pulumi-vault 5.15.0a1693982937__tar.gz → 5.16.0a1694757730__tar.gz

{pulumi_vault-5.15.0a1693982937 → pulumi_vault-5.16.0a1694757730}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulumi_vault
-Version: 5.15.0a1693982937
+Version: 5.16.0a1694757730
 Summary: A Pulumi package for creating and managing HashiCorp Vault cloud resources.
 Home-page: https://pulumi.io
 License: Apache-2.0

{pulumi_vault-5.15.0a1693982937 → pulumi_vault-5.16.0a1694757730}/pulumi_vault/aws/auth_backend_client.py

@@ -22,7 +22,8 @@ class AuthBackendClientArgs:
                  namespace: Optional[pulumi.Input[str]] = None,
                  secret_key: Optional[pulumi.Input[str]] = None,
                  sts_endpoint: Optional[pulumi.Input[str]] = None,
-                 sts_region: Optional[pulumi.Input[str]] = None):
+                 sts_region: Optional[pulumi.Input[str]] = None,
+                 use_sts_region_from_client: Optional[pulumi.Input[bool]] = None):
         """
         The set of arguments for constructing a AuthBackendClient resource.
         :param pulumi.Input[str] access_key: The AWS access key that Vault should use for the
@@ -46,6 +47,11 @@ class AuthBackendClientArgs:
                calls.
         :param pulumi.Input[str] sts_region: Override the default region when making STS API 
                calls. The `sts_endpoint` argument must be set when using `sts_region`.
+        :param pulumi.Input[bool] use_sts_region_from_client: Available in Vault v1.15+. If set, 
+               overrides both `sts_endpoint` and `sts_region` to instead use the region
+               specified in the client request headers for IAM-based authentication.
+               This can be useful when you have client requests coming from different
+               regions and want flexibility in which regional STS API is used.
         """
         if access_key is not None:
             pulumi.set(__self__, "access_key", access_key)
@@ -65,6 +71,8 @@ class AuthBackendClientArgs:
             pulumi.set(__self__, "sts_endpoint", sts_endpoint)
         if sts_region is not None:
             pulumi.set(__self__, "sts_region", sts_region)
+        if use_sts_region_from_client is not None:
+            pulumi.set(__self__, "use_sts_region_from_client", use_sts_region_from_client)
 
     @property
     @pulumi.getter(name="accessKey")
@@ -186,6 +194,22 @@ class AuthBackendClientArgs:
     def sts_region(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "sts_region", value)
 
+    @property
+    @pulumi.getter(name="useStsRegionFromClient")
+    def use_sts_region_from_client(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Available in Vault v1.15+. If set, 
+        overrides both `sts_endpoint` and `sts_region` to instead use the region
+        specified in the client request headers for IAM-based authentication.
+        This can be useful when you have client requests coming from different
+        regions and want flexibility in which regional STS API is used.
+        """
+        return pulumi.get(self, "use_sts_region_from_client")
+
+    @use_sts_region_from_client.setter
+    def use_sts_region_from_client(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "use_sts_region_from_client", value)
+
 
 @pulumi.input_type
 class _AuthBackendClientState:
@@ -198,7 +222,8 @@ class _AuthBackendClientState:
                  namespace: Optional[pulumi.Input[str]] = None,
                  secret_key: Optional[pulumi.Input[str]] = None,
                  sts_endpoint: Optional[pulumi.Input[str]] = None,
-                 sts_region: Optional[pulumi.Input[str]] = None):
+                 sts_region: Optional[pulumi.Input[str]] = None,
+                 use_sts_region_from_client: Optional[pulumi.Input[bool]] = None):
         """
         Input properties used for looking up and filtering AuthBackendClient resources.
         :param pulumi.Input[str] access_key: The AWS access key that Vault should use for the
@@ -222,6 +247,11 @@ class _AuthBackendClientState:
                calls.
         :param pulumi.Input[str] sts_region: Override the default region when making STS API 
                calls. The `sts_endpoint` argument must be set when using `sts_region`.
+        :param pulumi.Input[bool] use_sts_region_from_client: Available in Vault v1.15+. If set, 
+               overrides both `sts_endpoint` and `sts_region` to instead use the region
+               specified in the client request headers for IAM-based authentication.
+               This can be useful when you have client requests coming from different
+               regions and want flexibility in which regional STS API is used.
         """
         if access_key is not None:
             pulumi.set(__self__, "access_key", access_key)
@@ -241,6 +271,8 @@ class _AuthBackendClientState:
             pulumi.set(__self__, "sts_endpoint", sts_endpoint)
         if sts_region is not None:
             pulumi.set(__self__, "sts_region", sts_region)
+        if use_sts_region_from_client is not None:
+            pulumi.set(__self__, "use_sts_region_from_client", use_sts_region_from_client)
 
     @property
     @pulumi.getter(name="accessKey")
@@ -362,6 +394,22 @@ class _AuthBackendClientState:
     def sts_region(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "sts_region", value)
 
+    @property
+    @pulumi.getter(name="useStsRegionFromClient")
+    def use_sts_region_from_client(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Available in Vault v1.15+. If set, 
+        overrides both `sts_endpoint` and `sts_region` to instead use the region
+        specified in the client request headers for IAM-based authentication.
+        This can be useful when you have client requests coming from different
+        regions and want flexibility in which regional STS API is used.
+        """
+        return pulumi.get(self, "use_sts_region_from_client")
+
+    @use_sts_region_from_client.setter
+    def use_sts_region_from_client(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "use_sts_region_from_client", value)
+
 
 class AuthBackendClient(pulumi.CustomResource):
     @overload
@@ -377,6 +425,7 @@ class AuthBackendClient(pulumi.CustomResource):
                  secret_key: Optional[pulumi.Input[str]] = None,
                  sts_endpoint: Optional[pulumi.Input[str]] = None,
                  sts_region: Optional[pulumi.Input[str]] = None,
+                 use_sts_region_from_client: Optional[pulumi.Input[bool]] = None,
                  __props__=None):
         """
         ## Example Usage
@@ -423,6 +472,11 @@ class AuthBackendClient(pulumi.CustomResource):
                calls.
         :param pulumi.Input[str] sts_region: Override the default region when making STS API 
                calls. The `sts_endpoint` argument must be set when using `sts_region`.
+        :param pulumi.Input[bool] use_sts_region_from_client: Available in Vault v1.15+. If set, 
+               overrides both `sts_endpoint` and `sts_region` to instead use the region
+               specified in the client request headers for IAM-based authentication.
+               This can be useful when you have client requests coming from different
+               regions and want flexibility in which regional STS API is used.
         """
         ...
     @overload
@@ -476,6 +530,7 @@ class AuthBackendClient(pulumi.CustomResource):
                  secret_key: Optional[pulumi.Input[str]] = None,
                  sts_endpoint: Optional[pulumi.Input[str]] = None,
                  sts_region: Optional[pulumi.Input[str]] = None,
+                 use_sts_region_from_client: Optional[pulumi.Input[bool]] = None,
                  __props__=None):
         opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
         if not isinstance(opts, pulumi.ResourceOptions):
@@ -494,6 +549,7 @@ class AuthBackendClient(pulumi.CustomResource):
             __props__.__dict__["secret_key"] = None if secret_key is None else pulumi.Output.secret(secret_key)
             __props__.__dict__["sts_endpoint"] = sts_endpoint
             __props__.__dict__["sts_region"] = sts_region
+            __props__.__dict__["use_sts_region_from_client"] = use_sts_region_from_client
         secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["accessKey", "secretKey"])
         opts = pulumi.ResourceOptions.merge(opts, secret_opts)
         super(AuthBackendClient, __self__).__init__(
@@ -514,7 +570,8 @@ class AuthBackendClient(pulumi.CustomResource):
             namespace: Optional[pulumi.Input[str]] = None,
             secret_key: Optional[pulumi.Input[str]] = None,
             sts_endpoint: Optional[pulumi.Input[str]] = None,
-            sts_region: Optional[pulumi.Input[str]] = None) -> 'AuthBackendClient':
+            sts_region: Optional[pulumi.Input[str]] = None,
+            use_sts_region_from_client: Optional[pulumi.Input[bool]] = None) -> 'AuthBackendClient':
         """
         Get an existing AuthBackendClient resource's state with the given name, id, and optional extra
         properties used to qualify the lookup.
@@ -543,6 +600,11 @@ class AuthBackendClient(pulumi.CustomResource):
                calls.
         :param pulumi.Input[str] sts_region: Override the default region when making STS API 
                calls. The `sts_endpoint` argument must be set when using `sts_region`.
+        :param pulumi.Input[bool] use_sts_region_from_client: Available in Vault v1.15+. If set, 
+               overrides both `sts_endpoint` and `sts_region` to instead use the region
+               specified in the client request headers for IAM-based authentication.
+               This can be useful when you have client requests coming from different
+               regions and want flexibility in which regional STS API is used.
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
 
@@ -557,6 +619,7 @@ class AuthBackendClient(pulumi.CustomResource):
         __props__.__dict__["secret_key"] = secret_key
         __props__.__dict__["sts_endpoint"] = sts_endpoint
         __props__.__dict__["sts_region"] = sts_region
+        __props__.__dict__["use_sts_region_from_client"] = use_sts_region_from_client
         return AuthBackendClient(resource_name, opts=opts, __props__=__props__)
 
     @property
@@ -643,3 +706,15 @@ class AuthBackendClient(pulumi.CustomResource):
         """
         return pulumi.get(self, "sts_region")
 
+    @property
+    @pulumi.getter(name="useStsRegionFromClient")
+    def use_sts_region_from_client(self) -> pulumi.Output[bool]:
+        """
+        Available in Vault v1.15+. If set, 
+        overrides both `sts_endpoint` and `sts_region` to instead use the region
+        specified in the client request headers for IAM-based authentication.
+        This can be useful when you have client requests coming from different
+        regions and want flexibility in which regional STS API is used.
+        """
+        return pulumi.get(self, "use_sts_region_from_client")
+

{pulumi_vault-5.15.0a1693982937 → pulumi_vault-5.16.0a1694757730}/pulumi_vault/aws/auth_backend_role.py

@@ -49,7 +49,7 @@ class AuthBackendRoleArgs:
                the underlying instance where the client resides.
         :param pulumi.Input[str] auth_type: The auth type permitted for this role. Valid choices
                are `ec2` and `iam`. Defaults to `iam`.
-        :param pulumi.Input[str] backend: Unique name of the auth backend to configure.
+        :param pulumi.Input[str] backend: Path to the mounted aws auth backend.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_account_ids: If set, defines a constraint on the EC2
                instances that can perform the login operation that they should be using the
                account ID specified by this field. `auth_type` must be set to `ec2` or
@@ -242,7 +242,7 @@ class AuthBackendRoleArgs:
     @pulumi.getter
     def backend(self) -> Optional[pulumi.Input[str]]:
         """
-        Unique name of the auth backend to configure.
+        Path to the mounted aws auth backend.
         """
         return pulumi.get(self, "backend")
 
@@ -646,7 +646,7 @@ class _AuthBackendRoleState:
                the underlying instance where the client resides.
         :param pulumi.Input[str] auth_type: The auth type permitted for this role. Valid choices
                are `ec2` and `iam`. Defaults to `iam`.
-        :param pulumi.Input[str] backend: Unique name of the auth backend to configure.
+        :param pulumi.Input[str] backend: Path to the mounted aws auth backend.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_account_ids: If set, defines a constraint on the EC2
                instances that can perform the login operation that they should be using the
                account ID specified by this field. `auth_type` must be set to `ec2` or
@@ -832,7 +832,7 @@ class _AuthBackendRoleState:
     @pulumi.getter
     def backend(self) -> Optional[pulumi.Input[str]]:
         """
-        Unique name of the auth backend to configure.
+        Path to the mounted aws auth backend.
         """
         return pulumi.get(self, "backend")
 
@@ -1305,7 +1305,7 @@ class AuthBackendRole(pulumi.CustomResource):
                the underlying instance where the client resides.
         :param pulumi.Input[str] auth_type: The auth type permitted for this role. Valid choices
                are `ec2` and `iam`. Defaults to `iam`.
-        :param pulumi.Input[str] backend: Unique name of the auth backend to configure.
+        :param pulumi.Input[str] backend: Path to the mounted aws auth backend.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_account_ids: If set, defines a constraint on the EC2
                instances that can perform the login operation that they should be using the
                account ID specified by this field. `auth_type` must be set to `ec2` or
@@ -1583,7 +1583,7 @@ class AuthBackendRole(pulumi.CustomResource):
                the underlying instance where the client resides.
         :param pulumi.Input[str] auth_type: The auth type permitted for this role. Valid choices
                are `ec2` and `iam`. Defaults to `iam`.
-        :param pulumi.Input[str] backend: Unique name of the auth backend to configure.
+        :param pulumi.Input[str] backend: Path to the mounted aws auth backend.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_account_ids: If set, defines a constraint on the EC2
                instances that can perform the login operation that they should be using the
                account ID specified by this field. `auth_type` must be set to `ec2` or
@@ -1737,7 +1737,7 @@ class AuthBackendRole(pulumi.CustomResource):
     @pulumi.getter
     def backend(self) -> pulumi.Output[Optional[str]]:
         """
-        Unique name of the auth backend to configure.
+        Path to the mounted aws auth backend.
         """
         return pulumi.get(self, "backend")
 

{pulumi_vault-5.15.0a1693982937 → pulumi_vault-5.16.0a1694757730}/pulumi_vault/azure/backend_role.py

@@ -24,12 +24,13 @@ class BackendRoleArgs:
                  description: Optional[pulumi.Input[str]] = None,
                  max_ttl: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
+                 permanently_delete: Optional[pulumi.Input[bool]] = None,
                  ttl: Optional[pulumi.Input[str]] = None):
         """
         The set of arguments for constructing a BackendRole resource.
         :param pulumi.Input[str] role: Name of the Azure role
         :param pulumi.Input[str] application_object_id: Application Object ID for an existing service principal that will
-               be used instead of creating dynamic service principals. If present, `azure_roles` will be ignored.
+               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
         :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]] azure_groups: List of Azure groups to be assigned to the generated service principal.
         :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]] azure_roles: List of Azure roles to be assigned to the generated service principal.
         :param pulumi.Input[str] backend: Path to the mounted Azure auth backend
@@ -40,6 +41,8 @@ class BackendRoleArgs:
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
                *Available only for Vault Enterprise*.
+        :param pulumi.Input[bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
+               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
         :param pulumi.Input[str] ttl: Specifies the default TTL for service principals generated using this role.
                Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
         """
@@ -58,6 +61,8 @@ class BackendRoleArgs:
             pulumi.set(__self__, "max_ttl", max_ttl)
         if namespace is not None:
             pulumi.set(__self__, "namespace", namespace)
+        if permanently_delete is not None:
+            pulumi.set(__self__, "permanently_delete", permanently_delete)
         if ttl is not None:
             pulumi.set(__self__, "ttl", ttl)
 
@@ -78,7 +83,7 @@ class BackendRoleArgs:
     def application_object_id(self) -> Optional[pulumi.Input[str]]:
         """
         Application Object ID for an existing service principal that will
-        be used instead of creating dynamic service principals. If present, `azure_roles` will be ignored.
+        be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
         """
         return pulumi.get(self, "application_object_id")
 
@@ -162,6 +167,19 @@ class BackendRoleArgs:
     def namespace(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "namespace", value)
 
+    @property
+    @pulumi.getter(name="permanentlyDelete")
+    def permanently_delete(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether the applications and service principals created by Vault will be permanently
+        deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        """
+        return pulumi.get(self, "permanently_delete")
+
+    @permanently_delete.setter
+    def permanently_delete(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "permanently_delete", value)
+
     @property
     @pulumi.getter
     def ttl(self) -> Optional[pulumi.Input[str]]:
@@ -186,12 +204,13 @@ class _BackendRoleState:
                  description: Optional[pulumi.Input[str]] = None,
                  max_ttl: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
+                 permanently_delete: Optional[pulumi.Input[bool]] = None,
                  role: Optional[pulumi.Input[str]] = None,
                  ttl: Optional[pulumi.Input[str]] = None):
         """
         Input properties used for looking up and filtering BackendRole resources.
         :param pulumi.Input[str] application_object_id: Application Object ID for an existing service principal that will
-               be used instead of creating dynamic service principals. If present, `azure_roles` will be ignored.
+               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
         :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureGroupArgs']]] azure_groups: List of Azure groups to be assigned to the generated service principal.
         :param pulumi.Input[Sequence[pulumi.Input['BackendRoleAzureRoleArgs']]] azure_roles: List of Azure roles to be assigned to the generated service principal.
         :param pulumi.Input[str] backend: Path to the mounted Azure auth backend
@@ -202,6 +221,8 @@ class _BackendRoleState:
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
                *Available only for Vault Enterprise*.
+        :param pulumi.Input[bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
+               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
         :param pulumi.Input[str] role: Name of the Azure role
         :param pulumi.Input[str] ttl: Specifies the default TTL for service principals generated using this role.
                Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
@@ -220,6 +241,8 @@ class _BackendRoleState:
             pulumi.set(__self__, "max_ttl", max_ttl)
         if namespace is not None:
             pulumi.set(__self__, "namespace", namespace)
+        if permanently_delete is not None:
+            pulumi.set(__self__, "permanently_delete", permanently_delete)
         if role is not None:
             pulumi.set(__self__, "role", role)
         if ttl is not None:
@@ -230,7 +253,7 @@ class _BackendRoleState:
     def application_object_id(self) -> Optional[pulumi.Input[str]]:
         """
         Application Object ID for an existing service principal that will
-        be used instead of creating dynamic service principals. If present, `azure_roles` will be ignored.
+        be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
         """
         return pulumi.get(self, "application_object_id")
 
@@ -314,6 +337,19 @@ class _BackendRoleState:
     def namespace(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "namespace", value)
 
+    @property
+    @pulumi.getter(name="permanentlyDelete")
+    def permanently_delete(self) -> Optional[pulumi.Input[bool]]:
+        """
+        Indicates whether the applications and service principals created by Vault will be permanently
+        deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        """
+        return pulumi.get(self, "permanently_delete")
+
+    @permanently_delete.setter
+    def permanently_delete(self, value: Optional[pulumi.Input[bool]]):
+        pulumi.set(self, "permanently_delete", value)
+
     @property
     @pulumi.getter
     def role(self) -> Optional[pulumi.Input[str]]:
@@ -352,6 +388,7 @@ class BackendRole(pulumi.CustomResource):
                  description: Optional[pulumi.Input[str]] = None,
                  max_ttl: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
+                 permanently_delete: Optional[pulumi.Input[bool]] = None,
                  role: Optional[pulumi.Input[str]] = None,
                  ttl: Optional[pulumi.Input[str]] = None,
                  __props__=None):
@@ -387,7 +424,7 @@ class BackendRole(pulumi.CustomResource):
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] application_object_id: Application Object ID for an existing service principal that will
-               be used instead of creating dynamic service principals. If present, `azure_roles` will be ignored.
+               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['BackendRoleAzureGroupArgs']]]] azure_groups: List of Azure groups to be assigned to the generated service principal.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['BackendRoleAzureRoleArgs']]]] azure_roles: List of Azure roles to be assigned to the generated service principal.
         :param pulumi.Input[str] backend: Path to the mounted Azure auth backend
@@ -398,6 +435,8 @@ class BackendRole(pulumi.CustomResource):
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
                *Available only for Vault Enterprise*.
+        :param pulumi.Input[bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
+               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
         :param pulumi.Input[str] role: Name of the Azure role
         :param pulumi.Input[str] ttl: Specifies the default TTL for service principals generated using this role.
                Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
@@ -459,6 +498,7 @@ class BackendRole(pulumi.CustomResource):
                  description: Optional[pulumi.Input[str]] = None,
                  max_ttl: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
+                 permanently_delete: Optional[pulumi.Input[bool]] = None,
                  role: Optional[pulumi.Input[str]] = None,
                  ttl: Optional[pulumi.Input[str]] = None,
                  __props__=None):
@@ -477,6 +517,7 @@ class BackendRole(pulumi.CustomResource):
             __props__.__dict__["description"] = description
             __props__.__dict__["max_ttl"] = max_ttl
             __props__.__dict__["namespace"] = namespace
+            __props__.__dict__["permanently_delete"] = permanently_delete
             if role is None and not opts.urn:
                 raise TypeError("Missing required property 'role'")
             __props__.__dict__["role"] = role
@@ -498,6 +539,7 @@ class BackendRole(pulumi.CustomResource):
             description: Optional[pulumi.Input[str]] = None,
             max_ttl: Optional[pulumi.Input[str]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
+            permanently_delete: Optional[pulumi.Input[bool]] = None,
             role: Optional[pulumi.Input[str]] = None,
             ttl: Optional[pulumi.Input[str]] = None) -> 'BackendRole':
         """
@@ -508,7 +550,7 @@ class BackendRole(pulumi.CustomResource):
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] application_object_id: Application Object ID for an existing service principal that will
-               be used instead of creating dynamic service principals. If present, `azure_roles` will be ignored.
+               be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['BackendRoleAzureGroupArgs']]]] azure_groups: List of Azure groups to be assigned to the generated service principal.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['BackendRoleAzureRoleArgs']]]] azure_roles: List of Azure roles to be assigned to the generated service principal.
         :param pulumi.Input[str] backend: Path to the mounted Azure auth backend
@@ -519,6 +561,8 @@ class BackendRole(pulumi.CustomResource):
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
                *Available only for Vault Enterprise*.
+        :param pulumi.Input[bool] permanently_delete: Indicates whether the applications and service principals created by Vault will be permanently
+               deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
         :param pulumi.Input[str] role: Name of the Azure role
         :param pulumi.Input[str] ttl: Specifies the default TTL for service principals generated using this role.
                Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
@@ -534,6 +578,7 @@ class BackendRole(pulumi.CustomResource):
         __props__.__dict__["description"] = description
         __props__.__dict__["max_ttl"] = max_ttl
         __props__.__dict__["namespace"] = namespace
+        __props__.__dict__["permanently_delete"] = permanently_delete
         __props__.__dict__["role"] = role
         __props__.__dict__["ttl"] = ttl
         return BackendRole(resource_name, opts=opts, __props__=__props__)
@@ -543,7 +588,7 @@ class BackendRole(pulumi.CustomResource):
     def application_object_id(self) -> pulumi.Output[Optional[str]]:
         """
         Application Object ID for an existing service principal that will
-        be used instead of creating dynamic service principals. If present, `azure_roles` will be ignored.
+        be used instead of creating dynamic service principals. If present, `azure_roles` and `permanently_delete` will be ignored.
         """
         return pulumi.get(self, "application_object_id")
 
@@ -599,6 +644,15 @@ class BackendRole(pulumi.CustomResource):
         """
         return pulumi.get(self, "namespace")
 
+    @property
+    @pulumi.getter(name="permanentlyDelete")
+    def permanently_delete(self) -> pulumi.Output[bool]:
+        """
+        Indicates whether the applications and service principals created by Vault will be permanently
+        deleted when the corresponding leases expire. Defaults to `false`. For Vault v1.12+.
+        """
+        return pulumi.get(self, "permanently_delete")
+
     @property
     @pulumi.getter
     def role(self) -> pulumi.Output[str]:

{pulumi_vault-5.15.0a1693982937 → pulumi_vault-5.16.0a1694757730}/pulumi_vault/gcp/auth_backend.py

@@ -216,6 +216,7 @@ class AuthBackendArgs:
 @pulumi.input_type
 class _AuthBackendState:
     def __init__(__self__, *,
+                 accessor: Optional[pulumi.Input[str]] = None,
                  client_email: Optional[pulumi.Input[str]] = None,
                  client_id: Optional[pulumi.Input[str]] = None,
                  credentials: Optional[pulumi.Input[str]] = None,
@@ -229,6 +230,7 @@ class _AuthBackendState:
                  project_id: Optional[pulumi.Input[str]] = None):
         """
         Input properties used for looking up and filtering AuthBackend resources.
+        :param pulumi.Input[str] accessor: The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
         :param pulumi.Input[str] client_email: The clients email associated with the credentials
         :param pulumi.Input[str] client_id: The Client ID of the credentials
         :param pulumi.Input[str] credentials: A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running.
@@ -249,6 +251,8 @@ class _AuthBackendState:
         :param pulumi.Input[str] private_key_id: The ID of the private key from the credentials
         :param pulumi.Input[str] project_id: The GCP Project ID
         """
+        if accessor is not None:
+            pulumi.set(__self__, "accessor", accessor)
         if client_email is not None:
             pulumi.set(__self__, "client_email", client_email)
         if client_id is not None:
@@ -272,6 +276,18 @@ class _AuthBackendState:
         if project_id is not None:
             pulumi.set(__self__, "project_id", project_id)
 
+    @property
+    @pulumi.getter
+    def accessor(self) -> Optional[pulumi.Input[str]]:
+        """
+        The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
+        """
+        return pulumi.get(self, "accessor")
+
+    @accessor.setter
+    def accessor(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "accessor", value)
+
     @property
     @pulumi.getter(name="clientEmail")
     def client_email(self) -> Optional[pulumi.Input[str]]:
@@ -558,6 +574,7 @@ class AuthBackend(pulumi.CustomResource):
             __props__.__dict__["path"] = path
             __props__.__dict__["private_key_id"] = private_key_id
             __props__.__dict__["project_id"] = project_id
+            __props__.__dict__["accessor"] = None
         secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["credentials"])
         opts = pulumi.ResourceOptions.merge(opts, secret_opts)
         super(AuthBackend, __self__).__init__(
@@ -570,6 +587,7 @@ class AuthBackend(pulumi.CustomResource):
     def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
+            accessor: Optional[pulumi.Input[str]] = None,
             client_email: Optional[pulumi.Input[str]] = None,
             client_id: Optional[pulumi.Input[str]] = None,
             credentials: Optional[pulumi.Input[str]] = None,
@@ -588,6 +606,7 @@ class AuthBackend(pulumi.CustomResource):
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] accessor: The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
         :param pulumi.Input[str] client_email: The clients email associated with the credentials
         :param pulumi.Input[str] client_id: The Client ID of the credentials
         :param pulumi.Input[str] credentials: A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running.
@@ -612,6 +631,7 @@ class AuthBackend(pulumi.CustomResource):
 
         __props__ = _AuthBackendState.__new__(_AuthBackendState)
 
+        __props__.__dict__["accessor"] = accessor
         __props__.__dict__["client_email"] = client_email
         __props__.__dict__["client_id"] = client_id
         __props__.__dict__["credentials"] = credentials
@@ -625,6 +645,14 @@ class AuthBackend(pulumi.CustomResource):
         __props__.__dict__["project_id"] = project_id
         return AuthBackend(resource_name, opts=opts, __props__=__props__)
 
+    @property
+    @pulumi.getter
+    def accessor(self) -> pulumi.Output[str]:
+        """
+        The mount accessor related to the auth mount. It is useful for integration with [Identity Secrets Engine](https://www.vaultproject.io/docs/secrets/identity/index.html).
+        """
+        return pulumi.get(self, "accessor")
+
     @property
     @pulumi.getter(name="clientEmail")
     def client_email(self) -> pulumi.Output[str]:

{pulumi_vault-5.15.0a1693982937 → pulumi_vault-5.16.0a1694757730}/pulumi_vault/mount.py

@@ -507,6 +507,10 @@ class Mount(pulumi.CustomResource):
 
         kvv2_example = vault.Mount("kvv2-example",
             description="This is an example KV Version 2 secret engine mount",
+            options={
+                "type": "kv-v2",
+                "version": "2",
+            },
             path="version2-example",
             type="kv-v2")
         ```
@@ -588,6 +592,10 @@ class Mount(pulumi.CustomResource):
 
         kvv2_example = vault.Mount("kvv2-example",
             description="This is an example KV Version 2 secret engine mount",
+            options={
+                "type": "kv-v2",
+                "version": "2",
+            },
             path="version2-example",
             type="kv-v2")
         ```

{pulumi_vault-5.15.0a1693982937 → pulumi_vault-5.16.0a1694757730}/pulumi_vault/pkisecret/secret_backend_role.py

@@ -99,7 +99,7 @@ class SecretBackendRoleArgs:
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
                *Available only for Vault Enterprise*.
         :param pulumi.Input[bool] no_store: Flag to not store certificates in the storage backend
-        :param pulumi.Input[str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
+        :param pulumi.Input[str] not_before_duration: Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] organization_unit: The organization unit of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[str]]] organizations: The organization of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
@@ -595,7 +595,7 @@ class SecretBackendRoleArgs:
     @pulumi.getter(name="notBeforeDuration")
     def not_before_duration(self) -> Optional[pulumi.Input[str]]:
         """
-        Specifies the duration by which to backdate the NotBefore property.
+        Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.
         """
         return pulumi.get(self, "not_before_duration")
 
@@ -824,7 +824,7 @@ class _SecretBackendRoleState:
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
                *Available only for Vault Enterprise*.
         :param pulumi.Input[bool] no_store: Flag to not store certificates in the storage backend
-        :param pulumi.Input[str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
+        :param pulumi.Input[str] not_before_duration: Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] organization_unit: The organization unit of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[str]]] organizations: The organization of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
@@ -1321,7 +1321,7 @@ class _SecretBackendRoleState:
     @pulumi.getter(name="notBeforeDuration")
     def not_before_duration(self) -> Optional[pulumi.Input[str]]:
         """
-        Specifies the duration by which to backdate the NotBefore property.
+        Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.
         """
         return pulumi.get(self, "not_before_duration")
 
@@ -1588,7 +1588,7 @@ class SecretBackendRole(pulumi.CustomResource):
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
                *Available only for Vault Enterprise*.
         :param pulumi.Input[bool] no_store: Flag to not store certificates in the storage backend
-        :param pulumi.Input[str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
+        :param pulumi.Input[str] not_before_duration: Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] organization_unit: The organization unit of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[str]]] organizations: The organization of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
@@ -1856,7 +1856,7 @@ class SecretBackendRole(pulumi.CustomResource):
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
                *Available only for Vault Enterprise*.
         :param pulumi.Input[bool] no_store: Flag to not store certificates in the storage backend
-        :param pulumi.Input[str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
+        :param pulumi.Input[str] not_before_duration: Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] organization_unit: The organization unit of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[str]]] organizations: The organization of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
@@ -2186,7 +2186,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @pulumi.getter(name="notBeforeDuration")
     def not_before_duration(self) -> pulumi.Output[str]:
         """
-        Specifies the duration by which to backdate the NotBefore property.
+        Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.
         """
         return pulumi.get(self, "not_before_duration")