pulumi-vault 5.19.0a1705621752__py3-none-any.whl → 5.20.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. pulumi_vault/__init__.py +59 -0
  2. pulumi_vault/_inputs.py +380 -0
  3. pulumi_vault/_utilities.py +2 -2
  4. pulumi_vault/aws/secret_backend.py +188 -0
  5. pulumi_vault/aws/secret_backend_static_role.py +2 -2
  6. pulumi_vault/azure/backend.py +7 -21
  7. pulumi_vault/config/__init__.pyi +0 -3
  8. pulumi_vault/config/outputs.py +380 -0
  9. pulumi_vault/config/vars.py +0 -3
  10. pulumi_vault/consul/secret_backend.py +7 -35
  11. pulumi_vault/database/_inputs.py +176 -0
  12. pulumi_vault/database/outputs.py +168 -0
  13. pulumi_vault/get_raft_autopilot_state.py +0 -12
  14. pulumi_vault/identity/group_alias.py +6 -6
  15. pulumi_vault/kubernetes/secret_backend_role.py +8 -4
  16. pulumi_vault/kv/_inputs.py +12 -0
  17. pulumi_vault/kv/outputs.py +12 -0
  18. pulumi_vault/ldap/secret_backend_dynamic_role.py +2 -2
  19. pulumi_vault/ldap/secret_backend_static_role.py +2 -2
  20. pulumi_vault/managed/_inputs.py +12 -0
  21. pulumi_vault/managed/keys.py +20 -0
  22. pulumi_vault/managed/outputs.py +12 -0
  23. pulumi_vault/mongodbatlas/secret_role.py +2 -2
  24. pulumi_vault/namespace.py +46 -14
  25. pulumi_vault/pkisecret/secret_backend_config_issuers.py +0 -6
  26. pulumi_vault/pkisecret/secret_backend_issuer.py +0 -10
  27. pulumi_vault/pkisecret/secret_backend_role.py +7 -7
  28. pulumi_vault/rabbitmq/_inputs.py +36 -0
  29. pulumi_vault/rabbitmq/outputs.py +36 -0
  30. pulumi_vault/saml/auth_backend_role.py +7 -14
  31. pulumi_vault/secrets/__init__.py +14 -0
  32. pulumi_vault/secrets/sync_association.py +464 -0
  33. pulumi_vault/secrets/sync_aws_destination.py +564 -0
  34. pulumi_vault/secrets/sync_azure_destination.py +674 -0
  35. pulumi_vault/secrets/sync_config.py +297 -0
  36. pulumi_vault/secrets/sync_gcp_destination.py +438 -0
  37. pulumi_vault/secrets/sync_gh_destination.py +511 -0
  38. pulumi_vault/secrets/sync_vercel_destination.py +541 -0
  39. pulumi_vault/ssh/secret_backend_role.py +7 -14
  40. {pulumi_vault-5.19.0a1705621752.dist-info → pulumi_vault-5.20.0.dist-info}/METADATA +2 -2
  41. {pulumi_vault-5.19.0a1705621752.dist-info → pulumi_vault-5.20.0.dist-info}/RECORD +43 -35
  42. {pulumi_vault-5.19.0a1705621752.dist-info → pulumi_vault-5.20.0.dist-info}/WHEEL +0 -0
  43. {pulumi_vault-5.19.0a1705621752.dist-info → pulumi_vault-5.20.0.dist-info}/top_level.txt +0 -0
pulumi_vault/_utilities.py CHANGED
@@ -4,11 +4,11 @@
4
4
 
5
5
 
6
6
  import asyncio
7
+ import importlib.metadata
7
8
  import importlib.util
8
9
  import inspect
9
10
  import json
10
11
  import os
11
- import pkg_resources
12
12
  import sys
13
13
  import typing
14
14
 
@@ -72,7 +72,7 @@ def _get_semver_version():
72
72
  # to receive a valid semver string when receiving requests from the language host, so it's our
73
73
  # responsibility as the library to convert our own PEP440 version into a valid semver string.
74
74
 
75
- pep440_version_string = pkg_resources.require(root_package)[0].version
75
+ pep440_version_string = importlib.metadata.version(root_package)
76
76
  pep440_version = PEP440Version.parse(pep440_version_string)
77
77
  (major, minor, patch) = pep440_version.release
78
78
  prerelease = None
pulumi_vault/aws/secret_backend.py CHANGED
@@ -19,11 +19,15 @@ class SecretBackendArgs:
19
19
  description: Optional[pulumi.Input[str]] = None,
20
20
  disable_remount: Optional[pulumi.Input[bool]] = None,
21
21
  iam_endpoint: Optional[pulumi.Input[str]] = None,
22
+ identity_token_audience: Optional[pulumi.Input[str]] = None,
23
+ identity_token_key: Optional[pulumi.Input[str]] = None,
24
+ identity_token_ttl: Optional[pulumi.Input[int]] = None,
22
25
  local: Optional[pulumi.Input[bool]] = None,
23
26
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
24
27
  namespace: Optional[pulumi.Input[str]] = None,
25
28
  path: Optional[pulumi.Input[str]] = None,
26
29
  region: Optional[pulumi.Input[str]] = None,
30
+ role_arn: Optional[pulumi.Input[str]] = None,
27
31
  secret_key: Optional[pulumi.Input[str]] = None,
28
32
  sts_endpoint: Optional[pulumi.Input[str]] = None,
29
33
  username_template: Optional[pulumi.Input[str]] = None):
@@ -37,6 +41,9 @@ class SecretBackendArgs:
37
41
  :param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
38
42
  See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
39
43
  :param pulumi.Input[str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
44
+ :param pulumi.Input[str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
45
+ :param pulumi.Input[str] identity_token_key: The key to use for signing identity tokens. Requires Vault 1.16+.
46
+ :param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
40
47
  :param pulumi.Input[bool] local: Specifies whether the secrets mount will be marked as local. Local mounts are not replicated to performance replicas.
41
48
  :param pulumi.Input[int] max_lease_ttl_seconds: The maximum TTL that can be requested
42
49
  for credentials issued by this backend.
@@ -47,6 +54,7 @@ class SecretBackendArgs:
47
54
  :param pulumi.Input[str] path: The unique path this backend should be mounted at. Must
48
55
  not begin or end with a `/`. Defaults to `aws`.
49
56
  :param pulumi.Input[str] region: The AWS region to make API calls against. Defaults to us-east-1.
57
+ :param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
50
58
  :param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
51
59
  :param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
52
60
  :param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
@@ -61,6 +69,12 @@ class SecretBackendArgs:
61
69
  pulumi.set(__self__, "disable_remount", disable_remount)
62
70
  if iam_endpoint is not None:
63
71
  pulumi.set(__self__, "iam_endpoint", iam_endpoint)
72
+ if identity_token_audience is not None:
73
+ pulumi.set(__self__, "identity_token_audience", identity_token_audience)
74
+ if identity_token_key is not None:
75
+ pulumi.set(__self__, "identity_token_key", identity_token_key)
76
+ if identity_token_ttl is not None:
77
+ pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
64
78
  if local is not None:
65
79
  pulumi.set(__self__, "local", local)
66
80
  if max_lease_ttl_seconds is not None:
@@ -71,6 +85,8 @@ class SecretBackendArgs:
71
85
  pulumi.set(__self__, "path", path)
72
86
  if region is not None:
73
87
  pulumi.set(__self__, "region", region)
88
+ if role_arn is not None:
89
+ pulumi.set(__self__, "role_arn", role_arn)
74
90
  if secret_key is not None:
75
91
  pulumi.set(__self__, "secret_key", secret_key)
76
92
  if sts_endpoint is not None:
@@ -141,6 +157,42 @@ class SecretBackendArgs:
141
157
  def iam_endpoint(self, value: Optional[pulumi.Input[str]]):
142
158
  pulumi.set(self, "iam_endpoint", value)
143
159
 
160
+ @property
161
+ @pulumi.getter(name="identityTokenAudience")
162
+ def identity_token_audience(self) -> Optional[pulumi.Input[str]]:
163
+ """
164
+ The audience claim value. Requires Vault 1.16+.
165
+ """
166
+ return pulumi.get(self, "identity_token_audience")
167
+
168
+ @identity_token_audience.setter
169
+ def identity_token_audience(self, value: Optional[pulumi.Input[str]]):
170
+ pulumi.set(self, "identity_token_audience", value)
171
+
172
+ @property
173
+ @pulumi.getter(name="identityTokenKey")
174
+ def identity_token_key(self) -> Optional[pulumi.Input[str]]:
175
+ """
176
+ The key to use for signing identity tokens. Requires Vault 1.16+.
177
+ """
178
+ return pulumi.get(self, "identity_token_key")
179
+
180
+ @identity_token_key.setter
181
+ def identity_token_key(self, value: Optional[pulumi.Input[str]]):
182
+ pulumi.set(self, "identity_token_key", value)
183
+
184
+ @property
185
+ @pulumi.getter(name="identityTokenTtl")
186
+ def identity_token_ttl(self) -> Optional[pulumi.Input[int]]:
187
+ """
188
+ The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
189
+ """
190
+ return pulumi.get(self, "identity_token_ttl")
191
+
192
+ @identity_token_ttl.setter
193
+ def identity_token_ttl(self, value: Optional[pulumi.Input[int]]):
194
+ pulumi.set(self, "identity_token_ttl", value)
195
+
144
196
  @property
145
197
  @pulumi.getter
146
198
  def local(self) -> Optional[pulumi.Input[bool]]:
@@ -206,6 +258,18 @@ class SecretBackendArgs:
206
258
  def region(self, value: Optional[pulumi.Input[str]]):
207
259
  pulumi.set(self, "region", value)
208
260
 
261
+ @property
262
+ @pulumi.getter(name="roleArn")
263
+ def role_arn(self) -> Optional[pulumi.Input[str]]:
264
+ """
265
+ Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
266
+ """
267
+ return pulumi.get(self, "role_arn")
268
+
269
+ @role_arn.setter
270
+ def role_arn(self, value: Optional[pulumi.Input[str]]):
271
+ pulumi.set(self, "role_arn", value)
272
+
209
273
  @property
210
274
  @pulumi.getter(name="secretKey")
211
275
  def secret_key(self) -> Optional[pulumi.Input[str]]:
@@ -251,11 +315,15 @@ class _SecretBackendState:
251
315
  description: Optional[pulumi.Input[str]] = None,
252
316
  disable_remount: Optional[pulumi.Input[bool]] = None,
253
317
  iam_endpoint: Optional[pulumi.Input[str]] = None,
318
+ identity_token_audience: Optional[pulumi.Input[str]] = None,
319
+ identity_token_key: Optional[pulumi.Input[str]] = None,
320
+ identity_token_ttl: Optional[pulumi.Input[int]] = None,
254
321
  local: Optional[pulumi.Input[bool]] = None,
255
322
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
256
323
  namespace: Optional[pulumi.Input[str]] = None,
257
324
  path: Optional[pulumi.Input[str]] = None,
258
325
  region: Optional[pulumi.Input[str]] = None,
326
+ role_arn: Optional[pulumi.Input[str]] = None,
259
327
  secret_key: Optional[pulumi.Input[str]] = None,
260
328
  sts_endpoint: Optional[pulumi.Input[str]] = None,
261
329
  username_template: Optional[pulumi.Input[str]] = None):
@@ -269,6 +337,9 @@ class _SecretBackendState:
269
337
  :param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
270
338
  See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
271
339
  :param pulumi.Input[str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
340
+ :param pulumi.Input[str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
341
+ :param pulumi.Input[str] identity_token_key: The key to use for signing identity tokens. Requires Vault 1.16+.
342
+ :param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
272
343
  :param pulumi.Input[bool] local: Specifies whether the secrets mount will be marked as local. Local mounts are not replicated to performance replicas.
273
344
  :param pulumi.Input[int] max_lease_ttl_seconds: The maximum TTL that can be requested
274
345
  for credentials issued by this backend.
@@ -279,6 +350,7 @@ class _SecretBackendState:
279
350
  :param pulumi.Input[str] path: The unique path this backend should be mounted at. Must
280
351
  not begin or end with a `/`. Defaults to `aws`.
281
352
  :param pulumi.Input[str] region: The AWS region to make API calls against. Defaults to us-east-1.
353
+ :param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
282
354
  :param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
283
355
  :param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
284
356
  :param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
@@ -293,6 +365,12 @@ class _SecretBackendState:
293
365
  pulumi.set(__self__, "disable_remount", disable_remount)
294
366
  if iam_endpoint is not None:
295
367
  pulumi.set(__self__, "iam_endpoint", iam_endpoint)
368
+ if identity_token_audience is not None:
369
+ pulumi.set(__self__, "identity_token_audience", identity_token_audience)
370
+ if identity_token_key is not None:
371
+ pulumi.set(__self__, "identity_token_key", identity_token_key)
372
+ if identity_token_ttl is not None:
373
+ pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
296
374
  if local is not None:
297
375
  pulumi.set(__self__, "local", local)
298
376
  if max_lease_ttl_seconds is not None:
@@ -303,6 +381,8 @@ class _SecretBackendState:
303
381
  pulumi.set(__self__, "path", path)
304
382
  if region is not None:
305
383
  pulumi.set(__self__, "region", region)
384
+ if role_arn is not None:
385
+ pulumi.set(__self__, "role_arn", role_arn)
306
386
  if secret_key is not None:
307
387
  pulumi.set(__self__, "secret_key", secret_key)
308
388
  if sts_endpoint is not None:
@@ -373,6 +453,42 @@ class _SecretBackendState:
373
453
  def iam_endpoint(self, value: Optional[pulumi.Input[str]]):
374
454
  pulumi.set(self, "iam_endpoint", value)
375
455
 
456
+ @property
457
+ @pulumi.getter(name="identityTokenAudience")
458
+ def identity_token_audience(self) -> Optional[pulumi.Input[str]]:
459
+ """
460
+ The audience claim value. Requires Vault 1.16+.
461
+ """
462
+ return pulumi.get(self, "identity_token_audience")
463
+
464
+ @identity_token_audience.setter
465
+ def identity_token_audience(self, value: Optional[pulumi.Input[str]]):
466
+ pulumi.set(self, "identity_token_audience", value)
467
+
468
+ @property
469
+ @pulumi.getter(name="identityTokenKey")
470
+ def identity_token_key(self) -> Optional[pulumi.Input[str]]:
471
+ """
472
+ The key to use for signing identity tokens. Requires Vault 1.16+.
473
+ """
474
+ return pulumi.get(self, "identity_token_key")
475
+
476
+ @identity_token_key.setter
477
+ def identity_token_key(self, value: Optional[pulumi.Input[str]]):
478
+ pulumi.set(self, "identity_token_key", value)
479
+
480
+ @property
481
+ @pulumi.getter(name="identityTokenTtl")
482
+ def identity_token_ttl(self) -> Optional[pulumi.Input[int]]:
483
+ """
484
+ The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
485
+ """
486
+ return pulumi.get(self, "identity_token_ttl")
487
+
488
+ @identity_token_ttl.setter
489
+ def identity_token_ttl(self, value: Optional[pulumi.Input[int]]):
490
+ pulumi.set(self, "identity_token_ttl", value)
491
+
376
492
  @property
377
493
  @pulumi.getter
378
494
  def local(self) -> Optional[pulumi.Input[bool]]:
@@ -438,6 +554,18 @@ class _SecretBackendState:
438
554
  def region(self, value: Optional[pulumi.Input[str]]):
439
555
  pulumi.set(self, "region", value)
440
556
 
557
+ @property
558
+ @pulumi.getter(name="roleArn")
559
+ def role_arn(self) -> Optional[pulumi.Input[str]]:
560
+ """
561
+ Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
562
+ """
563
+ return pulumi.get(self, "role_arn")
564
+
565
+ @role_arn.setter
566
+ def role_arn(self, value: Optional[pulumi.Input[str]]):
567
+ pulumi.set(self, "role_arn", value)
568
+
441
569
  @property
442
570
  @pulumi.getter(name="secretKey")
443
571
  def secret_key(self) -> Optional[pulumi.Input[str]]:
@@ -485,11 +613,15 @@ class SecretBackend(pulumi.CustomResource):
485
613
  description: Optional[pulumi.Input[str]] = None,
486
614
  disable_remount: Optional[pulumi.Input[bool]] = None,
487
615
  iam_endpoint: Optional[pulumi.Input[str]] = None,
616
+ identity_token_audience: Optional[pulumi.Input[str]] = None,
617
+ identity_token_key: Optional[pulumi.Input[str]] = None,
618
+ identity_token_ttl: Optional[pulumi.Input[int]] = None,
488
619
  local: Optional[pulumi.Input[bool]] = None,
489
620
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
490
621
  namespace: Optional[pulumi.Input[str]] = None,
491
622
  path: Optional[pulumi.Input[str]] = None,
492
623
  region: Optional[pulumi.Input[str]] = None,
624
+ role_arn: Optional[pulumi.Input[str]] = None,
493
625
  secret_key: Optional[pulumi.Input[str]] = None,
494
626
  sts_endpoint: Optional[pulumi.Input[str]] = None,
495
627
  username_template: Optional[pulumi.Input[str]] = None,
@@ -513,6 +645,9 @@ class SecretBackend(pulumi.CustomResource):
513
645
  :param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
514
646
  See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
515
647
  :param pulumi.Input[str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
648
+ :param pulumi.Input[str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
649
+ :param pulumi.Input[str] identity_token_key: The key to use for signing identity tokens. Requires Vault 1.16+.
650
+ :param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
516
651
  :param pulumi.Input[bool] local: Specifies whether the secrets mount will be marked as local. Local mounts are not replicated to performance replicas.
517
652
  :param pulumi.Input[int] max_lease_ttl_seconds: The maximum TTL that can be requested
518
653
  for credentials issued by this backend.
@@ -523,6 +658,7 @@ class SecretBackend(pulumi.CustomResource):
523
658
  :param pulumi.Input[str] path: The unique path this backend should be mounted at. Must
524
659
  not begin or end with a `/`. Defaults to `aws`.
525
660
  :param pulumi.Input[str] region: The AWS region to make API calls against. Defaults to us-east-1.
661
+ :param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
526
662
  :param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
527
663
  :param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
528
664
  :param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
@@ -562,11 +698,15 @@ class SecretBackend(pulumi.CustomResource):
562
698
  description: Optional[pulumi.Input[str]] = None,
563
699
  disable_remount: Optional[pulumi.Input[bool]] = None,
564
700
  iam_endpoint: Optional[pulumi.Input[str]] = None,
701
+ identity_token_audience: Optional[pulumi.Input[str]] = None,
702
+ identity_token_key: Optional[pulumi.Input[str]] = None,
703
+ identity_token_ttl: Optional[pulumi.Input[int]] = None,
565
704
  local: Optional[pulumi.Input[bool]] = None,
566
705
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
567
706
  namespace: Optional[pulumi.Input[str]] = None,
568
707
  path: Optional[pulumi.Input[str]] = None,
569
708
  region: Optional[pulumi.Input[str]] = None,
709
+ role_arn: Optional[pulumi.Input[str]] = None,
570
710
  secret_key: Optional[pulumi.Input[str]] = None,
571
711
  sts_endpoint: Optional[pulumi.Input[str]] = None,
572
712
  username_template: Optional[pulumi.Input[str]] = None,
@@ -584,11 +724,15 @@ class SecretBackend(pulumi.CustomResource):
584
724
  __props__.__dict__["description"] = description
585
725
  __props__.__dict__["disable_remount"] = disable_remount
586
726
  __props__.__dict__["iam_endpoint"] = iam_endpoint
727
+ __props__.__dict__["identity_token_audience"] = identity_token_audience
728
+ __props__.__dict__["identity_token_key"] = identity_token_key
729
+ __props__.__dict__["identity_token_ttl"] = identity_token_ttl
587
730
  __props__.__dict__["local"] = local
588
731
  __props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
589
732
  __props__.__dict__["namespace"] = namespace
590
733
  __props__.__dict__["path"] = path
591
734
  __props__.__dict__["region"] = region
735
+ __props__.__dict__["role_arn"] = role_arn
592
736
  __props__.__dict__["secret_key"] = None if secret_key is None else pulumi.Output.secret(secret_key)
593
737
  __props__.__dict__["sts_endpoint"] = sts_endpoint
594
738
  __props__.__dict__["username_template"] = username_template
@@ -609,11 +753,15 @@ class SecretBackend(pulumi.CustomResource):
609
753
  description: Optional[pulumi.Input[str]] = None,
610
754
  disable_remount: Optional[pulumi.Input[bool]] = None,
611
755
  iam_endpoint: Optional[pulumi.Input[str]] = None,
756
+ identity_token_audience: Optional[pulumi.Input[str]] = None,
757
+ identity_token_key: Optional[pulumi.Input[str]] = None,
758
+ identity_token_ttl: Optional[pulumi.Input[int]] = None,
612
759
  local: Optional[pulumi.Input[bool]] = None,
613
760
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
614
761
  namespace: Optional[pulumi.Input[str]] = None,
615
762
  path: Optional[pulumi.Input[str]] = None,
616
763
  region: Optional[pulumi.Input[str]] = None,
764
+ role_arn: Optional[pulumi.Input[str]] = None,
617
765
  secret_key: Optional[pulumi.Input[str]] = None,
618
766
  sts_endpoint: Optional[pulumi.Input[str]] = None,
619
767
  username_template: Optional[pulumi.Input[str]] = None) -> 'SecretBackend':
@@ -632,6 +780,9 @@ class SecretBackend(pulumi.CustomResource):
632
780
  :param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
633
781
  See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
634
782
  :param pulumi.Input[str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
783
+ :param pulumi.Input[str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
784
+ :param pulumi.Input[str] identity_token_key: The key to use for signing identity tokens. Requires Vault 1.16+.
785
+ :param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
635
786
  :param pulumi.Input[bool] local: Specifies whether the secrets mount will be marked as local. Local mounts are not replicated to performance replicas.
636
787
  :param pulumi.Input[int] max_lease_ttl_seconds: The maximum TTL that can be requested
637
788
  for credentials issued by this backend.
@@ -642,6 +793,7 @@ class SecretBackend(pulumi.CustomResource):
642
793
  :param pulumi.Input[str] path: The unique path this backend should be mounted at. Must
643
794
  not begin or end with a `/`. Defaults to `aws`.
644
795
  :param pulumi.Input[str] region: The AWS region to make API calls against. Defaults to us-east-1.
796
+ :param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
645
797
  :param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
646
798
  :param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
647
799
  :param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
@@ -655,11 +807,15 @@ class SecretBackend(pulumi.CustomResource):
655
807
  __props__.__dict__["description"] = description
656
808
  __props__.__dict__["disable_remount"] = disable_remount
657
809
  __props__.__dict__["iam_endpoint"] = iam_endpoint
810
+ __props__.__dict__["identity_token_audience"] = identity_token_audience
811
+ __props__.__dict__["identity_token_key"] = identity_token_key
812
+ __props__.__dict__["identity_token_ttl"] = identity_token_ttl
658
813
  __props__.__dict__["local"] = local
659
814
  __props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
660
815
  __props__.__dict__["namespace"] = namespace
661
816
  __props__.__dict__["path"] = path
662
817
  __props__.__dict__["region"] = region
818
+ __props__.__dict__["role_arn"] = role_arn
663
819
  __props__.__dict__["secret_key"] = secret_key
664
820
  __props__.__dict__["sts_endpoint"] = sts_endpoint
665
821
  __props__.__dict__["username_template"] = username_template
@@ -708,6 +864,30 @@ class SecretBackend(pulumi.CustomResource):
708
864
  """
709
865
  return pulumi.get(self, "iam_endpoint")
710
866
 
867
+ @property
868
+ @pulumi.getter(name="identityTokenAudience")
869
+ def identity_token_audience(self) -> pulumi.Output[Optional[str]]:
870
+ """
871
+ The audience claim value. Requires Vault 1.16+.
872
+ """
873
+ return pulumi.get(self, "identity_token_audience")
874
+
875
+ @property
876
+ @pulumi.getter(name="identityTokenKey")
877
+ def identity_token_key(self) -> pulumi.Output[Optional[str]]:
878
+ """
879
+ The key to use for signing identity tokens. Requires Vault 1.16+.
880
+ """
881
+ return pulumi.get(self, "identity_token_key")
882
+
883
+ @property
884
+ @pulumi.getter(name="identityTokenTtl")
885
+ def identity_token_ttl(self) -> pulumi.Output[int]:
886
+ """
887
+ The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
888
+ """
889
+ return pulumi.get(self, "identity_token_ttl")
890
+
711
891
  @property
712
892
  @pulumi.getter
713
893
  def local(self) -> pulumi.Output[Optional[bool]]:
@@ -753,6 +933,14 @@ class SecretBackend(pulumi.CustomResource):
753
933
  """
754
934
  return pulumi.get(self, "region")
755
935
 
936
+ @property
937
+ @pulumi.getter(name="roleArn")
938
+ def role_arn(self) -> pulumi.Output[Optional[str]]:
939
+ """
940
+ Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
941
+ """
942
+ return pulumi.get(self, "role_arn")
943
+
756
944
  @property
757
945
  @pulumi.getter(name="secretKey")
758
946
  def secret_key(self) -> pulumi.Output[Optional[str]]:
pulumi_vault/aws/secret_backend_static_role.py CHANGED
@@ -234,7 +234,7 @@ class SecretBackendStaticRole(pulumi.CustomResource):
234
234
 
235
235
  ## Import
236
236
 
237
- AWS secret backend static role can be imported using the full path to the role of the form`<mount_path>/static-roles/<role_name>` e.g.
237
+ AWS secret backend static role can be imported using the full path to the role of the form: `<mount_path>/static-roles/<role_name>` e.g.
238
238
 
239
239
  ```sh
240
240
  $ pulumi import vault:aws/secretBackendStaticRole:SecretBackendStaticRole role aws/static-roles/example-role
@@ -277,7 +277,7 @@ class SecretBackendStaticRole(pulumi.CustomResource):
277
277
 
278
278
  ## Import
279
279
 
280
- AWS secret backend static role can be imported using the full path to the role of the form`<mount_path>/static-roles/<role_name>` e.g.
280
+ AWS secret backend static role can be imported using the full path to the role of the form: `<mount_path>/static-roles/<role_name>` e.g.
281
281
 
282
282
  ```sh
283
283
  $ pulumi import vault:aws/secretBackendStaticRole:SecretBackendStaticRole role aws/static-roles/example-role
pulumi_vault/azure/backend.py CHANGED
@@ -39,9 +39,7 @@ class BackendArgs:
39
39
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
40
40
  *Available only for Vault Enterprise*.
41
41
  :param pulumi.Input[str] path: The unique path this backend should be mounted at. Defaults to `azure`.
42
- :param pulumi.Input[bool] use_microsoft_graph_api: Indicates whether the secrets engine should use
43
- the Microsoft Graph API. This parameter has been deprecated and will be ignored in `vault-1.12+`.
44
- For more information, please refer to the [Vault docs](https://developer.hashicorp.com/vault/api-docs/secret/azure#use_microsoft_graph_api)
42
+ :param pulumi.Input[bool] use_microsoft_graph_api: Use the Microsoft Graph API. Should be set to true on vault-1.10+
45
43
  """
46
44
  pulumi.set(__self__, "subscription_id", subscription_id)
47
45
  pulumi.set(__self__, "tenant_id", tenant_id)
@@ -178,9 +176,7 @@ class BackendArgs:
178
176
  @pulumi.getter(name="useMicrosoftGraphApi")
179
177
  def use_microsoft_graph_api(self) -> Optional[pulumi.Input[bool]]:
180
178
  """
181
- Indicates whether the secrets engine should use
182
- the Microsoft Graph API. This parameter has been deprecated and will be ignored in `vault-1.12+`.
183
- For more information, please refer to the [Vault docs](https://developer.hashicorp.com/vault/api-docs/secret/azure#use_microsoft_graph_api)
179
+ Use the Microsoft Graph API. Should be set to true on vault-1.10+
184
180
  """
185
181
  return pulumi.get(self, "use_microsoft_graph_api")
186
182
 
@@ -217,9 +213,7 @@ class _BackendState:
217
213
  :param pulumi.Input[str] path: The unique path this backend should be mounted at. Defaults to `azure`.
218
214
  :param pulumi.Input[str] subscription_id: The subscription id for the Azure Active Directory.
219
215
  :param pulumi.Input[str] tenant_id: The tenant id for the Azure Active Directory.
220
- :param pulumi.Input[bool] use_microsoft_graph_api: Indicates whether the secrets engine should use
221
- the Microsoft Graph API. This parameter has been deprecated and will be ignored in `vault-1.12+`.
222
- For more information, please refer to the [Vault docs](https://developer.hashicorp.com/vault/api-docs/secret/azure#use_microsoft_graph_api)
216
+ :param pulumi.Input[bool] use_microsoft_graph_api: Use the Microsoft Graph API. Should be set to true on vault-1.10+
223
217
  """
224
218
  if client_id is not None:
225
219
  pulumi.set(__self__, "client_id", client_id)
@@ -358,9 +352,7 @@ class _BackendState:
358
352
  @pulumi.getter(name="useMicrosoftGraphApi")
359
353
  def use_microsoft_graph_api(self) -> Optional[pulumi.Input[bool]]:
360
354
  """
361
- Indicates whether the secrets engine should use
362
- the Microsoft Graph API. This parameter has been deprecated and will be ignored in `vault-1.12+`.
363
- For more information, please refer to the [Vault docs](https://developer.hashicorp.com/vault/api-docs/secret/azure#use_microsoft_graph_api)
355
+ Use the Microsoft Graph API. Should be set to true on vault-1.10+
364
356
  """
365
357
  return pulumi.get(self, "use_microsoft_graph_api")
366
358
 
@@ -431,9 +423,7 @@ class Backend(pulumi.CustomResource):
431
423
  :param pulumi.Input[str] path: The unique path this backend should be mounted at. Defaults to `azure`.
432
424
  :param pulumi.Input[str] subscription_id: The subscription id for the Azure Active Directory.
433
425
  :param pulumi.Input[str] tenant_id: The tenant id for the Azure Active Directory.
434
- :param pulumi.Input[bool] use_microsoft_graph_api: Indicates whether the secrets engine should use
435
- the Microsoft Graph API. This parameter has been deprecated and will be ignored in `vault-1.12+`.
436
- For more information, please refer to the [Vault docs](https://developer.hashicorp.com/vault/api-docs/secret/azure#use_microsoft_graph_api)
426
+ :param pulumi.Input[bool] use_microsoft_graph_api: Use the Microsoft Graph API. Should be set to true on vault-1.10+
437
427
  """
438
428
  ...
439
429
  @overload
@@ -562,9 +552,7 @@ class Backend(pulumi.CustomResource):
562
552
  :param pulumi.Input[str] path: The unique path this backend should be mounted at. Defaults to `azure`.
563
553
  :param pulumi.Input[str] subscription_id: The subscription id for the Azure Active Directory.
564
554
  :param pulumi.Input[str] tenant_id: The tenant id for the Azure Active Directory.
565
- :param pulumi.Input[bool] use_microsoft_graph_api: Indicates whether the secrets engine should use
566
- the Microsoft Graph API. This parameter has been deprecated and will be ignored in `vault-1.12+`.
567
- For more information, please refer to the [Vault docs](https://developer.hashicorp.com/vault/api-docs/secret/azure#use_microsoft_graph_api)
555
+ :param pulumi.Input[bool] use_microsoft_graph_api: Use the Microsoft Graph API. Should be set to true on vault-1.10+
568
556
  """
569
557
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
570
558
 
@@ -662,9 +650,7 @@ class Backend(pulumi.CustomResource):
662
650
  @pulumi.getter(name="useMicrosoftGraphApi")
663
651
  def use_microsoft_graph_api(self) -> pulumi.Output[bool]:
664
652
  """
665
- Indicates whether the secrets engine should use
666
- the Microsoft Graph API. This parameter has been deprecated and will be ignored in `vault-1.12+`.
667
- For more information, please refer to the [Vault docs](https://developer.hashicorp.com/vault/api-docs/secret/azure#use_microsoft_graph_api)
653
+ Use the Microsoft Graph API. Should be set to true on vault-1.10+
668
654
  """
669
655
  return pulumi.get(self, "use_microsoft_graph_api")
670
656
 
pulumi_vault/config/__init__.pyi CHANGED
@@ -11,9 +11,6 @@ from .. import _utilities
11
11
  from . import outputs
12
12
 
13
13
  addAddressToEnv: Optional[str]
14
- """
15
- If true, adds the value of the `address` argument to the Terraform process environment.
16
- """
17
14
 
18
15
  address: Optional[str]
19
16
  """