pulumi-vault 6.1.0a1712233015__py3-none-any.whl → 6.1.1a1717550614__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (184) hide show
  1. pulumi_vault/_inputs.py +0 -20
  2. pulumi_vault/ad/secret_backend.py +2 -6
  3. pulumi_vault/ad/secret_library.py +2 -4
  4. pulumi_vault/ad/secret_role.py +0 -4
  5. pulumi_vault/alicloud/auth_backend_role.py +69 -192
  6. pulumi_vault/approle/auth_backend_login.py +0 -4
  7. pulumi_vault/approle/auth_backend_role.py +63 -186
  8. pulumi_vault/approle/auth_backend_role_secret_id.py +0 -4
  9. pulumi_vault/approle/get_auth_backend_role_id.py +0 -4
  10. pulumi_vault/audit.py +12 -20
  11. pulumi_vault/audit_request_header.py +6 -6
  12. pulumi_vault/aws/auth_backend_client.py +6 -10
  13. pulumi_vault/aws/auth_backend_config_identity.py +0 -4
  14. pulumi_vault/aws/auth_backend_identity_whitelist.py +6 -10
  15. pulumi_vault/aws/auth_backend_login.py +0 -8
  16. pulumi_vault/aws/auth_backend_role.py +63 -186
  17. pulumi_vault/aws/auth_backend_roletag_blacklist.py +6 -10
  18. pulumi_vault/aws/auth_backend_sts_role.py +0 -4
  19. pulumi_vault/aws/secret_backend.py +63 -0
  20. pulumi_vault/aws/secret_backend_role.py +2 -4
  21. pulumi_vault/aws/secret_backend_static_role.py +2 -4
  22. pulumi_vault/azure/auth_backend_config.py +6 -10
  23. pulumi_vault/azure/auth_backend_role.py +63 -186
  24. pulumi_vault/azure/backend.py +16 -24
  25. pulumi_vault/azure/backend_role.py +14 -18
  26. pulumi_vault/azure/get_access_credentials.py +0 -4
  27. pulumi_vault/cert_auth_backend_role.py +75 -208
  28. pulumi_vault/consul/secret_backend.py +10 -18
  29. pulumi_vault/consul/secret_backend_role.py +2 -4
  30. pulumi_vault/database/_inputs.py +522 -784
  31. pulumi_vault/database/outputs.py +522 -784
  32. pulumi_vault/database/secret_backend_connection.py +2 -4
  33. pulumi_vault/database/secret_backend_role.py +4 -4
  34. pulumi_vault/database/secret_backend_static_role.py +10 -8
  35. pulumi_vault/database/secrets_mount.py +4 -4
  36. pulumi_vault/egp_policy.py +4 -8
  37. pulumi_vault/gcp/auth_backend.py +0 -36
  38. pulumi_vault/gcp/auth_backend_role.py +63 -264
  39. pulumi_vault/gcp/get_auth_backend_role.py +0 -4
  40. pulumi_vault/gcp/secret_backend.py +4 -6
  41. pulumi_vault/gcp/secret_impersonated_account.py +12 -14
  42. pulumi_vault/gcp/secret_roleset.py +4 -6
  43. pulumi_vault/gcp/secret_static_account.py +14 -16
  44. pulumi_vault/generic/endpoint.py +4 -8
  45. pulumi_vault/generic/get_secret.py +40 -4
  46. pulumi_vault/get_auth_backend.py +0 -4
  47. pulumi_vault/get_auth_backends.py +0 -8
  48. pulumi_vault/get_namespace.py +0 -12
  49. pulumi_vault/get_namespaces.py +4 -12
  50. pulumi_vault/get_nomad_access_token.py +0 -4
  51. pulumi_vault/get_policy_document.py +8 -8
  52. pulumi_vault/get_raft_autopilot_state.py +0 -4
  53. pulumi_vault/github/auth_backend.py +0 -4
  54. pulumi_vault/github/team.py +2 -6
  55. pulumi_vault/github/user.py +2 -6
  56. pulumi_vault/identity/entity.py +6 -8
  57. pulumi_vault/identity/entity_alias.py +6 -8
  58. pulumi_vault/identity/entity_policies.py +12 -12
  59. pulumi_vault/identity/get_entity.py +0 -4
  60. pulumi_vault/identity/get_group.py +0 -4
  61. pulumi_vault/identity/get_oidc_client_creds.py +2 -4
  62. pulumi_vault/identity/get_oidc_openid_config.py +10 -6
  63. pulumi_vault/identity/get_oidc_public_keys.py +10 -6
  64. pulumi_vault/identity/group.py +38 -42
  65. pulumi_vault/identity/group_alias.py +2 -4
  66. pulumi_vault/identity/group_member_entity_ids.py +12 -16
  67. pulumi_vault/identity/group_member_group_ids.py +24 -20
  68. pulumi_vault/identity/group_policies.py +4 -8
  69. pulumi_vault/identity/mfa_duo.py +4 -8
  70. pulumi_vault/identity/mfa_login_enforcement.py +8 -8
  71. pulumi_vault/identity/mfa_okta.py +4 -8
  72. pulumi_vault/identity/mfa_pingid.py +0 -4
  73. pulumi_vault/identity/mfa_totp.py +0 -4
  74. pulumi_vault/identity/oidc.py +0 -4
  75. pulumi_vault/identity/oidc_assignment.py +10 -6
  76. pulumi_vault/identity/oidc_client.py +10 -10
  77. pulumi_vault/identity/oidc_key.py +16 -12
  78. pulumi_vault/identity/oidc_key_allowed_client_id.py +16 -12
  79. pulumi_vault/identity/oidc_provider.py +22 -16
  80. pulumi_vault/identity/oidc_role.py +28 -20
  81. pulumi_vault/identity/oidc_scope.py +6 -8
  82. pulumi_vault/jwt/auth_backend.py +20 -32
  83. pulumi_vault/jwt/auth_backend_role.py +63 -190
  84. pulumi_vault/kmip/secret_backend.py +10 -14
  85. pulumi_vault/kmip/secret_role.py +0 -4
  86. pulumi_vault/kmip/secret_scope.py +0 -4
  87. pulumi_vault/kubernetes/auth_backend_config.py +0 -4
  88. pulumi_vault/kubernetes/auth_backend_role.py +56 -172
  89. pulumi_vault/kubernetes/get_service_account_token.py +8 -8
  90. pulumi_vault/kubernetes/secret_backend.py +6 -8
  91. pulumi_vault/kubernetes/secret_backend_role.py +24 -24
  92. pulumi_vault/kv/get_secret.py +0 -4
  93. pulumi_vault/kv/get_secret_subkeys_v2.py +4 -6
  94. pulumi_vault/kv/get_secret_v2.py +58 -0
  95. pulumi_vault/kv/get_secrets_list.py +4 -8
  96. pulumi_vault/kv/get_secrets_list_v2.py +14 -12
  97. pulumi_vault/kv/secret.py +0 -4
  98. pulumi_vault/kv/secret_backend_v2.py +0 -4
  99. pulumi_vault/kv/secret_v2.py +2 -4
  100. pulumi_vault/ldap/auth_backend.py +66 -161
  101. pulumi_vault/ldap/auth_backend_group.py +0 -4
  102. pulumi_vault/ldap/auth_backend_user.py +0 -4
  103. pulumi_vault/ldap/secret_backend.py +4 -8
  104. pulumi_vault/ldap/secret_backend_dynamic_role.py +0 -4
  105. pulumi_vault/ldap/secret_backend_library_set.py +2 -4
  106. pulumi_vault/ldap/secret_backend_static_role.py +0 -4
  107. pulumi_vault/managed/_inputs.py +84 -132
  108. pulumi_vault/managed/keys.py +7 -28
  109. pulumi_vault/managed/outputs.py +84 -132
  110. pulumi_vault/mfa_duo.py +4 -6
  111. pulumi_vault/mfa_okta.py +4 -6
  112. pulumi_vault/mfa_pingid.py +4 -6
  113. pulumi_vault/mfa_totp.py +10 -12
  114. pulumi_vault/mongodbatlas/secret_backend.py +0 -4
  115. pulumi_vault/mongodbatlas/secret_role.py +2 -4
  116. pulumi_vault/mount.py +26 -42
  117. pulumi_vault/nomad_secret_backend.py +4 -8
  118. pulumi_vault/nomad_secret_role.py +0 -4
  119. pulumi_vault/okta/_inputs.py +8 -8
  120. pulumi_vault/okta/auth_backend.py +6 -10
  121. pulumi_vault/okta/auth_backend_group.py +0 -4
  122. pulumi_vault/okta/auth_backend_user.py +0 -4
  123. pulumi_vault/okta/outputs.py +8 -8
  124. pulumi_vault/outputs.py +0 -20
  125. pulumi_vault/password_policy.py +6 -8
  126. pulumi_vault/pkisecret/backend_config_cluster.py +0 -4
  127. pulumi_vault/pkisecret/get_backend_issuer.py +36 -0
  128. pulumi_vault/pkisecret/get_backend_issuers.py +0 -4
  129. pulumi_vault/pkisecret/get_backend_key.py +2 -6
  130. pulumi_vault/pkisecret/get_backend_keys.py +0 -4
  131. pulumi_vault/pkisecret/secret_backend_cert.py +6 -8
  132. pulumi_vault/pkisecret/secret_backend_config_ca.py +4 -8
  133. pulumi_vault/pkisecret/secret_backend_config_issuers.py +0 -4
  134. pulumi_vault/pkisecret/secret_backend_config_urls.py +0 -4
  135. pulumi_vault/pkisecret/secret_backend_crl_config.py +2 -6
  136. pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +4 -8
  137. pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +10 -14
  138. pulumi_vault/pkisecret/secret_backend_issuer.py +0 -4
  139. pulumi_vault/pkisecret/secret_backend_role.py +2 -4
  140. pulumi_vault/pkisecret/secret_backend_root_cert.py +4 -8
  141. pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +6 -10
  142. pulumi_vault/pkisecret/secret_backend_sign.py +6 -8
  143. pulumi_vault/provider.py +0 -8
  144. pulumi_vault/pulumi-plugin.json +2 -1
  145. pulumi_vault/quota_lease_count.py +6 -8
  146. pulumi_vault/quota_rate_limit.py +2 -4
  147. pulumi_vault/rabbitmq/secret_backend.py +4 -8
  148. pulumi_vault/rabbitmq/secret_backend_role.py +2 -4
  149. pulumi_vault/raft_autopilot.py +0 -4
  150. pulumi_vault/raft_snapshot_agent_config.py +109 -304
  151. pulumi_vault/rgp_policy.py +2 -6
  152. pulumi_vault/saml/auth_backend.py +8 -12
  153. pulumi_vault/saml/auth_backend_role.py +64 -178
  154. pulumi_vault/secrets/sync_association.py +12 -10
  155. pulumi_vault/secrets/sync_aws_destination.py +6 -8
  156. pulumi_vault/secrets/sync_azure_destination.py +10 -12
  157. pulumi_vault/secrets/sync_config.py +2 -6
  158. pulumi_vault/secrets/sync_gcp_destination.py +6 -6
  159. pulumi_vault/secrets/sync_gh_destination.py +6 -8
  160. pulumi_vault/secrets/sync_github_apps.py +8 -8
  161. pulumi_vault/secrets/sync_vercel_destination.py +6 -8
  162. pulumi_vault/ssh/_inputs.py +6 -32
  163. pulumi_vault/ssh/outputs.py +6 -32
  164. pulumi_vault/ssh/secret_backend_ca.py +0 -4
  165. pulumi_vault/ssh/secret_backend_role.py +4 -4
  166. pulumi_vault/terraformcloud/secret_backend.py +0 -56
  167. pulumi_vault/terraformcloud/secret_creds.py +2 -17
  168. pulumi_vault/terraformcloud/secret_role.py +2 -69
  169. pulumi_vault/token.py +14 -18
  170. pulumi_vault/tokenauth/auth_backend_role.py +64 -180
  171. pulumi_vault/transform/alphabet.py +4 -6
  172. pulumi_vault/transform/get_decode.py +4 -4
  173. pulumi_vault/transform/get_encode.py +4 -4
  174. pulumi_vault/transform/role.py +4 -6
  175. pulumi_vault/transform/template.py +4 -4
  176. pulumi_vault/transit/get_decrypt.py +4 -20
  177. pulumi_vault/transit/get_encrypt.py +0 -14
  178. pulumi_vault/transit/secret_backend_key.py +6 -6
  179. pulumi_vault/transit/secret_cache_config.py +0 -4
  180. {pulumi_vault-6.1.0a1712233015.dist-info → pulumi_vault-6.1.1a1717550614.dist-info}/METADATA +1 -1
  181. pulumi_vault-6.1.1a1717550614.dist-info/RECORD +252 -0
  182. pulumi_vault-6.1.0a1712233015.dist-info/RECORD +0 -252
  183. {pulumi_vault-6.1.0a1712233015.dist-info → pulumi_vault-6.1.1a1717550614.dist-info}/WHEEL +0 -0
  184. {pulumi_vault-6.1.0a1712233015.dist-info → pulumi_vault-6.1.1a1717550614.dist-info}/top_level.txt +0 -0
pulumi_vault/gcp/auth_backend_role.py CHANGED
@@ -40,45 +40,22 @@ class AuthBackendRoleArgs:
40
40
  The set of arguments for constructing a AuthBackendRole resource.
41
41
  :param pulumi.Input[str] role: Name of the GCP role
42
42
  :param pulumi.Input[str] type: Type of GCP authentication role (either `gce` or `iam`)
43
- :param pulumi.Input[bool] allow_gce_inference: A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
44
43
  :param pulumi.Input[str] backend: Path to the mounted GCP auth backend
45
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_instance_groups: The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
46
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_labels: A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
47
44
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_projects: An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.
48
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_regions: The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
49
45
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_service_accounts: GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is `iam`)
50
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_zones: The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
51
- :param pulumi.Input[str] max_jwt_exp: The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
52
46
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
53
47
  The value should not contain leading or trailing forward slashes.
54
48
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
55
49
  *Available only for Vault Enterprise*.
56
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: List of CIDR blocks; if set, specifies blocks of IP
57
- addresses which can authenticate successfully, and ties the resulting token to these blocks
58
- as well.
59
- :param pulumi.Input[int] token_explicit_max_ttl: If set, will encode an
60
- [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
61
- onto the token in number of seconds. This is a hard cap even if `token_ttl` and
62
- `token_max_ttl` would otherwise allow a renewal.
63
- :param pulumi.Input[int] token_max_ttl: The maximum lifetime for generated tokens in number of seconds.
64
- Its current value will be referenced at renewal time.
65
- :param pulumi.Input[bool] token_no_default_policy: If set, the default policy will not be set on
66
- generated tokens; otherwise it will be added to the policies set in token_policies.
67
- :param pulumi.Input[int] token_num_uses: The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
68
- of times a generated token may be used (within its lifetime); 0 means unlimited.
69
- :param pulumi.Input[int] token_period: If set, indicates that the
70
- token generated using this role should never expire. The token should be renewed within the
71
- duration specified by this value. At each renewal, the token's TTL will be set to the
72
- value of this field. Specified in seconds.
73
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: List of policies to encode onto generated tokens. Depending
74
- on the auth method, this list may be supplemented by user/group/other values.
75
- :param pulumi.Input[int] token_ttl: The incremental lifetime for generated tokens in number of seconds.
76
- Its current value will be referenced at renewal time.
77
- :param pulumi.Input[str] token_type: The type of token that should be generated. Can be `service`,
78
- `batch`, or `default` to use the mount's tuned default (which unless changed will be
79
- `service` tokens). For token store roles, there are two additional possibilities:
80
- `default-service` and `default-batch` which specify the type to return unless the client
81
- requests a different type at generation time.
50
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
51
+ :param pulumi.Input[int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
52
+ :param pulumi.Input[int] token_max_ttl: The maximum lifetime of the generated token
53
+ :param pulumi.Input[bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
54
+ :param pulumi.Input[int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
55
+ :param pulumi.Input[int] token_period: Generated Token's Period
56
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: Generated Token's Policies
57
+ :param pulumi.Input[int] token_ttl: The initial ttl of the token to generate in seconds
58
+ :param pulumi.Input[str] token_type: The type of token to generate, service or batch
82
59
  """
83
60
  pulumi.set(__self__, "role", role)
84
61
  pulumi.set(__self__, "type", type)
@@ -159,9 +136,6 @@ class AuthBackendRoleArgs:
159
136
  @property
160
137
  @pulumi.getter(name="allowGceInference")
161
138
  def allow_gce_inference(self) -> Optional[pulumi.Input[bool]]:
162
- """
163
- A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
164
- """
165
139
  return pulumi.get(self, "allow_gce_inference")
166
140
 
167
141
  @allow_gce_inference.setter
@@ -183,9 +157,6 @@ class AuthBackendRoleArgs:
183
157
  @property
184
158
  @pulumi.getter(name="boundInstanceGroups")
185
159
  def bound_instance_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
186
- """
187
- The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
188
- """
189
160
  return pulumi.get(self, "bound_instance_groups")
190
161
 
191
162
  @bound_instance_groups.setter
@@ -195,9 +166,6 @@ class AuthBackendRoleArgs:
195
166
  @property
196
167
  @pulumi.getter(name="boundLabels")
197
168
  def bound_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
198
- """
199
- A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
200
- """
201
169
  return pulumi.get(self, "bound_labels")
202
170
 
203
171
  @bound_labels.setter
@@ -219,9 +187,6 @@ class AuthBackendRoleArgs:
219
187
  @property
220
188
  @pulumi.getter(name="boundRegions")
221
189
  def bound_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
222
- """
223
- The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
224
- """
225
190
  return pulumi.get(self, "bound_regions")
226
191
 
227
192
  @bound_regions.setter
@@ -243,9 +208,6 @@ class AuthBackendRoleArgs:
243
208
  @property
244
209
  @pulumi.getter(name="boundZones")
245
210
  def bound_zones(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
246
- """
247
- The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
248
- """
249
211
  return pulumi.get(self, "bound_zones")
250
212
 
251
213
  @bound_zones.setter
@@ -255,9 +217,6 @@ class AuthBackendRoleArgs:
255
217
  @property
256
218
  @pulumi.getter(name="maxJwtExp")
257
219
  def max_jwt_exp(self) -> Optional[pulumi.Input[str]]:
258
- """
259
- The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
260
- """
261
220
  return pulumi.get(self, "max_jwt_exp")
262
221
 
263
222
  @max_jwt_exp.setter
@@ -283,9 +242,7 @@ class AuthBackendRoleArgs:
283
242
  @pulumi.getter(name="tokenBoundCidrs")
284
243
  def token_bound_cidrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
285
244
  """
286
- List of CIDR blocks; if set, specifies blocks of IP
287
- addresses which can authenticate successfully, and ties the resulting token to these blocks
288
- as well.
245
+ Specifies the blocks of IP addresses which are allowed to use the generated token
289
246
  """
290
247
  return pulumi.get(self, "token_bound_cidrs")
291
248
 
@@ -297,10 +254,7 @@ class AuthBackendRoleArgs:
297
254
  @pulumi.getter(name="tokenExplicitMaxTtl")
298
255
  def token_explicit_max_ttl(self) -> Optional[pulumi.Input[int]]:
299
256
  """
300
- If set, will encode an
301
- [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
302
- onto the token in number of seconds. This is a hard cap even if `token_ttl` and
303
- `token_max_ttl` would otherwise allow a renewal.
257
+ Generated Token's Explicit Maximum TTL in seconds
304
258
  """
305
259
  return pulumi.get(self, "token_explicit_max_ttl")
306
260
 
@@ -312,8 +266,7 @@ class AuthBackendRoleArgs:
312
266
  @pulumi.getter(name="tokenMaxTtl")
313
267
  def token_max_ttl(self) -> Optional[pulumi.Input[int]]:
314
268
  """
315
- The maximum lifetime for generated tokens in number of seconds.
316
- Its current value will be referenced at renewal time.
269
+ The maximum lifetime of the generated token
317
270
  """
318
271
  return pulumi.get(self, "token_max_ttl")
319
272
 
@@ -325,8 +278,7 @@ class AuthBackendRoleArgs:
325
278
  @pulumi.getter(name="tokenNoDefaultPolicy")
326
279
  def token_no_default_policy(self) -> Optional[pulumi.Input[bool]]:
327
280
  """
328
- If set, the default policy will not be set on
329
- generated tokens; otherwise it will be added to the policies set in token_policies.
281
+ If true, the 'default' policy will not automatically be added to generated tokens
330
282
  """
331
283
  return pulumi.get(self, "token_no_default_policy")
332
284
 
@@ -338,8 +290,7 @@ class AuthBackendRoleArgs:
338
290
  @pulumi.getter(name="tokenNumUses")
339
291
  def token_num_uses(self) -> Optional[pulumi.Input[int]]:
340
292
  """
341
- The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
342
- of times a generated token may be used (within its lifetime); 0 means unlimited.
293
+ The maximum number of times a token may be used, a value of zero means unlimited
343
294
  """
344
295
  return pulumi.get(self, "token_num_uses")
345
296
 
@@ -351,10 +302,7 @@ class AuthBackendRoleArgs:
351
302
  @pulumi.getter(name="tokenPeriod")
352
303
  def token_period(self) -> Optional[pulumi.Input[int]]:
353
304
  """
354
- If set, indicates that the
355
- token generated using this role should never expire. The token should be renewed within the
356
- duration specified by this value. At each renewal, the token's TTL will be set to the
357
- value of this field. Specified in seconds.
305
+ Generated Token's Period
358
306
  """
359
307
  return pulumi.get(self, "token_period")
360
308
 
@@ -366,8 +314,7 @@ class AuthBackendRoleArgs:
366
314
  @pulumi.getter(name="tokenPolicies")
367
315
  def token_policies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
368
316
  """
369
- List of policies to encode onto generated tokens. Depending
370
- on the auth method, this list may be supplemented by user/group/other values.
317
+ Generated Token's Policies
371
318
  """
372
319
  return pulumi.get(self, "token_policies")
373
320
 
@@ -379,8 +326,7 @@ class AuthBackendRoleArgs:
379
326
  @pulumi.getter(name="tokenTtl")
380
327
  def token_ttl(self) -> Optional[pulumi.Input[int]]:
381
328
  """
382
- The incremental lifetime for generated tokens in number of seconds.
383
- Its current value will be referenced at renewal time.
329
+ The initial ttl of the token to generate in seconds
384
330
  """
385
331
  return pulumi.get(self, "token_ttl")
386
332
 
@@ -392,11 +338,7 @@ class AuthBackendRoleArgs:
392
338
  @pulumi.getter(name="tokenType")
393
339
  def token_type(self) -> Optional[pulumi.Input[str]]:
394
340
  """
395
- The type of token that should be generated. Can be `service`,
396
- `batch`, or `default` to use the mount's tuned default (which unless changed will be
397
- `service` tokens). For token store roles, there are two additional possibilities:
398
- `default-service` and `default-batch` which specify the type to return unless the client
399
- requests a different type at generation time.
341
+ The type of token to generate, service or batch
400
342
  """
401
343
  return pulumi.get(self, "token_type")
402
344
 
@@ -432,46 +374,23 @@ class _AuthBackendRoleState:
432
374
  type: Optional[pulumi.Input[str]] = None):
433
375
  """
434
376
  Input properties used for looking up and filtering AuthBackendRole resources.
435
- :param pulumi.Input[bool] allow_gce_inference: A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
436
377
  :param pulumi.Input[str] backend: Path to the mounted GCP auth backend
437
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_instance_groups: The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
438
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_labels: A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
439
378
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_projects: An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.
440
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_regions: The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
441
379
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_service_accounts: GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is `iam`)
442
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_zones: The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
443
- :param pulumi.Input[str] max_jwt_exp: The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
444
380
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
445
381
  The value should not contain leading or trailing forward slashes.
446
382
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
447
383
  *Available only for Vault Enterprise*.
448
384
  :param pulumi.Input[str] role: Name of the GCP role
449
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: List of CIDR blocks; if set, specifies blocks of IP
450
- addresses which can authenticate successfully, and ties the resulting token to these blocks
451
- as well.
452
- :param pulumi.Input[int] token_explicit_max_ttl: If set, will encode an
453
- [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
454
- onto the token in number of seconds. This is a hard cap even if `token_ttl` and
455
- `token_max_ttl` would otherwise allow a renewal.
456
- :param pulumi.Input[int] token_max_ttl: The maximum lifetime for generated tokens in number of seconds.
457
- Its current value will be referenced at renewal time.
458
- :param pulumi.Input[bool] token_no_default_policy: If set, the default policy will not be set on
459
- generated tokens; otherwise it will be added to the policies set in token_policies.
460
- :param pulumi.Input[int] token_num_uses: The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
461
- of times a generated token may be used (within its lifetime); 0 means unlimited.
462
- :param pulumi.Input[int] token_period: If set, indicates that the
463
- token generated using this role should never expire. The token should be renewed within the
464
- duration specified by this value. At each renewal, the token's TTL will be set to the
465
- value of this field. Specified in seconds.
466
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: List of policies to encode onto generated tokens. Depending
467
- on the auth method, this list may be supplemented by user/group/other values.
468
- :param pulumi.Input[int] token_ttl: The incremental lifetime for generated tokens in number of seconds.
469
- Its current value will be referenced at renewal time.
470
- :param pulumi.Input[str] token_type: The type of token that should be generated. Can be `service`,
471
- `batch`, or `default` to use the mount's tuned default (which unless changed will be
472
- `service` tokens). For token store roles, there are two additional possibilities:
473
- `default-service` and `default-batch` which specify the type to return unless the client
474
- requests a different type at generation time.
385
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
386
+ :param pulumi.Input[int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
387
+ :param pulumi.Input[int] token_max_ttl: The maximum lifetime of the generated token
388
+ :param pulumi.Input[bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
389
+ :param pulumi.Input[int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
390
+ :param pulumi.Input[int] token_period: Generated Token's Period
391
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: Generated Token's Policies
392
+ :param pulumi.Input[int] token_ttl: The initial ttl of the token to generate in seconds
393
+ :param pulumi.Input[str] token_type: The type of token to generate, service or batch
475
394
  :param pulumi.Input[str] type: Type of GCP authentication role (either `gce` or `iam`)
476
395
  """
477
396
  if add_group_aliases is not None:
@@ -531,9 +450,6 @@ class _AuthBackendRoleState:
531
450
  @property
532
451
  @pulumi.getter(name="allowGceInference")
533
452
  def allow_gce_inference(self) -> Optional[pulumi.Input[bool]]:
534
- """
535
- A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
536
- """
537
453
  return pulumi.get(self, "allow_gce_inference")
538
454
 
539
455
  @allow_gce_inference.setter
@@ -555,9 +471,6 @@ class _AuthBackendRoleState:
555
471
  @property
556
472
  @pulumi.getter(name="boundInstanceGroups")
557
473
  def bound_instance_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
558
- """
559
- The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
560
- """
561
474
  return pulumi.get(self, "bound_instance_groups")
562
475
 
563
476
  @bound_instance_groups.setter
@@ -567,9 +480,6 @@ class _AuthBackendRoleState:
567
480
  @property
568
481
  @pulumi.getter(name="boundLabels")
569
482
  def bound_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
570
- """
571
- A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
572
- """
573
483
  return pulumi.get(self, "bound_labels")
574
484
 
575
485
  @bound_labels.setter
@@ -591,9 +501,6 @@ class _AuthBackendRoleState:
591
501
  @property
592
502
  @pulumi.getter(name="boundRegions")
593
503
  def bound_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
594
- """
595
- The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
596
- """
597
504
  return pulumi.get(self, "bound_regions")
598
505
 
599
506
  @bound_regions.setter
@@ -615,9 +522,6 @@ class _AuthBackendRoleState:
615
522
  @property
616
523
  @pulumi.getter(name="boundZones")
617
524
  def bound_zones(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
618
- """
619
- The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
620
- """
621
525
  return pulumi.get(self, "bound_zones")
622
526
 
623
527
  @bound_zones.setter
@@ -627,9 +531,6 @@ class _AuthBackendRoleState:
627
531
  @property
628
532
  @pulumi.getter(name="maxJwtExp")
629
533
  def max_jwt_exp(self) -> Optional[pulumi.Input[str]]:
630
- """
631
- The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
632
- """
633
534
  return pulumi.get(self, "max_jwt_exp")
634
535
 
635
536
  @max_jwt_exp.setter
@@ -667,9 +568,7 @@ class _AuthBackendRoleState:
667
568
  @pulumi.getter(name="tokenBoundCidrs")
668
569
  def token_bound_cidrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
669
570
  """
670
- List of CIDR blocks; if set, specifies blocks of IP
671
- addresses which can authenticate successfully, and ties the resulting token to these blocks
672
- as well.
571
+ Specifies the blocks of IP addresses which are allowed to use the generated token
673
572
  """
674
573
  return pulumi.get(self, "token_bound_cidrs")
675
574
 
@@ -681,10 +580,7 @@ class _AuthBackendRoleState:
681
580
  @pulumi.getter(name="tokenExplicitMaxTtl")
682
581
  def token_explicit_max_ttl(self) -> Optional[pulumi.Input[int]]:
683
582
  """
684
- If set, will encode an
685
- [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
686
- onto the token in number of seconds. This is a hard cap even if `token_ttl` and
687
- `token_max_ttl` would otherwise allow a renewal.
583
+ Generated Token's Explicit Maximum TTL in seconds
688
584
  """
689
585
  return pulumi.get(self, "token_explicit_max_ttl")
690
586
 
@@ -696,8 +592,7 @@ class _AuthBackendRoleState:
696
592
  @pulumi.getter(name="tokenMaxTtl")
697
593
  def token_max_ttl(self) -> Optional[pulumi.Input[int]]:
698
594
  """
699
- The maximum lifetime for generated tokens in number of seconds.
700
- Its current value will be referenced at renewal time.
595
+ The maximum lifetime of the generated token
701
596
  """
702
597
  return pulumi.get(self, "token_max_ttl")
703
598
 
@@ -709,8 +604,7 @@ class _AuthBackendRoleState:
709
604
  @pulumi.getter(name="tokenNoDefaultPolicy")
710
605
  def token_no_default_policy(self) -> Optional[pulumi.Input[bool]]:
711
606
  """
712
- If set, the default policy will not be set on
713
- generated tokens; otherwise it will be added to the policies set in token_policies.
607
+ If true, the 'default' policy will not automatically be added to generated tokens
714
608
  """
715
609
  return pulumi.get(self, "token_no_default_policy")
716
610
 
@@ -722,8 +616,7 @@ class _AuthBackendRoleState:
722
616
  @pulumi.getter(name="tokenNumUses")
723
617
  def token_num_uses(self) -> Optional[pulumi.Input[int]]:
724
618
  """
725
- The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
726
- of times a generated token may be used (within its lifetime); 0 means unlimited.
619
+ The maximum number of times a token may be used, a value of zero means unlimited
727
620
  """
728
621
  return pulumi.get(self, "token_num_uses")
729
622
 
@@ -735,10 +628,7 @@ class _AuthBackendRoleState:
735
628
  @pulumi.getter(name="tokenPeriod")
736
629
  def token_period(self) -> Optional[pulumi.Input[int]]:
737
630
  """
738
- If set, indicates that the
739
- token generated using this role should never expire. The token should be renewed within the
740
- duration specified by this value. At each renewal, the token's TTL will be set to the
741
- value of this field. Specified in seconds.
631
+ Generated Token's Period
742
632
  """
743
633
  return pulumi.get(self, "token_period")
744
634
 
@@ -750,8 +640,7 @@ class _AuthBackendRoleState:
750
640
  @pulumi.getter(name="tokenPolicies")
751
641
  def token_policies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
752
642
  """
753
- List of policies to encode onto generated tokens. Depending
754
- on the auth method, this list may be supplemented by user/group/other values.
643
+ Generated Token's Policies
755
644
  """
756
645
  return pulumi.get(self, "token_policies")
757
646
 
@@ -763,8 +652,7 @@ class _AuthBackendRoleState:
763
652
  @pulumi.getter(name="tokenTtl")
764
653
  def token_ttl(self) -> Optional[pulumi.Input[int]]:
765
654
  """
766
- The incremental lifetime for generated tokens in number of seconds.
767
- Its current value will be referenced at renewal time.
655
+ The initial ttl of the token to generate in seconds
768
656
  """
769
657
  return pulumi.get(self, "token_ttl")
770
658
 
@@ -776,11 +664,7 @@ class _AuthBackendRoleState:
776
664
  @pulumi.getter(name="tokenType")
777
665
  def token_type(self) -> Optional[pulumi.Input[str]]:
778
666
  """
779
- The type of token that should be generated. Can be `service`,
780
- `batch`, or `default` to use the mount's tuned default (which unless changed will be
781
- `service` tokens). For token store roles, there are two additional possibilities:
782
- `default-service` and `default-batch` which specify the type to return unless the client
783
- requests a different type at generation time.
667
+ The type of token to generate, service or batch
784
668
  """
785
669
  return pulumi.get(self, "token_type")
786
670
 
@@ -834,7 +718,6 @@ class AuthBackendRole(pulumi.CustomResource):
834
718
 
835
719
  ## Example Usage
836
720
 
837
- <!--Start PulumiCodeChooser -->
838
721
  ```python
839
722
  import pulumi
840
723
  import pulumi_vault as vault
@@ -856,7 +739,6 @@ class AuthBackendRole(pulumi.CustomResource):
856
739
  ],
857
740
  add_group_aliases=True)
858
741
  ```
859
- <!--End PulumiCodeChooser -->
860
742
 
861
743
  ## Import
862
744
 
@@ -868,46 +750,23 @@ class AuthBackendRole(pulumi.CustomResource):
868
750
 
869
751
  :param str resource_name: The name of the resource.
870
752
  :param pulumi.ResourceOptions opts: Options for the resource.
871
- :param pulumi.Input[bool] allow_gce_inference: A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
872
753
  :param pulumi.Input[str] backend: Path to the mounted GCP auth backend
873
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_instance_groups: The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
874
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_labels: A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
875
754
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_projects: An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.
876
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_regions: The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
877
755
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_service_accounts: GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is `iam`)
878
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_zones: The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
879
- :param pulumi.Input[str] max_jwt_exp: The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
880
756
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
881
757
  The value should not contain leading or trailing forward slashes.
882
758
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
883
759
  *Available only for Vault Enterprise*.
884
760
  :param pulumi.Input[str] role: Name of the GCP role
885
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: List of CIDR blocks; if set, specifies blocks of IP
886
- addresses which can authenticate successfully, and ties the resulting token to these blocks
887
- as well.
888
- :param pulumi.Input[int] token_explicit_max_ttl: If set, will encode an
889
- [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
890
- onto the token in number of seconds. This is a hard cap even if `token_ttl` and
891
- `token_max_ttl` would otherwise allow a renewal.
892
- :param pulumi.Input[int] token_max_ttl: The maximum lifetime for generated tokens in number of seconds.
893
- Its current value will be referenced at renewal time.
894
- :param pulumi.Input[bool] token_no_default_policy: If set, the default policy will not be set on
895
- generated tokens; otherwise it will be added to the policies set in token_policies.
896
- :param pulumi.Input[int] token_num_uses: The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
897
- of times a generated token may be used (within its lifetime); 0 means unlimited.
898
- :param pulumi.Input[int] token_period: If set, indicates that the
899
- token generated using this role should never expire. The token should be renewed within the
900
- duration specified by this value. At each renewal, the token's TTL will be set to the
901
- value of this field. Specified in seconds.
902
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: List of policies to encode onto generated tokens. Depending
903
- on the auth method, this list may be supplemented by user/group/other values.
904
- :param pulumi.Input[int] token_ttl: The incremental lifetime for generated tokens in number of seconds.
905
- Its current value will be referenced at renewal time.
906
- :param pulumi.Input[str] token_type: The type of token that should be generated. Can be `service`,
907
- `batch`, or `default` to use the mount's tuned default (which unless changed will be
908
- `service` tokens). For token store roles, there are two additional possibilities:
909
- `default-service` and `default-batch` which specify the type to return unless the client
910
- requests a different type at generation time.
761
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
762
+ :param pulumi.Input[int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
763
+ :param pulumi.Input[int] token_max_ttl: The maximum lifetime of the generated token
764
+ :param pulumi.Input[bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
765
+ :param pulumi.Input[int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
766
+ :param pulumi.Input[int] token_period: Generated Token's Period
767
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: Generated Token's Policies
768
+ :param pulumi.Input[int] token_ttl: The initial ttl of the token to generate in seconds
769
+ :param pulumi.Input[str] token_type: The type of token to generate, service or batch
911
770
  :param pulumi.Input[str] type: Type of GCP authentication role (either `gce` or `iam`)
912
771
  """
913
772
  ...
@@ -921,7 +780,6 @@ class AuthBackendRole(pulumi.CustomResource):
921
780
 
922
781
  ## Example Usage
923
782
 
924
- <!--Start PulumiCodeChooser -->
925
783
  ```python
926
784
  import pulumi
927
785
  import pulumi_vault as vault
@@ -943,7 +801,6 @@ class AuthBackendRole(pulumi.CustomResource):
943
801
  ],
944
802
  add_group_aliases=True)
945
803
  ```
946
- <!--End PulumiCodeChooser -->
947
804
 
948
805
  ## Import
949
806
 
@@ -1064,46 +921,23 @@ class AuthBackendRole(pulumi.CustomResource):
1064
921
  :param str resource_name: The unique name of the resulting resource.
1065
922
  :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
1066
923
  :param pulumi.ResourceOptions opts: Options for the resource.
1067
- :param pulumi.Input[bool] allow_gce_inference: A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
1068
924
  :param pulumi.Input[str] backend: Path to the mounted GCP auth backend
1069
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_instance_groups: The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
1070
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_labels: A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
1071
925
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_projects: An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.
1072
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_regions: The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
1073
926
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_service_accounts: GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is `iam`)
1074
- :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_zones: The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
1075
- :param pulumi.Input[str] max_jwt_exp: The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
1076
927
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
1077
928
  The value should not contain leading or trailing forward slashes.
1078
929
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
1079
930
  *Available only for Vault Enterprise*.
1080
931
  :param pulumi.Input[str] role: Name of the GCP role
1081
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: List of CIDR blocks; if set, specifies blocks of IP
1082
- addresses which can authenticate successfully, and ties the resulting token to these blocks
1083
- as well.
1084
- :param pulumi.Input[int] token_explicit_max_ttl: If set, will encode an
1085
- [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
1086
- onto the token in number of seconds. This is a hard cap even if `token_ttl` and
1087
- `token_max_ttl` would otherwise allow a renewal.
1088
- :param pulumi.Input[int] token_max_ttl: The maximum lifetime for generated tokens in number of seconds.
1089
- Its current value will be referenced at renewal time.
1090
- :param pulumi.Input[bool] token_no_default_policy: If set, the default policy will not be set on
1091
- generated tokens; otherwise it will be added to the policies set in token_policies.
1092
- :param pulumi.Input[int] token_num_uses: The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
1093
- of times a generated token may be used (within its lifetime); 0 means unlimited.
1094
- :param pulumi.Input[int] token_period: If set, indicates that the
1095
- token generated using this role should never expire. The token should be renewed within the
1096
- duration specified by this value. At each renewal, the token's TTL will be set to the
1097
- value of this field. Specified in seconds.
1098
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: List of policies to encode onto generated tokens. Depending
1099
- on the auth method, this list may be supplemented by user/group/other values.
1100
- :param pulumi.Input[int] token_ttl: The incremental lifetime for generated tokens in number of seconds.
1101
- Its current value will be referenced at renewal time.
1102
- :param pulumi.Input[str] token_type: The type of token that should be generated. Can be `service`,
1103
- `batch`, or `default` to use the mount's tuned default (which unless changed will be
1104
- `service` tokens). For token store roles, there are two additional possibilities:
1105
- `default-service` and `default-batch` which specify the type to return unless the client
1106
- requests a different type at generation time.
932
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
933
+ :param pulumi.Input[int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
934
+ :param pulumi.Input[int] token_max_ttl: The maximum lifetime of the generated token
935
+ :param pulumi.Input[bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
936
+ :param pulumi.Input[int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
937
+ :param pulumi.Input[int] token_period: Generated Token's Period
938
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: Generated Token's Policies
939
+ :param pulumi.Input[int] token_ttl: The initial ttl of the token to generate in seconds
940
+ :param pulumi.Input[str] token_type: The type of token to generate, service or batch
1107
941
  :param pulumi.Input[str] type: Type of GCP authentication role (either `gce` or `iam`)
1108
942
  """
1109
943
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
@@ -1142,9 +976,6 @@ class AuthBackendRole(pulumi.CustomResource):
1142
976
  @property
1143
977
  @pulumi.getter(name="allowGceInference")
1144
978
  def allow_gce_inference(self) -> pulumi.Output[bool]:
1145
- """
1146
- A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
1147
- """
1148
979
  return pulumi.get(self, "allow_gce_inference")
1149
980
 
1150
981
  @property
@@ -1158,17 +989,11 @@ class AuthBackendRole(pulumi.CustomResource):
1158
989
  @property
1159
990
  @pulumi.getter(name="boundInstanceGroups")
1160
991
  def bound_instance_groups(self) -> pulumi.Output[Sequence[str]]:
1161
- """
1162
- The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
1163
- """
1164
992
  return pulumi.get(self, "bound_instance_groups")
1165
993
 
1166
994
  @property
1167
995
  @pulumi.getter(name="boundLabels")
1168
996
  def bound_labels(self) -> pulumi.Output[Sequence[str]]:
1169
- """
1170
- A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
1171
- """
1172
997
  return pulumi.get(self, "bound_labels")
1173
998
 
1174
999
  @property
@@ -1182,9 +1007,6 @@ class AuthBackendRole(pulumi.CustomResource):
1182
1007
  @property
1183
1008
  @pulumi.getter(name="boundRegions")
1184
1009
  def bound_regions(self) -> pulumi.Output[Sequence[str]]:
1185
- """
1186
- The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
1187
- """
1188
1010
  return pulumi.get(self, "bound_regions")
1189
1011
 
1190
1012
  @property
@@ -1198,17 +1020,11 @@ class AuthBackendRole(pulumi.CustomResource):
1198
1020
  @property
1199
1021
  @pulumi.getter(name="boundZones")
1200
1022
  def bound_zones(self) -> pulumi.Output[Sequence[str]]:
1201
- """
1202
- The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
1203
- """
1204
1023
  return pulumi.get(self, "bound_zones")
1205
1024
 
1206
1025
  @property
1207
1026
  @pulumi.getter(name="maxJwtExp")
1208
1027
  def max_jwt_exp(self) -> pulumi.Output[str]:
1209
- """
1210
- The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
1211
- """
1212
1028
  return pulumi.get(self, "max_jwt_exp")
1213
1029
 
1214
1030
  @property
@@ -1234,9 +1050,7 @@ class AuthBackendRole(pulumi.CustomResource):
1234
1050
  @pulumi.getter(name="tokenBoundCidrs")
1235
1051
  def token_bound_cidrs(self) -> pulumi.Output[Optional[Sequence[str]]]:
1236
1052
  """
1237
- List of CIDR blocks; if set, specifies blocks of IP
1238
- addresses which can authenticate successfully, and ties the resulting token to these blocks
1239
- as well.
1053
+ Specifies the blocks of IP addresses which are allowed to use the generated token
1240
1054
  """
1241
1055
  return pulumi.get(self, "token_bound_cidrs")
1242
1056
 
@@ -1244,10 +1058,7 @@ class AuthBackendRole(pulumi.CustomResource):
1244
1058
  @pulumi.getter(name="tokenExplicitMaxTtl")
1245
1059
  def token_explicit_max_ttl(self) -> pulumi.Output[Optional[int]]:
1246
1060
  """
1247
- If set, will encode an
1248
- [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
1249
- onto the token in number of seconds. This is a hard cap even if `token_ttl` and
1250
- `token_max_ttl` would otherwise allow a renewal.
1061
+ Generated Token's Explicit Maximum TTL in seconds
1251
1062
  """
1252
1063
  return pulumi.get(self, "token_explicit_max_ttl")
1253
1064
 
@@ -1255,8 +1066,7 @@ class AuthBackendRole(pulumi.CustomResource):
1255
1066
  @pulumi.getter(name="tokenMaxTtl")
1256
1067
  def token_max_ttl(self) -> pulumi.Output[Optional[int]]:
1257
1068
  """
1258
- The maximum lifetime for generated tokens in number of seconds.
1259
- Its current value will be referenced at renewal time.
1069
+ The maximum lifetime of the generated token
1260
1070
  """
1261
1071
  return pulumi.get(self, "token_max_ttl")
1262
1072
 
@@ -1264,8 +1074,7 @@ class AuthBackendRole(pulumi.CustomResource):
1264
1074
  @pulumi.getter(name="tokenNoDefaultPolicy")
1265
1075
  def token_no_default_policy(self) -> pulumi.Output[Optional[bool]]:
1266
1076
  """
1267
- If set, the default policy will not be set on
1268
- generated tokens; otherwise it will be added to the policies set in token_policies.
1077
+ If true, the 'default' policy will not automatically be added to generated tokens
1269
1078
  """
1270
1079
  return pulumi.get(self, "token_no_default_policy")
1271
1080
 
@@ -1273,8 +1082,7 @@ class AuthBackendRole(pulumi.CustomResource):
1273
1082
  @pulumi.getter(name="tokenNumUses")
1274
1083
  def token_num_uses(self) -> pulumi.Output[Optional[int]]:
1275
1084
  """
1276
- The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
1277
- of times a generated token may be used (within its lifetime); 0 means unlimited.
1085
+ The maximum number of times a token may be used, a value of zero means unlimited
1278
1086
  """
1279
1087
  return pulumi.get(self, "token_num_uses")
1280
1088
 
@@ -1282,10 +1090,7 @@ class AuthBackendRole(pulumi.CustomResource):
1282
1090
  @pulumi.getter(name="tokenPeriod")
1283
1091
  def token_period(self) -> pulumi.Output[Optional[int]]:
1284
1092
  """
1285
- If set, indicates that the
1286
- token generated using this role should never expire. The token should be renewed within the
1287
- duration specified by this value. At each renewal, the token's TTL will be set to the
1288
- value of this field. Specified in seconds.
1093
+ Generated Token's Period
1289
1094
  """
1290
1095
  return pulumi.get(self, "token_period")
1291
1096
 
@@ -1293,8 +1098,7 @@ class AuthBackendRole(pulumi.CustomResource):
1293
1098
  @pulumi.getter(name="tokenPolicies")
1294
1099
  def token_policies(self) -> pulumi.Output[Optional[Sequence[str]]]:
1295
1100
  """
1296
- List of policies to encode onto generated tokens. Depending
1297
- on the auth method, this list may be supplemented by user/group/other values.
1101
+ Generated Token's Policies
1298
1102
  """
1299
1103
  return pulumi.get(self, "token_policies")
1300
1104
 
@@ -1302,8 +1106,7 @@ class AuthBackendRole(pulumi.CustomResource):
1302
1106
  @pulumi.getter(name="tokenTtl")
1303
1107
  def token_ttl(self) -> pulumi.Output[Optional[int]]:
1304
1108
  """
1305
- The incremental lifetime for generated tokens in number of seconds.
1306
- Its current value will be referenced at renewal time.
1109
+ The initial ttl of the token to generate in seconds
1307
1110
  """
1308
1111
  return pulumi.get(self, "token_ttl")
1309
1112
 
@@ -1311,11 +1114,7 @@ class AuthBackendRole(pulumi.CustomResource):
1311
1114
  @pulumi.getter(name="tokenType")
1312
1115
  def token_type(self) -> pulumi.Output[Optional[str]]:
1313
1116
  """
1314
- The type of token that should be generated. Can be `service`,
1315
- `batch`, or `default` to use the mount's tuned default (which unless changed will be
1316
- `service` tokens). For token store roles, there are two additional possibilities:
1317
- `default-service` and `default-batch` which specify the type to return unless the client
1318
- requests a different type at generation time.
1117
+ The type of token to generate, service or batch
1319
1118
  """
1320
1119
  return pulumi.get(self, "token_type")
1321
1120