDestination(\"awsKmsKeyId\", SyncAwsDestinationArgs.builder()\n .name(\"aws-dest-kms-key-id\")\n .accessKeyId(accessKeyId)\n .secretAccessKey(secretAccessKey)\n .region(\"us-east-1\")\n .kmsKeyId(\"arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n awsKmsKeyId:\n type: vault:secrets:SyncAwsDestination\n name: aws_kms_key_id\n properties:\n name: aws-dest-kms-key-id\n accessKeyId: ${accessKeyId}\n secretAccessKey: ${secretAccessKey}\n region: us-east-1\n kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Replica Regions (Vault 2.2.0+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst awsReplicaRegions = new vault.secrets.SyncAwsDestination(\"aws_replica_regions\", {\n name: \"aws-dest-replica-regions\",\n accessKeyId: accessKeyId,\n secretAccessKey: secretAccessKey,\n region: \"us-east-1\",\n replicaRegions: {\n \"us-east-2\": \"arn:aws:kms:us-east-2:123456789012:key/mrk-1234567890abcdef1234567890abcdef\",\n \"us-west-1\": \"arn:aws:kms:us-west-1:123456789012:key/mrk-1234567890abcdef1234567890abcdef\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naws_replica_regions = vault.secrets.SyncAwsDestination(\"aws_replica_regions\",\n name=\"aws-dest-replica-regions\",\n access_key_id=access_key_id,\n secret_access_key=secret_access_key,\n region=\"us-east-1\",\n replica_regions={\n \"us-east-2\": \"arn:aws:kms:us-east-2:123456789012:key/mrk-1234567890abcdef1234567890abcdef\",\n \"us-west-1\": \"arn:aws:kms:us-west-1:123456789012:key/mrk-1234567890abcdef1234567890abcdef\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var awsReplicaRegions = new Vault.Secrets.SyncAwsDestination(\"aws_replica_regions\", new()\n {\n Name = \"aws-dest-replica-regions\",\n AccessKeyId = accessKeyId,\n SecretAccessKey = secretAccessKey,\n Region = \"us-east-1\",\n ReplicaRegions = \n {\n { \"us-east-2\", \"arn:aws:kms:us-east-2:123456789012:key/mrk-1234567890abcdef1234567890abcdef\" },\n { \"us-west-1\", \"arn:aws:kms:us-west-1:123456789012:key/mrk-1234567890abcdef1234567890abcdef\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncAwsDestination(ctx, \"aws_replica_regions\", \u0026secrets.SyncAwsDestinationArgs{\n\t\t\tName: pulumi.String(\"aws-dest-replica-regions\"),\n\t\t\tAccessKeyId: pulumi.Any(accessKeyId),\n\t\t\tSecretAccessKey: pulumi.Any(secretAccessKey),\n\t\t\tRegion: pulumi.String(\"us-east-1\"),\n\t\t\tReplicaRegions: pulumi.StringMap{\n\t\t\t\t\"us-east-2\": pulumi.String(\"arn:aws:kms:us-east-2:123456789012:key/mrk-1234567890abcdef1234567890abcdef\"),\n\t\t\t\t\"us-west-1\": pulumi.String(\"arn:aws:kms:us-west-1:123456789012:key/mrk-1234567890abcdef1234567890abcdef\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncawsdestination\" \"aws_replica_regions\" {\n name = \"aws-dest-replica-regions\"\n access_key_id = accessKeyId\n secret_access_key = secretAccessKey\n region = \"us-east-1\"\n replica_regions = {\n \"us-east-2\" = \"arn:aws:kms:us-east-2:123456789012:key/mrk-1234567890abcdef1234567890abcdef\"\n \"us-west-1\" = \"arn:aws:kms:us-west-1:123456789012:key/mrk-1234567890abcdef1234567890abcdef\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncAwsDestination;\nimport com.pulumi.vault.secrets.SyncAwsDestinationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var awsReplicaRegions = new SyncAwsDestination(\"awsReplicaRegions\", SyncAwsDestinationArgs.builder()\n .name(\"aws-dest-replica-regions\")\n .accessKeyId(accessKeyId)\n .secretAccessKey(secretAccessKey)\n .region(\"us-east-1\")\n .replicaRegions(Map.ofEntries(\n Map.entry(\"us-east-2\", \"arn:aws:kms:us-east-2:123456789012:key/mrk-1234567890abcdef1234567890abcdef\"),\n Map.entry(\"us-west-1\", \"arn:aws:kms:us-west-1:123456789012:key/mrk-1234567890abcdef1234567890abcdef\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n awsReplicaRegions:\n type: vault:secrets:SyncAwsDestination\n name: aws_replica_regions\n properties:\n name: aws-dest-replica-regions\n accessKeyId: ${accessKeyId}\n secretAccessKey: ${secretAccessKey}\n region: us-east-1\n replicaRegions:\n us-east-2: arn:aws:kms:us-east-2:123456789012:key/mrk-1234567890abcdef1234567890abcdef\n us-west-1: arn:aws:kms:us-west-1:123456789012:key/mrk-1234567890abcdef1234567890abcdef\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAWS Secrets sync destinations can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:secrets/syncAwsDestination:SyncAwsDestination aws aws-dest\n```\n\n", "properties": { "accessKeyId": { "type": "string", "description": "Access key id to authenticate against the AWS secrets manager.\nCan be omitted and directly provided to Vault using the `AWS_ACCESS_KEY_ID` environment\nvariable.\n" }, "allowedIpv4Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv4 addresses for outbound connections from Vault to AWS Secrets Manager.\nCan also be set via an IP address range using CIDR notation. For example: `[\"192.168.1.0/24\", \"10.0.0.0/8\"]`.\n**Requires Vault 1.19.0+**.\n" }, "allowedIpv6Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv6 addresses for outbound connections from Vault to AWS Secrets Manager.\nCan also be set via an IP address range using CIDR notation. For example: `[\"2001:db8::/32\"]`.\n**Requires Vault 1.19.0+**.\n" }, "allowedPorts": { "type": "array", "items": { "type": "integer" }, "description": "Allowed ports for outbound connections from Vault to AWS Secrets Manager.\nFor example: `[443, 8200]`.\n**Requires Vault 1.19.0+**.\n" }, "customTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom tags to set on the secret managed at the destination.\n" }, "disableStrictNetworking": { "type": "boolean", "description": "Disable strict networking mode. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, Vault will not enforce\nallowed IP addresses and ports. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n**Requires Vault 1.19.0+**.\n" }, "externalId": { "type": "string", "description": "Optional extra protection that must match the trust policy granting access to the\nAWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.\nThe field is mutable with no special condition, but users must be careful that the new value fits with the trust\nrelationship condition they set on AWS otherwise sync operations will start to fail due to client-side access\ndenied errors. Ignored if the \u003cspan pulumi-lang-nodejs=\"`roleArn`\" pulumi-lang-dotnet=\"`RoleArn`\" pulumi-lang-go=\"`roleArn`\" pulumi-lang-python=\"`role_arn`\" pulumi-lang-yaml=\"`roleArn`\" pulumi-lang-java=\"`roleArn`\" pulumi-lang-hcl=\"`role_arn`\"\u003e`roleArn`\u003c/span\u003e field is empty.\n" }, "granularity": { "type": "string", "description": "Determines what level of information is synced as a distinct resource \nat the destination. Supports `secret-path` and `secret-key`.\n" }, "identityTokenAudienceWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe audience claim value for identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenAudienceWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenAudienceWo \" pulumi-lang-dotnet=\" IdentityTokenAudienceWo \" pulumi-lang-go=\" identityTokenAudienceWo \" pulumi-lang-python=\" identity_token_audience_wo \" pulumi-lang-yaml=\" identityTokenAudienceWo \" pulumi-lang-java=\" identityTokenAudienceWo \" pulumi-lang-hcl=\" identity_token_audience_wo \"\u003e identityTokenAudienceWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe key to use for signing identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenKeyWo \" pulumi-lang-dotnet=\" IdentityTokenKeyWo \" pulumi-lang-go=\" identityTokenKeyWo \" pulumi-lang-python=\" identity_token_key_wo \" pulumi-lang-yaml=\" identityTokenKeyWo \" pulumi-lang-java=\" identityTokenKeyWo \" pulumi-lang-hcl=\" identity_token_key_wo \"\u003e identityTokenKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens." }, "kmsKeyId": { "type": "string", "description": "Specifies the ARN of the AWS KMS key to be used to encrypt the secret." }, "name": { "type": "string", "description": "Unique name of the AWS destination.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "region": { "type": "string", "description": "Region where to manage the secrets manager entries.\nCan be omitted and directly provided to Vault using the `AWS_REGION` environment\nvariable.\n" }, "replicaRegions": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of regions to KMS key ARN values for replica region encryption. KMS key values are optional." }, "roleArn": { "type": "string", "description": "Specifies a role to assume when connecting to AWS. When assuming a role, \nVault uses temporary STS credentials to authenticate. An initial session with the proper trust relationship must\nexist for Vault to be able to assume this role. The role can be in a different account.\nThe value is mutable as long as the new role targets the same AWS account ID. If not, the BE will return an error.\nIt is possible to provide both an access key pair and a role to assume.\n" }, "secretAccessKey": { "type": "string", "description": "Secret access key to authenticate against the AWS secrets manager.\nCan be omitted and directly provided to Vault using the `AWS_SECRET_ACCESS_KEY` environment\nvariable.\n", "secret": true }, "secretNameTemplate": { "type": "string", "description": "Template describing how to generate external secret names.\nSupports a subset of the Go Template syntax.\n" }, "type": { "type": "string", "description": "The type of the secrets destination (`aws-sm`).\n" } }, "required": [ "identityTokenTtl", "name", "secretNameTemplate", "type" ], "inputProperties": { "accessKeyId": { "type": "string", "description": "Access key id to authenticate against the AWS secrets manager.\nCan be omitted and directly provided to Vault using the `AWS_ACCESS_KEY_ID` environment\nvariable.\n" }, "allowedIpv4Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv4 addresses for outbound connections from Vault to AWS Secrets Manager.\nCan also be set via an IP address range using CIDR notation. For example: `[\"192.168.1.0/24\", \"10.0.0.0/8\"]`.\n**Requires Vault 1.19.0+**.\n" }, "allowedIpv6Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv6 addresses for outbound connections from Vault to AWS Secrets Manager.\nCan also be set via an IP address range using CIDR notation. For example: `[\"2001:db8::/32\"]`.\n**Requires Vault 1.19.0+**.\n" }, "allowedPorts": { "type": "array", "items": { "type": "integer" }, "description": "Allowed ports for outbound connections from Vault to AWS Secrets Manager.\nFor example: `[443, 8200]`.\n**Requires Vault 1.19.0+**.\n" }, "customTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom tags to set on the secret managed at the destination.\n" }, "disableStrictNetworking": { "type": "boolean", "description": "Disable strict networking mode. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, Vault will not enforce\nallowed IP addresses and ports. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n**Requires Vault 1.19.0+**.\n" }, "externalId": { "type": "string", "description": "Optional extra protection that must match the trust policy granting access to the\nAWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.\nThe field is mutable with no special condition, but users must be careful that the new value fits with the trust\nrelationship condition they set on AWS otherwise sync operations will start to fail due to client-side access\ndenied errors. Ignored if the \u003cspan pulumi-lang-nodejs=\"`roleArn`\" pulumi-lang-dotnet=\"`RoleArn`\" pulumi-lang-go=\"`roleArn`\" pulumi-lang-python=\"`role_arn`\" pulumi-lang-yaml=\"`roleArn`\" pulumi-lang-java=\"`roleArn`\" pulumi-lang-hcl=\"`role_arn`\"\u003e`roleArn`\u003c/span\u003e field is empty.\n" }, "granularity": { "type": "string", "description": "Determines what level of information is synced as a distinct resource \nat the destination. Supports `secret-path` and `secret-key`.\n" }, "identityTokenAudienceWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe audience claim value for identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenAudienceWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenAudienceWo \" pulumi-lang-dotnet=\" IdentityTokenAudienceWo \" pulumi-lang-go=\" identityTokenAudienceWo \" pulumi-lang-python=\" identity_token_audience_wo \" pulumi-lang-yaml=\" identityTokenAudienceWo \" pulumi-lang-java=\" identityTokenAudienceWo \" pulumi-lang-hcl=\" identity_token_audience_wo \"\u003e identityTokenAudienceWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe key to use for signing identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenKeyWo \" pulumi-lang-dotnet=\" IdentityTokenKeyWo \" pulumi-lang-go=\" identityTokenKeyWo \" pulumi-lang-python=\" identity_token_key_wo \" pulumi-lang-yaml=\" identityTokenKeyWo \" pulumi-lang-java=\" identityTokenKeyWo \" pulumi-lang-hcl=\" identity_token_key_wo \"\u003e identityTokenKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens." }, "kmsKeyId": { "type": "string", "description": "Specifies the ARN of the AWS KMS key to be used to encrypt the secret." }, "name": { "type": "string", "description": "Unique name of the AWS destination.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n", "willReplaceOnChanges": true }, "region": { "type": "string", "description": "Region where to manage the secrets manager entries.\nCan be omitted and directly provided to Vault using the `AWS_REGION` environment\nvariable.\n", "willReplaceOnChanges": true }, "replicaRegions": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of regions to KMS key ARN values for replica region encryption. KMS key values are optional." }, "roleArn": { "type": "string", "description": "Specifies a role to assume when connecting to AWS. When assuming a role, \nVault uses temporary STS credentials to authenticate. An initial session with the proper trust relationship must\nexist for Vault to be able to assume this role. The role can be in a different account.\nThe value is mutable as long as the new role targets the same AWS account ID. If not, the BE will return an error.\nIt is possible to provide both an access key pair and a role to assume.\n" }, "secretAccessKey": { "type": "string", "description": "Secret access key to authenticate against the AWS secrets manager.\nCan be omitted and directly provided to Vault using the `AWS_SECRET_ACCESS_KEY` environment\nvariable.\n", "secret": true }, "secretNameTemplate": { "type": "string", "description": "Template describing how to generate external secret names.\nSupports a subset of the Go Template syntax.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering SyncAwsDestination resources.\n", "properties": { "accessKeyId": { "type": "string", "description": "Access key id to authenticate against the AWS secrets manager.\nCan be omitted and directly provided to Vault using the `AWS_ACCESS_KEY_ID` environment\nvariable.\n" }, "allowedIpv4Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv4 addresses for outbound connections from Vault to AWS Secrets Manager.\nCan also be set via an IP address range using CIDR notation. For example: `[\"192.168.1.0/24\", \"10.0.0.0/8\"]`.\n**Requires Vault 1.19.0+**.\n" }, "allowedIpv6Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv6 addresses for outbound connections from Vault to AWS Secrets Manager.\nCan also be set via an IP address range using CIDR notation. For example: `[\"2001:db8::/32\"]`.\n**Requires Vault 1.19.0+**.\n" }, "allowedPorts": { "type": "array", "items": { "type": "integer" }, "description": "Allowed ports for outbound connections from Vault to AWS Secrets Manager.\nFor example: `[443, 8200]`.\n**Requires Vault 1.19.0+**.\n" }, "customTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom tags to set on the secret managed at the destination.\n" }, "disableStrictNetworking": { "type": "boolean", "description": "Disable strict networking mode. When set to \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\" pulumi-lang-hcl=\"`true`\"\u003e`true`\u003c/span\u003e, Vault will not enforce\nallowed IP addresses and ports. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n**Requires Vault 1.19.0+**.\n" }, "externalId": { "type": "string", "description": "Optional extra protection that must match the trust policy granting access to the\nAWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.\nThe field is mutable with no special condition, but users must be careful that the new value fits with the trust\nrelationship condition they set on AWS otherwise sync operations will start to fail due to client-side access\ndenied errors. Ignored if the \u003cspan pulumi-lang-nodejs=\"`roleArn`\" pulumi-lang-dotnet=\"`RoleArn`\" pulumi-lang-go=\"`roleArn`\" pulumi-lang-python=\"`role_arn`\" pulumi-lang-yaml=\"`roleArn`\" pulumi-lang-java=\"`roleArn`\" pulumi-lang-hcl=\"`role_arn`\"\u003e`roleArn`\u003c/span\u003e field is empty.\n" }, "granularity": { "type": "string", "description": "Determines what level of information is synced as a distinct resource \nat the destination. Supports `secret-path` and `secret-key`.\n" }, "identityTokenAudienceWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe audience claim value for identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenAudienceWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenAudienceWo \" pulumi-lang-dotnet=\" IdentityTokenAudienceWo \" pulumi-lang-go=\" identityTokenAudienceWo \" pulumi-lang-python=\" identity_token_audience_wo \" pulumi-lang-yaml=\" identityTokenAudienceWo \" pulumi-lang-java=\" identityTokenAudienceWo \" pulumi-lang-hcl=\" identity_token_audience_wo \"\u003e identityTokenAudienceWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe key to use for signing identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenKeyWo \" pulumi-lang-dotnet=\" IdentityTokenKeyWo \" pulumi-lang-go=\" identityTokenKeyWo \" pulumi-lang-python=\" identity_token_key_wo \" pulumi-lang-yaml=\" identityTokenKeyWo \" pulumi-lang-java=\" identityTokenKeyWo \" pulumi-lang-hcl=\" identity_token_key_wo \"\u003e identityTokenKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens." }, "kmsKeyId": { "type": "string", "description": "Specifies the ARN of the AWS KMS key to be used to encrypt the secret." }, "name": { "type": "string", "description": "Unique name of the AWS destination.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n", "willReplaceOnChanges": true }, "region": { "type": "string", "description": "Region where to manage the secrets manager entries.\nCan be omitted and directly provided to Vault using the `AWS_REGION` environment\nvariable.\n", "willReplaceOnChanges": true }, "replicaRegions": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of regions to KMS key ARN values for replica region encryption. KMS key values are optional." }, "roleArn": { "type": "string", "description": "Specifies a role to assume when connecting to AWS. When assuming a role, \nVault uses temporary STS credentials to authenticate. An initial session with the proper trust relationship must\nexist for Vault to be able to assume this role. The role can be in a different account.\nThe value is mutable as long as the new role targets the same AWS account ID. If not, the BE will return an error.\nIt is possible to provide both an access key pair and a role to assume.\n" }, "secretAccessKey": { "type": "string", "description": "Secret access key to authenticate against the AWS secrets manager.\nCan be omitted and directly provided to Vault using the `AWS_SECRET_ACCESS_KEY` environment\nvariable.\n", "secret": true }, "secretNameTemplate": { "type": "string", "description": "Template describing how to generate external secret names.\nSupports a subset of the Go Template syntax.\n" }, "type": { "type": "string", "description": "The type of the secrets destination (`aws-sm`).\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:secrets/syncAzureDestination:SyncAzureDestination": { "description": "Creates a Azure Key Vault destination to synchronize secrets in Vault. Requires Vault 1.16+.\n*Available only for Vault Enterprise*.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\nFor more information on syncing secrets with Azure Key Vault, please refer to the Vault\n[documentation](https://developer.hashicorp.com/vault/docs/sync/azurekv).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst az = new vault.secrets.SyncAzureDestination(\"az\", {\n name: \"az-dest\",\n keyVaultUri: keyVaultUri,\n clientId: clientId,\n clientSecret: clientSecret,\n tenantId: tenantId,\n secretNameTemplate: \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n customTags: {\n foo: \"bar\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naz = vault.secrets.SyncAzureDestination(\"az\",\n name=\"az-dest\",\n key_vault_uri=key_vault_uri,\n client_id=client_id,\n client_secret=client_secret,\n tenant_id=tenant_id,\n secret_name_template=\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n custom_tags={\n \"foo\": \"bar\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var az = new Vault.Secrets.SyncAzureDestination(\"az\", new()\n {\n Name = \"az-dest\",\n KeyVaultUri = keyVaultUri,\n ClientId = clientId,\n ClientSecret = clientSecret,\n TenantId = tenantId,\n SecretNameTemplate = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n CustomTags = \n {\n { \"foo\", \"bar\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncAzureDestination(ctx, \"az\", \u0026secrets.SyncAzureDestinationArgs{\n\t\t\tName: pulumi.String(\"az-dest\"),\n\t\t\tKeyVaultUri: pulumi.Any(keyVaultUri),\n\t\t\tClientId: pulumi.Any(clientId),\n\t\t\tClientSecret: pulumi.Any(clientSecret),\n\t\t\tTenantId: pulumi.Any(tenantId),\n\t\t\tSecretNameTemplate: pulumi.String(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"),\n\t\t\tCustomTags: pulumi.StringMap{\n\t\t\t\t\"foo\": pulumi.String(\"bar\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncazuredestination\" \"az\" {\n name = \"az-dest\"\n key_vault_uri = keyVaultUri\n client_id = clientId\n client_secret = clientSecret\n tenant_id = tenantId\n secret_name_template = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"\n custom_tags = {\n \"foo\" = \"bar\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncAzureDestination;\nimport com.pulumi.vault.secrets.SyncAzureDestinationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var az = new SyncAzureDestination(\"az\", SyncAzureDestinationArgs.builder()\n .name(\"az-dest\")\n .keyVaultUri(keyVaultUri)\n .clientId(clientId)\n .clientSecret(clientSecret)\n .tenantId(tenantId)\n .secretNameTemplate(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\")\n .customTags(Map.of(\"foo\", \"bar\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n az:\n type: vault:secrets:SyncAzureDestination\n properties:\n name: az-dest\n keyVaultUri: ${keyVaultUri}\n clientId: ${clientId}\n clientSecret: ${clientSecret}\n tenantId: ${tenantId}\n secretNameTemplate: vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\n customTags:\n foo: bar\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Networking Configuration (Vault 1.19+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst azNetworking = new vault.secrets.SyncAzureDestination(\"az_networking\", {\n name: \"az-dest-networking\",\n keyVaultUri: keyVaultUri,\n clientId: clientId,\n clientSecret: clientSecret,\n tenantId: tenantId,\n allowedIpv4Addresses: [\n \"10.0.0.0/8\",\n \"192.168.0.0/16\",\n ],\n allowedIpv6Addresses: [\"2001:db8::/32\"],\n allowedPorts: [\n 443,\n 8443,\n ],\n disableStrictNetworking: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naz_networking = vault.secrets.SyncAzureDestination(\"az_networking\",\n name=\"az-dest-networking\",\n key_vault_uri=key_vault_uri,\n client_id=client_id,\n client_secret=client_secret,\n tenant_id=tenant_id,\n allowed_ipv4_addresses=[\n \"10.0.0.0/8\",\n \"192.168.0.0/16\",\n ],\n allowed_ipv6_addresses=[\"2001:db8::/32\"],\n allowed_ports=[\n 443,\n 8443,\n ],\n disable_strict_networking=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var azNetworking = new Vault.Secrets.SyncAzureDestination(\"az_networking\", new()\n {\n Name = \"az-dest-networking\",\n KeyVaultUri = keyVaultUri,\n ClientId = clientId,\n ClientSecret = clientSecret,\n TenantId = tenantId,\n AllowedIpv4Addresses = new[]\n {\n \"10.0.0.0/8\",\n \"192.168.0.0/16\",\n },\n AllowedIpv6Addresses = new[]\n {\n \"2001:db8::/32\",\n },\n AllowedPorts = new[]\n {\n 443,\n 8443,\n },\n DisableStrictNetworking = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncAzureDestination(ctx, \"az_networking\", \u0026secrets.SyncAzureDestinationArgs{\n\t\t\tName: pulumi.String(\"az-dest-networking\"),\n\t\t\tKeyVaultUri: pulumi.Any(keyVaultUri),\n\t\t\tClientId: pulumi.Any(clientId),\n\t\t\tClientSecret: pulumi.Any(clientSecret),\n\t\t\tTenantId: pulumi.Any(tenantId),\n\t\t\tAllowedIpv4Addresses: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"10.0.0.0/8\"),\n\t\t\t\tpulumi.String(\"192.168.0.0/16\"),\n\t\t\t},\n\t\t\tAllowedIpv6Addresses: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"2001:db8::/32\"),\n\t\t\t},\n\t\t\tAllowedPorts: pulumi.IntArray{\n\t\t\t\tpulumi.Int(443),\n\t\t\t\tpulumi.Int(8443),\n\t\t\t},\n\t\t\tDisableStrictNetworking: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncazuredestination\" \"az_networking\" {\n name = \"az-dest-networking\"\n key_vault_uri = keyVaultUri\n client_id = clientId\n client_secret = clientSecret\n tenant_id = tenantId\n allowed_ipv4_addresses = [\"10.0.0.0/8\", \"192.168.0.0/16\"]\n allowed_ipv6_addresses = [\"2001:db8::/32\"]\n allowed_ports = [443, 8443]\n disable_strict_networking = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncAzureDestination;\nimport com.pulumi.vault.secrets.SyncAzureDestinationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var azNetworking = new SyncAzureDestination(\"azNetworking\", SyncAzureDestinationArgs.builder()\n .name(\"az-dest-networking\")\n .keyVaultUri(keyVaultUri)\n .clientId(clientId)\n .clientSecret(clientSecret)\n .tenantId(tenantId)\n .allowedIpv4Addresses( \n \"10.0.0.0/8\",\n \"192.168.0.0/16\")\n .allowedIpv6Addresses(\"2001:db8::/32\")\n .allowedPorts( \n 443,\n 8443)\n .disableStrictNetworking(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n azNetworking:\n type: vault:secrets:SyncAzureDestination\n name: az_networking\n properties:\n name: az-dest-networking\n keyVaultUri: ${keyVaultUri}\n clientId: ${clientId}\n clientSecret: ${clientSecret}\n tenantId: ${tenantId}\n allowedIpv4Addresses:\n - 10.0.0.0/8\n - 192.168.0.0/16\n allowedIpv6Addresses:\n - 2001:db8::/32\n allowedPorts:\n - 443\n - 8443\n disableStrictNetworking: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Workload Identity Federation (Vault 2.0.0+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst azWif = new vault.secrets.SyncAzureDestination(\"az_wif\", {\n name: \"az-dest-wif\",\n keyVaultUri: keyVaultUri,\n clientId: clientId,\n tenantId: tenantId,\n identityTokenAudience: identityTokenAudience,\n identityTokenTtl: 3600,\n identityTokenKey: \"my-key\",\n granularity: \"secret-path\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\naz_wif = vault.secrets.SyncAzureDestination(\"az_wif\",\n name=\"az-dest-wif\",\n key_vault_uri=key_vault_uri,\n client_id=client_id,\n tenant_id=tenant_id,\n identity_token_audience=identity_token_audience,\n identity_token_ttl=3600,\n identity_token_key=\"my-key\",\n granularity=\"secret-path\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var azWif = new Vault.Secrets.SyncAzureDestination(\"az_wif\", new()\n {\n Name = \"az-dest-wif\",\n KeyVaultUri = keyVaultUri,\n ClientId = clientId,\n TenantId = tenantId,\n IdentityTokenAudience = identityTokenAudience,\n IdentityTokenTtl = 3600,\n IdentityTokenKey = \"my-key\",\n Granularity = \"secret-path\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncAzureDestination(ctx, \"az_wif\", \u0026secrets.SyncAzureDestinationArgs{\n\t\t\tName: pulumi.String(\"az-dest-wif\"),\n\t\t\tKeyVaultUri: pulumi.Any(keyVaultUri),\n\t\t\tClientId: pulumi.Any(clientId),\n\t\t\tTenantId: pulumi.Any(tenantId),\n\t\t\tIdentityTokenAudience: identityTokenAudience,\n\t\t\tIdentityTokenTtl: pulumi.Int(3600),\n\t\t\tIdentityTokenKey: \"my-key\",\n\t\t\tGranularity: pulumi.String(\"secret-path\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncazuredestination\" \"az_wif\" {\n name = \"az-dest-wif\"\n key_vault_uri = keyVaultUri\n client_id = clientId\n tenant_id = tenantId\n identity_token_audience = identityTokenAudience\n identity_token_ttl = 3600\n identity_token_key = \"my-key\"\n granularity = \"secret-path\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncAzureDestination;\nimport com.pulumi.vault.secrets.SyncAzureDestinationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var azWif = new SyncAzureDestination(\"azWif\", SyncAzureDestinationArgs.builder()\n .name(\"az-dest-wif\")\n .keyVaultUri(keyVaultUri)\n .clientId(clientId)\n .tenantId(tenantId)\n .identityTokenAudience(identityTokenAudience)\n .identityTokenTtl(3600)\n .identityTokenKey(\"my-key\")\n .granularity(\"secret-path\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n azWif:\n type: vault:secrets:SyncAzureDestination\n name: az_wif\n properties:\n name: az-dest-wif\n keyVaultUri: ${keyVaultUri}\n clientId: ${clientId}\n tenantId: ${tenantId}\n identityTokenAudience: ${identityTokenAudience}\n identityTokenTtl: 3600\n identityTokenKey: my-key\n granularity: secret-path\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nAzure Secrets sync destinations can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:secrets/syncAzureDestination:SyncAzureDestination az az-dest\n```\n\n", "properties": { "allowedIpv4Addresses": { "type": "array", "items": { "type": "string" }, "description": "Set of allowed IPv4 addresses in CIDR notation (e.g., 192.168.1.1/32) for outbound connections from Vault to the destination. If not set, all IPv4 addresses are allowed. Requires Vault 1.19+." }, "allowedIpv6Addresses": { "type": "array", "items": { "type": "string" }, "description": "Set of allowed IPv6 addresses in CIDR notation (e.g., 2001:db8::1/128) for outbound connections from Vault to the destination. If not set, all IPv6 addresses are allowed. Requires Vault 1.19+." }, "allowedPorts": { "type": "array", "items": { "type": "integer" }, "description": "Set of allowed ports for outbound connections from Vault to the destination. If not set, all ports are allowed. Requires Vault 1.19+." }, "clientId": { "type": "string", "description": "Client ID of an Azure app registration.\nCan be omitted and directly provided to Vault using the `AZURE_CLIENT_ID` environment\nvariable.\n" }, "clientSecret": { "type": "string", "description": "Client Secret of an Azure app registration.\nCan be omitted and directly provided to Vault using the `AZURE_CLIENT_SECRET` environment\nvariable.\n", "secret": true }, "cloud": { "type": "string", "description": "Specifies a cloud for the client. The default is Azure Public Cloud.\n" }, "customTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom tags to set on the secret managed at the destination.\n" }, "disableStrictNetworking": { "type": "boolean", "description": "If set to true, disables strict networking enforcement for this destination. When disabled, Vault will not enforce allowed IP addresses and ports. Requires Vault 1.19+." }, "granularity": { "type": "string", "description": "Determines what level of information is synced as a distinct resource\nat the destination. Supports `secret-path` and `secret-key`.\n" }, "identityTokenAudienceWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe audience claim value for identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenAudienceWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenAudienceWo \" pulumi-lang-dotnet=\" IdentityTokenAudienceWo \" pulumi-lang-go=\" identityTokenAudienceWo \" pulumi-lang-python=\" identity_token_audience_wo \" pulumi-lang-yaml=\" identityTokenAudienceWo \" pulumi-lang-java=\" identityTokenAudienceWo \" pulumi-lang-hcl=\" identity_token_audience_wo \"\u003e identityTokenAudienceWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe key to use for signing identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenKeyWo \" pulumi-lang-dotnet=\" IdentityTokenKeyWo \" pulumi-lang-go=\" identityTokenKeyWo \" pulumi-lang-python=\" identity_token_key_wo \" pulumi-lang-yaml=\" identityTokenKeyWo \" pulumi-lang-java=\" identityTokenKeyWo \" pulumi-lang-hcl=\" identity_token_key_wo \"\u003e identityTokenKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens." }, "keyVaultUri": { "type": "string", "description": "URI of an existing Azure Key Vault instance.\nCan be omitted and directly provided to Vault using the `KEY_VAULT_URI` environment\nvariable.\n" }, "name": { "type": "string", "description": "Unique name of the Azure destination.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "secretNameTemplate": { "type": "string", "description": "Template describing how to generate external secret names.\nSupports a subset of the Go Template syntax.\n" }, "tenantId": { "type": "string", "description": "ID of the target Azure tenant.\nCan be omitted and directly provided to Vault using the `AZURE_TENANT_ID` environment\nvariable.\n" }, "type": { "type": "string", "description": "The type of the secrets destination (`azure-kv`).\n" } }, "required": [ "identityTokenTtl", "name", "secretNameTemplate", "type" ], "inputProperties": { "allowedIpv4Addresses": { "type": "array", "items": { "type": "string" }, "description": "Set of allowed IPv4 addresses in CIDR notation (e.g., 192.168.1.1/32) for outbound connections from Vault to the destination. If not set, all IPv4 addresses are allowed. Requires Vault 1.19+." }, "allowedIpv6Addresses": { "type": "array", "items": { "type": "string" }, "description": "Set of allowed IPv6 addresses in CIDR notation (e.g., 2001:db8::1/128) for outbound connections from Vault to the destination. If not set, all IPv6 addresses are allowed. Requires Vault 1.19+." }, "allowedPorts": { "type": "array", "items": { "type": "integer" }, "description": "Set of allowed ports for outbound connections from Vault to the destination. If not set, all ports are allowed. Requires Vault 1.19+." }, "clientId": { "type": "string", "description": "Client ID of an Azure app registration.\nCan be omitted and directly provided to Vault using the `AZURE_CLIENT_ID` environment\nvariable.\n" }, "clientSecret": { "type": "string", "description": "Client Secret of an Azure app registration.\nCan be omitted and directly provided to Vault using the `AZURE_CLIENT_SECRET` environment\nvariable.\n", "secret": true }, "cloud": { "type": "string", "description": "Specifies a cloud for the client. The default is Azure Public Cloud.\n", "willReplaceOnChanges": true }, "customTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom tags to set on the secret managed at the destination.\n" }, "disableStrictNetworking": { "type": "boolean", "description": "If set to true, disables strict networking enforcement for this destination. When disabled, Vault will not enforce allowed IP addresses and ports. Requires Vault 1.19+." }, "granularity": { "type": "string", "description": "Determines what level of information is synced as a distinct resource\nat the destination. Supports `secret-path` and `secret-key`.\n" }, "identityTokenAudienceWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe audience claim value for identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenAudienceWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenAudienceWo \" pulumi-lang-dotnet=\" IdentityTokenAudienceWo \" pulumi-lang-go=\" identityTokenAudienceWo \" pulumi-lang-python=\" identity_token_audience_wo \" pulumi-lang-yaml=\" identityTokenAudienceWo \" pulumi-lang-java=\" identityTokenAudienceWo \" pulumi-lang-hcl=\" identity_token_audience_wo \"\u003e identityTokenAudienceWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe key to use for signing identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenKeyWo \" pulumi-lang-dotnet=\" IdentityTokenKeyWo \" pulumi-lang-go=\" identityTokenKeyWo \" pulumi-lang-python=\" identity_token_key_wo \" pulumi-lang-yaml=\" identityTokenKeyWo \" pulumi-lang-java=\" identityTokenKeyWo \" pulumi-lang-hcl=\" identity_token_key_wo \"\u003e identityTokenKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens." }, "keyVaultUri": { "type": "string", "description": "URI of an existing Azure Key Vault instance.\nCan be omitted and directly provided to Vault using the `KEY_VAULT_URI` environment\nvariable.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "Unique name of the Azure destination.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n", "willReplaceOnChanges": true }, "secretNameTemplate": { "type": "string", "description": "Template describing how to generate external secret names.\nSupports a subset of the Go Template syntax.\n" }, "tenantId": { "type": "string", "description": "ID of the target Azure tenant.\nCan be omitted and directly provided to Vault using the `AZURE_TENANT_ID` environment\nvariable.\n", "willReplaceOnChanges": true } }, "stateInputs": { "description": "Input properties used for looking up and filtering SyncAzureDestination resources.\n", "properties": { "allowedIpv4Addresses": { "type": "array", "items": { "type": "string" }, "description": "Set of allowed IPv4 addresses in CIDR notation (e.g., 192.168.1.1/32) for outbound connections from Vault to the destination. If not set, all IPv4 addresses are allowed. Requires Vault 1.19+." }, "allowedIpv6Addresses": { "type": "array", "items": { "type": "string" }, "description": "Set of allowed IPv6 addresses in CIDR notation (e.g., 2001:db8::1/128) for outbound connections from Vault to the destination. If not set, all IPv6 addresses are allowed. Requires Vault 1.19+." }, "allowedPorts": { "type": "array", "items": { "type": "integer" }, "description": "Set of allowed ports for outbound connections from Vault to the destination. If not set, all ports are allowed. Requires Vault 1.19+." }, "clientId": { "type": "string", "description": "Client ID of an Azure app registration.\nCan be omitted and directly provided to Vault using the `AZURE_CLIENT_ID` environment\nvariable.\n" }, "clientSecret": { "type": "string", "description": "Client Secret of an Azure app registration.\nCan be omitted and directly provided to Vault using the `AZURE_CLIENT_SECRET` environment\nvariable.\n", "secret": true }, "cloud": { "type": "string", "description": "Specifies a cloud for the client. The default is Azure Public Cloud.\n", "willReplaceOnChanges": true }, "customTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom tags to set on the secret managed at the destination.\n" }, "disableStrictNetworking": { "type": "boolean", "description": "If set to true, disables strict networking enforcement for this destination. When disabled, Vault will not enforce allowed IP addresses and ports. Requires Vault 1.19+." }, "granularity": { "type": "string", "description": "Determines what level of information is synced as a distinct resource\nat the destination. Supports `secret-path` and `secret-key`.\n" }, "identityTokenAudienceWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe audience claim value for identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenAudienceWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenAudienceWo \" pulumi-lang-dotnet=\" IdentityTokenAudienceWo \" pulumi-lang-go=\" identityTokenAudienceWo \" pulumi-lang-python=\" identity_token_audience_wo \" pulumi-lang-yaml=\" identityTokenAudienceWo \" pulumi-lang-java=\" identityTokenAudienceWo \" pulumi-lang-hcl=\" identity_token_audience_wo \"\u003e identityTokenAudienceWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe key to use for signing identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenKeyWo \" pulumi-lang-dotnet=\" IdentityTokenKeyWo \" pulumi-lang-go=\" identityTokenKeyWo \" pulumi-lang-python=\" identity_token_key_wo \" pulumi-lang-yaml=\" identityTokenKeyWo \" pulumi-lang-java=\" identityTokenKeyWo \" pulumi-lang-hcl=\" identity_token_key_wo \"\u003e identityTokenKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens." }, "keyVaultUri": { "type": "string", "description": "URI of an existing Azure Key Vault instance.\nCan be omitted and directly provided to Vault using the `KEY_VAULT_URI` environment\nvariable.\n", "willReplaceOnChanges": true }, "name": { "type": "string", "description": "Unique name of the Azure destination.\n", "willReplaceOnChanges": true }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n", "willReplaceOnChanges": true }, "secretNameTemplate": { "type": "string", "description": "Template describing how to generate external secret names.\nSupports a subset of the Go Template syntax.\n" }, "tenantId": { "type": "string", "description": "ID of the target Azure tenant.\nCan be omitted and directly provided to Vault using the `AZURE_TENANT_ID` environment\nvariable.\n", "willReplaceOnChanges": true }, "type": { "type": "string", "description": "The type of the secrets destination (`azure-kv`).\n", "willReplaceOnChanges": true } }, "type": "object" } }, "vault:secrets/syncConfig:SyncConfig": { "description": "Configures the secret sync global config. \nThe config is global and can only be managed in the root namespace.\n\n\u003e **Important** The config is global so the\u003cspan pulumi-lang-nodejs=\" vault.secrets.SyncConfig \" pulumi-lang-dotnet=\" vault.secrets.SyncConfig \" pulumi-lang-go=\" secrets.SyncConfig \" pulumi-lang-python=\" secrets.SyncConfig \" pulumi-lang-yaml=\" vault.secrets.SyncConfig \" pulumi-lang-java=\" vault.secrets.SyncConfig \" pulumi-lang-hcl=\" vault_secrets_sync_config \"\u003e vault.secrets.SyncConfig \u003c/span\u003eresource must not be defined\nmultiple times for the same Vault server. If multiple definition exists, the last one applied will be\neffective.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst globalConfig = new vault.secrets.SyncConfig(\"global_config\", {\n disabled: true,\n queueCapacity: 500000,\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\nglobal_config = vault.secrets.SyncConfig(\"global_config\",\n disabled=True,\n queue_capacity=500000)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var globalConfig = new Vault.Secrets.SyncConfig(\"global_config\", new()\n {\n Disabled = true,\n QueueCapacity = 500000,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncConfig(ctx, \"global_config\", \u0026secrets.SyncConfigArgs{\n\t\t\tDisabled: pulumi.Bool(true),\n\t\t\tQueueCapacity: pulumi.Int(500000),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncconfig\" \"global_config\" {\n disabled = true\n queue_capacity = 500000\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncConfig;\nimport com.pulumi.vault.secrets.SyncConfigArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var globalConfig = new SyncConfig(\"globalConfig\", SyncConfigArgs.builder()\n .disabled(true)\n .queueCapacity(500000)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n globalConfig:\n type: vault:secrets:SyncConfig\n name: global_config\n properties:\n disabled: true\n queueCapacity: 500000\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\n```sh\n$ pulumi import vault:secrets/syncConfig:SyncConfig config global_config\n```\n\n", "properties": { "disabled": { "type": "boolean", "description": "Disables the syncing process between Vault and external destinations. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThis resource can only be configured in the root namespace.\n*Available only for Vault Enterprise*.\n" }, "queueCapacity": { "type": "integer", "description": "Maximum number of pending sync operations allowed on the queue. Defaults to \u003cspan pulumi-lang-nodejs=\"`1000000`\" pulumi-lang-dotnet=\"`1000000`\" pulumi-lang-go=\"`1000000`\" pulumi-lang-python=\"`1000000`\" pulumi-lang-yaml=\"`1000000`\" pulumi-lang-java=\"`1000000`\" pulumi-lang-hcl=\"`1000000`\"\u003e`1000000`\u003c/span\u003e.\n" } }, "inputProperties": { "disabled": { "type": "boolean", "description": "Disables the syncing process between Vault and external destinations. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThis resource can only be configured in the root namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "queueCapacity": { "type": "integer", "description": "Maximum number of pending sync operations allowed on the queue. Defaults to \u003cspan pulumi-lang-nodejs=\"`1000000`\" pulumi-lang-dotnet=\"`1000000`\" pulumi-lang-go=\"`1000000`\" pulumi-lang-python=\"`1000000`\" pulumi-lang-yaml=\"`1000000`\" pulumi-lang-java=\"`1000000`\" pulumi-lang-hcl=\"`1000000`\"\u003e`1000000`\u003c/span\u003e.\n" } }, "stateInputs": { "description": "Input properties used for looking up and filtering SyncConfig resources.\n", "properties": { "disabled": { "type": "boolean", "description": "Disables the syncing process between Vault and external destinations. Defaults to \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\" pulumi-lang-hcl=\"`false`\"\u003e`false`\u003c/span\u003e.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThis resource can only be configured in the root namespace.\n*Available only for Vault Enterprise*.\n", "willReplaceOnChanges": true }, "queueCapacity": { "type": "integer", "description": "Maximum number of pending sync operations allowed on the queue. Defaults to \u003cspan pulumi-lang-nodejs=\"`1000000`\" pulumi-lang-dotnet=\"`1000000`\" pulumi-lang-go=\"`1000000`\" pulumi-lang-python=\"`1000000`\" pulumi-lang-yaml=\"`1000000`\" pulumi-lang-java=\"`1000000`\" pulumi-lang-hcl=\"`1000000`\"\u003e`1000000`\u003c/span\u003e.\n" } }, "type": "object" } }, "vault:secrets/syncGcpDestination:SyncGcpDestination": { "description": "Creates a GCP destination to synchronize secrets in Vault. Requires Vault 1.16+.\n*Available only for Vault Enterprise*.\n\n\u003e **Important** All data provided in the resource configuration will be\nwritten in cleartext to state and plan files generated by Terraform, and\nwill appear in the console output when Terraform runs. Protect these\nartifacts accordingly. See\nthe main provider documentation\nfor more details.\n\nFor more information on syncing secrets with GCP, please refer to the Vault\n[documentation](https://developer.hashicorp.com/vault/docs/sync/gcpsm).\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcp = new vault.secrets.SyncGcpDestination(\"gcp\", {\n name: \"gcp-dest\",\n projectId: \"gcp-project-id\",\n credentials: std.file({\n input: credentialsFile,\n }).then(invoke =\u003e invoke.result),\n secretNameTemplate: \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n customTags: {\n foo: \"bar\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp = vault.secrets.SyncGcpDestination(\"gcp\",\n name=\"gcp-dest\",\n project_id=\"gcp-project-id\",\n credentials=std.file(input=credentials_file).result,\n secret_name_template=\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n custom_tags={\n \"foo\": \"bar\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcp = new Vault.Secrets.SyncGcpDestination(\"gcp\", new()\n {\n Name = \"gcp-dest\",\n ProjectId = \"gcp-project-id\",\n Credentials = Std.File.Invoke(new()\n {\n Input = credentialsFile,\n }).Apply(invoke =\u003e invoke.Result),\n SecretNameTemplate = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n CustomTags = \n {\n { \"foo\", \"bar\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: credentialsFile,\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = secrets.NewSyncGcpDestination(ctx, \"gcp\", \u0026secrets.SyncGcpDestinationArgs{\n\t\t\tName: pulumi.String(\"gcp-dest\"),\n\t\t\tProjectId: pulumi.String(\"gcp-project-id\"),\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t\tSecretNameTemplate: pulumi.String(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"),\n\t\t\tCustomTags: pulumi.StringMap{\n\t\t\t\t\"foo\": pulumi.String(\"bar\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncgcpdestination\" \"gcp\" {\n name = \"gcp-dest\"\n project_id = \"gcp-project-id\"\n credentials = file(credentialsFile)\n secret_name_template = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"\n custom_tags = {\n \"foo\" = \"bar\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncGcpDestination;\nimport com.pulumi.vault.secrets.SyncGcpDestinationArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcp = new SyncGcpDestination(\"gcp\", SyncGcpDestinationArgs.builder()\n .name(\"gcp-dest\")\n .projectId(\"gcp-project-id\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(credentialsFile)\n .build()).result())\n .secretNameTemplate(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\")\n .customTags(Map.of(\"foo\", \"bar\"))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcp:\n type: vault:secrets:SyncGcpDestination\n properties:\n name: gcp-dest\n projectId: gcp-project-id\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: ${credentialsFile}\n return: result\n secretNameTemplate: vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\n customTags:\n foo: bar\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Networking Configuration (Vault 1.19+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpNetworking = new vault.secrets.SyncGcpDestination(\"gcp_networking\", {\n name: \"gcp-dest-networking\",\n projectId: \"gcp-project-id\",\n credentials: std.file({\n input: credentialsFile,\n }).then(invoke =\u003e invoke.result),\n secretNameTemplate: \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n allowedIpv4Addresses: [\n \"10.0.0.0/8\",\n \"192.168.0.0/16\",\n ],\n allowedIpv6Addresses: [\"2001:db8::/32\"],\n allowedPorts: [\n 443,\n 8443,\n ],\n disableStrictNetworking: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp_networking = vault.secrets.SyncGcpDestination(\"gcp_networking\",\n name=\"gcp-dest-networking\",\n project_id=\"gcp-project-id\",\n credentials=std.file(input=credentials_file).result,\n secret_name_template=\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n allowed_ipv4_addresses=[\n \"10.0.0.0/8\",\n \"192.168.0.0/16\",\n ],\n allowed_ipv6_addresses=[\"2001:db8::/32\"],\n allowed_ports=[\n 443,\n 8443,\n ],\n disable_strict_networking=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpNetworking = new Vault.Secrets.SyncGcpDestination(\"gcp_networking\", new()\n {\n Name = \"gcp-dest-networking\",\n ProjectId = \"gcp-project-id\",\n Credentials = Std.File.Invoke(new()\n {\n Input = credentialsFile,\n }).Apply(invoke =\u003e invoke.Result),\n SecretNameTemplate = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n AllowedIpv4Addresses = new[]\n {\n \"10.0.0.0/8\",\n \"192.168.0.0/16\",\n },\n AllowedIpv6Addresses = new[]\n {\n \"2001:db8::/32\",\n },\n AllowedPorts = new[]\n {\n 443,\n 8443,\n },\n DisableStrictNetworking = false,\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: credentialsFile,\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = secrets.NewSyncGcpDestination(ctx, \"gcp_networking\", \u0026secrets.SyncGcpDestinationArgs{\n\t\t\tName: pulumi.String(\"gcp-dest-networking\"),\n\t\t\tProjectId: pulumi.String(\"gcp-project-id\"),\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t\tSecretNameTemplate: pulumi.String(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"),\n\t\t\tAllowedIpv4Addresses: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"10.0.0.0/8\"),\n\t\t\t\tpulumi.String(\"192.168.0.0/16\"),\n\t\t\t},\n\t\t\tAllowedIpv6Addresses: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"2001:db8::/32\"),\n\t\t\t},\n\t\t\tAllowedPorts: pulumi.IntArray{\n\t\t\t\tpulumi.Int(443),\n\t\t\t\tpulumi.Int(8443),\n\t\t\t},\n\t\t\tDisableStrictNetworking: pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncgcpdestination\" \"gcp_networking\" {\n name = \"gcp-dest-networking\"\n project_id = \"gcp-project-id\"\n credentials = file(credentialsFile)\n secret_name_template = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"\n allowed_ipv4_addresses = [\"10.0.0.0/8\", \"192.168.0.0/16\"]\n allowed_ipv6_addresses = [\"2001:db8::/32\"]\n allowed_ports = [443, 8443]\n disable_strict_networking = false\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncGcpDestination;\nimport com.pulumi.vault.secrets.SyncGcpDestinationArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpNetworking = new SyncGcpDestination(\"gcpNetworking\", SyncGcpDestinationArgs.builder()\n .name(\"gcp-dest-networking\")\n .projectId(\"gcp-project-id\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(credentialsFile)\n .build()).result())\n .secretNameTemplate(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\")\n .allowedIpv4Addresses( \n \"10.0.0.0/8\",\n \"192.168.0.0/16\")\n .allowedIpv6Addresses(\"2001:db8::/32\")\n .allowedPorts( \n 443,\n 8443)\n .disableStrictNetworking(false)\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpNetworking:\n type: vault:secrets:SyncGcpDestination\n name: gcp_networking\n properties:\n name: gcp-dest-networking\n projectId: gcp-project-id\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: ${credentialsFile}\n return: result\n secretNameTemplate: vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\n allowedIpv4Addresses:\n - 10.0.0.0/8\n - 192.168.0.0/16\n allowedIpv6Addresses:\n - 2001:db8::/32\n allowedPorts:\n - 443\n - 8443\n disableStrictNetworking: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Global Encryption (Vault 1.19+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpEncryption = new vault.secrets.SyncGcpDestination(\"gcp_encryption\", {\n name: \"gcp-dest-encryption\",\n projectId: \"gcp-project-id\",\n credentials: std.file({\n input: credentialsFile,\n }).then(invoke =\u003e invoke.result),\n secretNameTemplate: \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n globalKmsKey: \"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp_encryption = vault.secrets.SyncGcpDestination(\"gcp_encryption\",\n name=\"gcp-dest-encryption\",\n project_id=\"gcp-project-id\",\n credentials=std.file(input=credentials_file).result,\n secret_name_template=\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n global_kms_key=\"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpEncryption = new Vault.Secrets.SyncGcpDestination(\"gcp_encryption\", new()\n {\n Name = \"gcp-dest-encryption\",\n ProjectId = \"gcp-project-id\",\n Credentials = Std.File.Invoke(new()\n {\n Input = credentialsFile,\n }).Apply(invoke =\u003e invoke.Result),\n SecretNameTemplate = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n GlobalKmsKey = \"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: credentialsFile,\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = secrets.NewSyncGcpDestination(ctx, \"gcp_encryption\", \u0026secrets.SyncGcpDestinationArgs{\n\t\t\tName: pulumi.String(\"gcp-dest-encryption\"),\n\t\t\tProjectId: pulumi.String(\"gcp-project-id\"),\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t\tSecretNameTemplate: pulumi.String(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"),\n\t\t\tGlobalKmsKey: pulumi.String(\"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncgcpdestination\" \"gcp_encryption\" {\n name = \"gcp-dest-encryption\"\n project_id = \"gcp-project-id\"\n credentials = file(credentialsFile)\n secret_name_template = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"\n global_kms_key = \"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncGcpDestination;\nimport com.pulumi.vault.secrets.SyncGcpDestinationArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpEncryption = new SyncGcpDestination(\"gcpEncryption\", SyncGcpDestinationArgs.builder()\n .name(\"gcp-dest-encryption\")\n .projectId(\"gcp-project-id\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(credentialsFile)\n .build()).result())\n .secretNameTemplate(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\")\n .globalKmsKey(\"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpEncryption:\n type: vault:secrets:SyncGcpDestination\n name: gcp_encryption\n properties:\n name: gcp-dest-encryption\n projectId: gcp-project-id\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: ${credentialsFile}\n return: result\n secretNameTemplate: vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\n globalKmsKey: projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Multi-Region Replication and Regional Encryption (Vault 1.19+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpReplicationEncryption = new vault.secrets.SyncGcpDestination(\"gcp_replication_encryption\", {\n name: \"gcp-dest-replication-encryption\",\n projectId: \"gcp-project-id\",\n credentials: std.file({\n input: credentialsFile,\n }).then(invoke =\u003e invoke.result),\n secretNameTemplate: \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}_{{ .SecretKey | lowercase }}\",\n granularity: \"secret-key\",\n locationalKmsKeys: {\n \"us-central1\": \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\",\n \"us-east1\": \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\",\n },\n replicationLocations: [\n \"us-central1\",\n \"us-east1\",\n ],\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp_replication_encryption = vault.secrets.SyncGcpDestination(\"gcp_replication_encryption\",\n name=\"gcp-dest-replication-encryption\",\n project_id=\"gcp-project-id\",\n credentials=std.file(input=credentials_file).result,\n secret_name_template=\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}_{{ .SecretKey | lowercase }}\",\n granularity=\"secret-key\",\n locational_kms_keys={\n \"us-central1\": \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\",\n \"us-east1\": \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\",\n },\n replication_locations=[\n \"us-central1\",\n \"us-east1\",\n ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpReplicationEncryption = new Vault.Secrets.SyncGcpDestination(\"gcp_replication_encryption\", new()\n {\n Name = \"gcp-dest-replication-encryption\",\n ProjectId = \"gcp-project-id\",\n Credentials = Std.File.Invoke(new()\n {\n Input = credentialsFile,\n }).Apply(invoke =\u003e invoke.Result),\n SecretNameTemplate = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}_{{ .SecretKey | lowercase }}\",\n Granularity = \"secret-key\",\n LocationalKmsKeys = \n {\n { \"us-central1\", \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\" },\n { \"us-east1\", \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\" },\n },\n ReplicationLocations = new[]\n {\n \"us-central1\",\n \"us-east1\",\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: credentialsFile,\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = secrets.NewSyncGcpDestination(ctx, \"gcp_replication_encryption\", \u0026secrets.SyncGcpDestinationArgs{\n\t\t\tName: pulumi.String(\"gcp-dest-replication-encryption\"),\n\t\t\tProjectId: pulumi.String(\"gcp-project-id\"),\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t\tSecretNameTemplate: pulumi.String(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}_{{ .SecretKey | lowercase }}\"),\n\t\t\tGranularity: pulumi.String(\"secret-key\"),\n\t\t\tLocationalKmsKeys: pulumi.StringMap{\n\t\t\t\t\"us-central1\": pulumi.String(\"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\"),\n\t\t\t\t\"us-east1\": pulumi.String(\"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\"),\n\t\t\t},\n\t\t\tReplicationLocations: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"us-central1\"),\n\t\t\t\tpulumi.String(\"us-east1\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncgcpdestination\" \"gcp_replication_encryption\" {\n name = \"gcp-dest-replication-encryption\"\n project_id = \"gcp-project-id\"\n credentials = file(credentialsFile)\n secret_name_template = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}_{{ .SecretKey | lowercase }}\"\n granularity = \"secret-key\"\n locational_kms_keys = {\n \"us-central1\" = \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\"\n \"us-east1\" = \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\"\n }\n replication_locations = [\"us-central1\", \"us-east1\"]\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncGcpDestination;\nimport com.pulumi.vault.secrets.SyncGcpDestinationArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpReplicationEncryption = new SyncGcpDestination(\"gcpReplicationEncryption\", SyncGcpDestinationArgs.builder()\n .name(\"gcp-dest-replication-encryption\")\n .projectId(\"gcp-project-id\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(credentialsFile)\n .build()).result())\n .secretNameTemplate(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}_{{ .SecretKey | lowercase }}\")\n .granularity(\"secret-key\")\n .locationalKmsKeys(Map.ofEntries(\n Map.entry(\"us-central1\", \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\"),\n Map.entry(\"us-east1\", \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\")\n ))\n .replicationLocations( \n \"us-central1\",\n \"us-east1\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpReplicationEncryption:\n type: vault:secrets:SyncGcpDestination\n name: gcp_replication_encryption\n properties:\n name: gcp-dest-replication-encryption\n projectId: gcp-project-id\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: ${credentialsFile}\n return: result\n secretNameTemplate: vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}_{{ .SecretKey | lowercase }}\n granularity: secret-key\n locationalKmsKeys:\n us-central1: projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\n us-east1: projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\n replicationLocations:\n - us-central1\n - us-east1\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With KMS Key ID (Vault 2.2.0+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpKmsKeyId = new vault.secrets.SyncGcpDestination(\"gcp_kms_key_id\", {\n name: \"gcp-dest-kms-key-id\",\n projectId: \"gcp-project-id\",\n credentials: std.file({\n input: credentialsFile,\n }).then(invoke =\u003e invoke.result),\n secretNameTemplate: \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n kmsKeyId: \"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\",\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp_kms_key_id = vault.secrets.SyncGcpDestination(\"gcp_kms_key_id\",\n name=\"gcp-dest-kms-key-id\",\n project_id=\"gcp-project-id\",\n credentials=std.file(input=credentials_file).result,\n secret_name_template=\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n kms_key_id=\"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpKmsKeyId = new Vault.Secrets.SyncGcpDestination(\"gcp_kms_key_id\", new()\n {\n Name = \"gcp-dest-kms-key-id\",\n ProjectId = \"gcp-project-id\",\n Credentials = Std.File.Invoke(new()\n {\n Input = credentialsFile,\n }).Apply(invoke =\u003e invoke.Result),\n SecretNameTemplate = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n KmsKeyId = \"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: credentialsFile,\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = secrets.NewSyncGcpDestination(ctx, \"gcp_kms_key_id\", \u0026secrets.SyncGcpDestinationArgs{\n\t\t\tName: pulumi.String(\"gcp-dest-kms-key-id\"),\n\t\t\tProjectId: pulumi.String(\"gcp-project-id\"),\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t\tSecretNameTemplate: pulumi.String(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"),\n\t\t\tKmsKeyId: pulumi.String(\"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncgcpdestination\" \"gcp_kms_key_id\" {\n name = \"gcp-dest-kms-key-id\"\n project_id = \"gcp-project-id\"\n credentials = file(credentialsFile)\n secret_name_template = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"\n kms_key_id = \"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncGcpDestination;\nimport com.pulumi.vault.secrets.SyncGcpDestinationArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpKmsKeyId = new SyncGcpDestination(\"gcpKmsKeyId\", SyncGcpDestinationArgs.builder()\n .name(\"gcp-dest-kms-key-id\")\n .projectId(\"gcp-project-id\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(credentialsFile)\n .build()).result())\n .secretNameTemplate(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\")\n .kmsKeyId(\"projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpKmsKeyId:\n type: vault:secrets:SyncGcpDestination\n name: gcp_kms_key_id\n properties:\n name: gcp-dest-kms-key-id\n projectId: gcp-project-id\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: ${credentialsFile}\n return: result\n secretNameTemplate: vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\n kmsKeyId: projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### With Replica Regions (Vault 2.2.0+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as std from \"@pulumi/std\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpReplicaRegions = new vault.secrets.SyncGcpDestination(\"gcp_replica_regions\", {\n name: \"gcp-dest-replica-regions\",\n projectId: \"gcp-project-id\",\n credentials: std.file({\n input: credentialsFile,\n }).then(invoke =\u003e invoke.result),\n secretNameTemplate: \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n replicaRegions: {\n \"us-central1\": \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\",\n \"us-east1\": \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\",\n },\n});\n```\n```python\nimport pulumi\nimport pulumi_std as std\nimport pulumi_vault as vault\n\ngcp_replica_regions = vault.secrets.SyncGcpDestination(\"gcp_replica_regions\",\n name=\"gcp-dest-replica-regions\",\n project_id=\"gcp-project-id\",\n credentials=std.file(input=credentials_file).result,\n secret_name_template=\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n replica_regions={\n \"us-central1\": \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\",\n \"us-east1\": \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\",\n })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Std = Pulumi.Std;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpReplicaRegions = new Vault.Secrets.SyncGcpDestination(\"gcp_replica_regions\", new()\n {\n Name = \"gcp-dest-replica-regions\",\n ProjectId = \"gcp-project-id\",\n Credentials = Std.File.Invoke(new()\n {\n Input = credentialsFile,\n }).Apply(invoke =\u003e invoke.Result),\n SecretNameTemplate = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\",\n ReplicaRegions = \n {\n { \"us-central1\", \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\" },\n { \"us-east1\", \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\" },\n },\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-std/sdk/go/std\"\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tinvokeFile, err := std.File(ctx, \u0026std.FileArgs{\n\t\t\tInput: credentialsFile,\n\t\t}, nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = secrets.NewSyncGcpDestination(ctx, \"gcp_replica_regions\", \u0026secrets.SyncGcpDestinationArgs{\n\t\t\tName: pulumi.String(\"gcp-dest-replica-regions\"),\n\t\t\tProjectId: pulumi.String(\"gcp-project-id\"),\n\t\t\tCredentials: pulumi.String(invokeFile.Result),\n\t\t\tSecretNameTemplate: pulumi.String(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"),\n\t\t\tReplicaRegions: pulumi.StringMap{\n\t\t\t\t\"us-central1\": pulumi.String(\"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\"),\n\t\t\t\t\"us-east1\": pulumi.String(\"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n std = {\n source = \"pulumi/std\"\n }\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncgcpdestination\" \"gcp_replica_regions\" {\n name = \"gcp-dest-replica-regions\"\n project_id = \"gcp-project-id\"\n credentials = file(credentialsFile)\n secret_name_template = \"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\"\n replica_regions = {\n \"us-central1\" = \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\"\n \"us-east1\" = \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\"\n }\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncGcpDestination;\nimport com.pulumi.vault.secrets.SyncGcpDestinationArgs;\nimport com.pulumi.std.StdFunctions;\nimport com.pulumi.std.inputs.FileArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpReplicaRegions = new SyncGcpDestination(\"gcpReplicaRegions\", SyncGcpDestinationArgs.builder()\n .name(\"gcp-dest-replica-regions\")\n .projectId(\"gcp-project-id\")\n .credentials(StdFunctions.file(FileArgs.builder()\n .input(credentialsFile)\n .build()).result())\n .secretNameTemplate(\"vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\")\n .replicaRegions(Map.ofEntries(\n Map.entry(\"us-central1\", \"projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\"),\n Map.entry(\"us-east1\", \"projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\")\n ))\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpReplicaRegions:\n type: vault:secrets:SyncGcpDestination\n name: gcp_replica_regions\n properties:\n name: gcp-dest-replica-regions\n projectId: gcp-project-id\n credentials:\n fn::invoke:\n function: std:file\n arguments:\n input: ${credentialsFile}\n return: result\n secretNameTemplate: vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}\n replicaRegions:\n us-central1: projects/my-project/locations/us-central1/keyRings/kr/cryptoKeys/key\n us-east1: projects/my-project/locations/us-east1/keyRings/kr/cryptoKeys/key\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n### Using Workload Identity Federation (Vault 2.0.0+)\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as vault from \"@pulumi/vault\";\n\nconst gcpWif = new vault.secrets.SyncGcpDestination(\"gcp_wif\", {\n name: \"gcp-dest-wif\",\n serviceAccountEmail: serviceAccountEmail,\n identityTokenAudienceWo: identityTokenAudience,\n identityTokenAudienceWoVersion: 1,\n identityTokenTtl: 3600,\n identityTokenKeyWo: \"my-key\",\n identityTokenKeyWoVersion: 1,\n granularity: \"secret-path\",\n});\n```\n```python\nimport pulumi\nimport pulumi_vault as vault\n\ngcp_wif = vault.secrets.SyncGcpDestination(\"gcp_wif\",\n name=\"gcp-dest-wif\",\n service_account_email=service_account_email,\n identity_token_audience_wo=identity_token_audience,\n identity_token_audience_wo_version=1,\n identity_token_ttl=3600,\n identity_token_key_wo=\"my-key\",\n identity_token_key_wo_version=1,\n granularity=\"secret-path\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Vault = Pulumi.Vault;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n var gcpWif = new Vault.Secrets.SyncGcpDestination(\"gcp_wif\", new()\n {\n Name = \"gcp-dest-wif\",\n ServiceAccountEmail = serviceAccountEmail,\n IdentityTokenAudienceWo = identityTokenAudience,\n IdentityTokenAudienceWoVersion = 1,\n IdentityTokenTtl = 3600,\n IdentityTokenKeyWo = \"my-key\",\n IdentityTokenKeyWoVersion = 1,\n Granularity = \"secret-path\",\n });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/secrets\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := secrets.NewSyncGcpDestination(ctx, \"gcp_wif\", \u0026secrets.SyncGcpDestinationArgs{\n\t\t\tName: pulumi.String(\"gcp-dest-wif\"),\n\t\t\tServiceAccountEmail: pulumi.Any(serviceAccountEmail),\n\t\t\tIdentityTokenAudienceWo: pulumi.Any(identityTokenAudience),\n\t\t\tIdentityTokenAudienceWoVersion: pulumi.Int(1),\n\t\t\tIdentityTokenTtl: pulumi.Int(3600),\n\t\t\tIdentityTokenKeyWo: pulumi.String(\"my-key\"),\n\t\t\tIdentityTokenKeyWoVersion: pulumi.Int(1),\n\t\t\tGranularity: pulumi.String(\"secret-path\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```hcl\npulumi {\n required_providers {\n vault = {\n source = \"pulumi/vault\"\n }\n }\n}\n\nresource \"vault_secrets_syncgcpdestination\" \"gcp_wif\" {\n name = \"gcp-dest-wif\"\n service_account_email = serviceAccountEmail\n identity_token_audience_wo = identityTokenAudience\n identity_token_audience_wo_version = 1\n identity_token_ttl = 3600\n identity_token_key_wo = \"my-key\"\n identity_token_key_wo_version = 1\n granularity = \"secret-path\"\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.vault.secrets.SyncGcpDestination;\nimport com.pulumi.vault.secrets.SyncGcpDestinationArgs;\nimport java.util.ArrayList;\nimport java.util.Arrays;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n public static void main(String[] args) {\n Pulumi.run(App::stack);\n }\n\n public static void stack(Context ctx) {\n var gcpWif = new SyncGcpDestination(\"gcpWif\", SyncGcpDestinationArgs.builder()\n .name(\"gcp-dest-wif\")\n .serviceAccountEmail(serviceAccountEmail)\n .identityTokenAudienceWo(identityTokenAudience)\n .identityTokenAudienceWoVersion(1)\n .identityTokenTtl(3600)\n .identityTokenKeyWo(\"my-key\")\n .identityTokenKeyWoVersion(1)\n .granularity(\"secret-path\")\n .build());\n\n }\n}\n```\n```yaml\nresources:\n gcpWif:\n type: vault:secrets:SyncGcpDestination\n name: gcp_wif\n properties:\n name: gcp-dest-wif\n serviceAccountEmail: ${serviceAccountEmail}\n identityTokenAudienceWo: ${identityTokenAudience}\n identityTokenAudienceWoVersion: 1\n identityTokenTtl: 3600\n identityTokenKeyWo: my-key\n identityTokenKeyWoVersion: 1\n granularity: secret-path\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nGCP Secrets sync destinations can be imported using the \u003cspan pulumi-lang-nodejs=\"`name`\" pulumi-lang-dotnet=\"`Name`\" pulumi-lang-go=\"`name`\" pulumi-lang-python=\"`name`\" pulumi-lang-yaml=\"`name`\" pulumi-lang-java=\"`name`\" pulumi-lang-hcl=\"`name`\"\u003e`name`\u003c/span\u003e, e.g.\n\n```sh\n$ pulumi import vault:secrets/syncGcpDestination:SyncGcpDestination gcp gcp-dest\n```\n\n", "properties": { "allowedIpv4Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv4 addresses for outbound network connectivity in CIDR notation. If not set, all IPv4 addresses are allowed." }, "allowedIpv6Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv6 addresses for outbound network connectivity in CIDR notation. If not set, all IPv6 addresses are allowed." }, "allowedPorts": { "type": "array", "items": { "type": "integer" }, "description": "Allowed ports for outbound network connectivity. If not set, all ports are allowed." }, "credentials": { "type": "string", "description": "JSON-encoded credentials to use to connect to GCP.\nCan be omitted and directly provided to Vault using the `GOOGLE_APPLICATION_CREDENTIALS` environment\nvariable.\n", "secret": true }, "customTags": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Custom tags to set on the secret managed at the destination.\n" }, "disableStrictNetworking": { "type": "boolean", "description": "Disable strict networking requirements." }, "globalKmsKey": { "type": "string", "description": "Global KMS key for encryption.", "deprecationMessage": "Deprecated in favor of\u003cspan pulumi-lang-nodejs=\" kmsKeyId \" pulumi-lang-dotnet=\" KmsKeyId \" pulumi-lang-go=\" kmsKeyId \" pulumi-lang-python=\" kms_key_id \" pulumi-lang-yaml=\" kmsKeyId \" pulumi-lang-java=\" kmsKeyId \" pulumi-lang-hcl=\" kms_key_id \"\u003e kmsKeyId \u003c/span\u003efor Vault Enterprise 2.2.0+." }, "granularity": { "type": "string", "description": "Determines what level of information is synced as a distinct resource\nat the destination. Supports `secret-path` and `secret-key`.\n" }, "identityTokenAudienceWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe audience claim value for identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenAudienceWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenAudienceWo \" pulumi-lang-dotnet=\" IdentityTokenAudienceWo \" pulumi-lang-go=\" identityTokenAudienceWo \" pulumi-lang-python=\" identity_token_audience_wo \" pulumi-lang-yaml=\" identityTokenAudienceWo \" pulumi-lang-java=\" identityTokenAudienceWo \" pulumi-lang-hcl=\" identity_token_audience_wo \"\u003e identityTokenAudienceWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenKeyWo": { "type": "string", "description": "**NOTE:** This field is write-only and its value will not be updated in state as part of read operations.\nThe key to use for signing identity tokens. This is a write-only field and will not be read back from Vault.", "secret": true }, "identityTokenKeyWoVersion": { "type": "integer", "description": "A version counter for the write-only\u003cspan pulumi-lang-nodejs=\" identityTokenKeyWo \" pulumi-lang-dotnet=\" IdentityTokenKeyWo \" pulumi-lang-go=\" identityTokenKeyWo \" pulumi-lang-python=\" identity_token_key_wo \" pulumi-lang-yaml=\" identityTokenKeyWo \" pulumi-lang-java=\" identityTokenKeyWo \" pulumi-lang-hcl=\" identity_token_key_wo \"\u003e identityTokenKeyWo \u003c/span\u003efield. Incrementing this value will trigger an update." }, "identityTokenTtl": { "type": "integer", "description": "The TTL of generated tokens." }, "kmsKeyId": { "type": "string", "description": "Specifies the ID of the GCP KMS key to be used to encrypt the secret." }, "locationalKmsKeys": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Locational KMS keys for encryption.", "deprecationMessage": "Deprecated in favor of\u003cspan pulumi-lang-nodejs=\" replicaRegions \" pulumi-lang-dotnet=\" ReplicaRegions \" pulumi-lang-go=\" replicaRegions \" pulumi-lang-python=\" replica_regions \" pulumi-lang-yaml=\" replicaRegions \" pulumi-lang-java=\" replicaRegions \" pulumi-lang-hcl=\" replica_regions \"\u003e replicaRegions \u003c/span\u003efor Vault Enterprise 2.2.0+." }, "name": { "type": "string", "description": "Unique name of the GCP destination.\n" }, "namespace": { "type": "string", "description": "The namespace to provision the resource in.\nThe value should not contain leading or trailing forward slashes.\nThe \u003cspan pulumi-lang-nodejs=\"`namespace`\" pulumi-lang-dotnet=\"`Namespace`\" pulumi-lang-go=\"`namespace`\" pulumi-lang-python=\"`namespace`\" pulumi-lang-yaml=\"`namespace`\" pulumi-lang-java=\"`namespace`\" pulumi-lang-hcl=\"`namespace`\"\u003e`namespace`\u003c/span\u003e is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).\n" }, "projectId": { "type": "string", "description": "The target project to manage secrets in. If set,\noverrides the project ID derived from the service account JSON credentials or application\ndefault credentials. The service account must be [authorized](https://cloud.google.com/iam/docs/service-account-overview#locations)\nto perform Secret Manager actions in the target project.\n" }, "replicaRegions": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of regions to KMS key resource names for replica region encryption. KMS key values are optional." }, "replicationLocations": { "type": "array", "items": { "type": "string" }, "description": "Replication locations for secrets.", "deprecationMessage": "Deprecated in favor of\u003cspan pulumi-lang-nodejs=\" replicaRegions \" pulumi-lang-dotnet=\" ReplicaRegions \" pulumi-lang-go=\" replicaRegions \" pulumi-lang-python=\" replica_regions \" pulumi-lang-yaml=\" replicaRegions \" pulumi-lang-java=\" replicaRegions \" pulumi-lang-hcl=\" replica_regions \"\u003e replicaRegions \u003c/span\u003efor Vault Enterprise 2.2.0+." }, "secretNameTemplate": { "type": "string", "description": "Template describing how to generate external secret names.\nSupports a subset of the Go Template syntax.\n" }, "serviceAccountEmail": { "type": "string", "description": "Service Account to impersonate for workload identity federation." }, "type": { "type": "string", "description": "The type of the secrets destination (`gcp-sm`).\n" } }, "required": [ "identityTokenTtl", "name", "secretNameTemplate", "type" ], "inputProperties": { "allowedIpv4Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv4 addresses for outbound network connectivity in CIDR notation. If not set, all IPv4 addresses are allowed." }, "allowedIpv6Addresses": { "type": "array", "items": { "type": "string" }, "description": "Allowed IPv6 addresses for outbound network connectivity in CIDR notation. If not set, all IPv6 addresses are allowed." },