pulumi-vault 6.1.1__py3-none-any.whl → 6.2.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (29) hide show
  1. pulumi_vault/__init__.py +26 -0
  2. pulumi_vault/auth_backend.py +47 -0
  3. pulumi_vault/aws/auth_backend_client.py +247 -7
  4. pulumi_vault/aws/secret_backend_role.py +54 -0
  5. pulumi_vault/azure/auth_backend_config.py +133 -0
  6. pulumi_vault/azure/backend.py +203 -0
  7. pulumi_vault/database/secrets_mount.py +282 -0
  8. pulumi_vault/gcp/auth_backend.py +244 -0
  9. pulumi_vault/gcp/secret_backend.py +271 -3
  10. pulumi_vault/jwt/auth_backend_role.py +28 -35
  11. pulumi_vault/kubernetes/secret_backend.py +282 -0
  12. pulumi_vault/ldap/secret_backend.py +282 -0
  13. pulumi_vault/mount.py +324 -0
  14. pulumi_vault/okta/auth_backend.py +453 -0
  15. pulumi_vault/pkisecret/__init__.py +2 -0
  16. pulumi_vault/pkisecret/_inputs.py +30 -0
  17. pulumi_vault/pkisecret/backend_config_est.py +614 -0
  18. pulumi_vault/pkisecret/get_backend_config_est.py +233 -0
  19. pulumi_vault/pkisecret/outputs.py +54 -0
  20. pulumi_vault/plugin.py +590 -0
  21. pulumi_vault/plugin_pinned_version.py +293 -0
  22. pulumi_vault/pulumi-plugin.json +1 -1
  23. pulumi_vault/quota_lease_count.py +47 -0
  24. pulumi_vault/quota_rate_limit.py +47 -0
  25. pulumi_vault/ssh/secret_backend_ca.py +94 -0
  26. {pulumi_vault-6.1.1.dist-info → pulumi_vault-6.2.0.dist-info}/METADATA +1 -1
  27. {pulumi_vault-6.1.1.dist-info → pulumi_vault-6.2.0.dist-info}/RECORD +29 -25
  28. {pulumi_vault-6.1.1.dist-info → pulumi_vault-6.2.0.dist-info}/WHEEL +1 -1
  29. {pulumi_vault-6.1.1.dist-info → pulumi_vault-6.2.0.dist-info}/top_level.txt +0 -0
pulumi_vault/mount.py CHANGED
@@ -17,26 +17,39 @@ class MountArgs:
17
17
  path: pulumi.Input[str],
18
18
  type: pulumi.Input[str],
19
19
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
20
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
20
21
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
21
22
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
22
23
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
24
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
23
25
  description: Optional[pulumi.Input[str]] = None,
24
26
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
27
+ identity_token_key: Optional[pulumi.Input[str]] = None,
28
+ listing_visibility: Optional[pulumi.Input[str]] = None,
25
29
  local: Optional[pulumi.Input[bool]] = None,
26
30
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
27
31
  namespace: Optional[pulumi.Input[str]] = None,
28
32
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
33
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
34
+ plugin_version: Optional[pulumi.Input[str]] = None,
29
35
  seal_wrap: Optional[pulumi.Input[bool]] = None):
30
36
  """
31
37
  The set of arguments for constructing a Mount resource.
32
38
  :param pulumi.Input[str] path: Where the secret backend will be mounted
33
39
  :param pulumi.Input[str] type: Type of the backend, such as "aws"
34
40
  :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_managed_keys: Set of managed key registry entry names that the mount in question is allowed to access
41
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_response_headers: List of headers to allow, allowing a plugin to include
42
+ them in the response.
35
43
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
36
44
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
37
45
  :param pulumi.Input[int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
46
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] delegated_auth_accessors: List of allowed authentication mount accessors the
47
+ backend can request delegated authentication for.
38
48
  :param pulumi.Input[str] description: Human-friendly description of the mount
39
49
  :param pulumi.Input[bool] external_entropy_access: Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
50
+ :param pulumi.Input[str] identity_token_key: The key to use for signing plugin workload identity tokens. If
51
+ not provided, this will default to Vault's OIDC default key.
52
+ :param pulumi.Input[str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
40
53
  :param pulumi.Input[bool] local: Boolean flag that can be explicitly set to true to enforce local mount in HA environment
41
54
  :param pulumi.Input[int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
42
55
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -44,22 +57,35 @@ class MountArgs:
44
57
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
45
58
  *Available only for Vault Enterprise*.
46
59
  :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
60
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to
61
+ the plugin.
62
+ :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
63
+ If unspecified, the server will select any matching unversioned plugin that may have been
64
+ registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
47
65
  :param pulumi.Input[bool] seal_wrap: Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
48
66
  """
49
67
  pulumi.set(__self__, "path", path)
50
68
  pulumi.set(__self__, "type", type)
51
69
  if allowed_managed_keys is not None:
52
70
  pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
71
+ if allowed_response_headers is not None:
72
+ pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
53
73
  if audit_non_hmac_request_keys is not None:
54
74
  pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
55
75
  if audit_non_hmac_response_keys is not None:
56
76
  pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
57
77
  if default_lease_ttl_seconds is not None:
58
78
  pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
79
+ if delegated_auth_accessors is not None:
80
+ pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
59
81
  if description is not None:
60
82
  pulumi.set(__self__, "description", description)
61
83
  if external_entropy_access is not None:
62
84
  pulumi.set(__self__, "external_entropy_access", external_entropy_access)
85
+ if identity_token_key is not None:
86
+ pulumi.set(__self__, "identity_token_key", identity_token_key)
87
+ if listing_visibility is not None:
88
+ pulumi.set(__self__, "listing_visibility", listing_visibility)
63
89
  if local is not None:
64
90
  pulumi.set(__self__, "local", local)
65
91
  if max_lease_ttl_seconds is not None:
@@ -68,6 +94,10 @@ class MountArgs:
68
94
  pulumi.set(__self__, "namespace", namespace)
69
95
  if options is not None:
70
96
  pulumi.set(__self__, "options", options)
97
+ if passthrough_request_headers is not None:
98
+ pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
99
+ if plugin_version is not None:
100
+ pulumi.set(__self__, "plugin_version", plugin_version)
71
101
  if seal_wrap is not None:
72
102
  pulumi.set(__self__, "seal_wrap", seal_wrap)
73
103
 
@@ -107,6 +137,19 @@ class MountArgs:
107
137
  def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
108
138
  pulumi.set(self, "allowed_managed_keys", value)
109
139
 
140
+ @property
141
+ @pulumi.getter(name="allowedResponseHeaders")
142
+ def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
143
+ """
144
+ List of headers to allow, allowing a plugin to include
145
+ them in the response.
146
+ """
147
+ return pulumi.get(self, "allowed_response_headers")
148
+
149
+ @allowed_response_headers.setter
150
+ def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
151
+ pulumi.set(self, "allowed_response_headers", value)
152
+
110
153
  @property
111
154
  @pulumi.getter(name="auditNonHmacRequestKeys")
112
155
  def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
@@ -143,6 +186,19 @@ class MountArgs:
143
186
  def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[int]]):
144
187
  pulumi.set(self, "default_lease_ttl_seconds", value)
145
188
 
189
+ @property
190
+ @pulumi.getter(name="delegatedAuthAccessors")
191
+ def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
192
+ """
193
+ List of allowed authentication mount accessors the
194
+ backend can request delegated authentication for.
195
+ """
196
+ return pulumi.get(self, "delegated_auth_accessors")
197
+
198
+ @delegated_auth_accessors.setter
199
+ def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
200
+ pulumi.set(self, "delegated_auth_accessors", value)
201
+
146
202
  @property
147
203
  @pulumi.getter
148
204
  def description(self) -> Optional[pulumi.Input[str]]:
@@ -167,6 +223,31 @@ class MountArgs:
167
223
  def external_entropy_access(self, value: Optional[pulumi.Input[bool]]):
168
224
  pulumi.set(self, "external_entropy_access", value)
169
225
 
226
+ @property
227
+ @pulumi.getter(name="identityTokenKey")
228
+ def identity_token_key(self) -> Optional[pulumi.Input[str]]:
229
+ """
230
+ The key to use for signing plugin workload identity tokens. If
231
+ not provided, this will default to Vault's OIDC default key.
232
+ """
233
+ return pulumi.get(self, "identity_token_key")
234
+
235
+ @identity_token_key.setter
236
+ def identity_token_key(self, value: Optional[pulumi.Input[str]]):
237
+ pulumi.set(self, "identity_token_key", value)
238
+
239
+ @property
240
+ @pulumi.getter(name="listingVisibility")
241
+ def listing_visibility(self) -> Optional[pulumi.Input[str]]:
242
+ """
243
+ Specifies whether to show this mount in the UI-specific listing endpoint
244
+ """
245
+ return pulumi.get(self, "listing_visibility")
246
+
247
+ @listing_visibility.setter
248
+ def listing_visibility(self, value: Optional[pulumi.Input[str]]):
249
+ pulumi.set(self, "listing_visibility", value)
250
+
170
251
  @property
171
252
  @pulumi.getter
172
253
  def local(self) -> Optional[pulumi.Input[bool]]:
@@ -218,6 +299,33 @@ class MountArgs:
218
299
  def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
219
300
  pulumi.set(self, "options", value)
220
301
 
302
+ @property
303
+ @pulumi.getter(name="passthroughRequestHeaders")
304
+ def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
305
+ """
306
+ List of headers to allow and pass from the request to
307
+ the plugin.
308
+ """
309
+ return pulumi.get(self, "passthrough_request_headers")
310
+
311
+ @passthrough_request_headers.setter
312
+ def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
313
+ pulumi.set(self, "passthrough_request_headers", value)
314
+
315
+ @property
316
+ @pulumi.getter(name="pluginVersion")
317
+ def plugin_version(self) -> Optional[pulumi.Input[str]]:
318
+ """
319
+ Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
320
+ If unspecified, the server will select any matching unversioned plugin that may have been
321
+ registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
322
+ """
323
+ return pulumi.get(self, "plugin_version")
324
+
325
+ @plugin_version.setter
326
+ def plugin_version(self, value: Optional[pulumi.Input[str]]):
327
+ pulumi.set(self, "plugin_version", value)
328
+
221
329
  @property
222
330
  @pulumi.getter(name="sealWrap")
223
331
  def seal_wrap(self) -> Optional[pulumi.Input[bool]]:
@@ -236,27 +344,40 @@ class _MountState:
236
344
  def __init__(__self__, *,
237
345
  accessor: Optional[pulumi.Input[str]] = None,
238
346
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
347
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
239
348
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
240
349
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
241
350
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
351
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
242
352
  description: Optional[pulumi.Input[str]] = None,
243
353
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
354
+ identity_token_key: Optional[pulumi.Input[str]] = None,
355
+ listing_visibility: Optional[pulumi.Input[str]] = None,
244
356
  local: Optional[pulumi.Input[bool]] = None,
245
357
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
246
358
  namespace: Optional[pulumi.Input[str]] = None,
247
359
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
360
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
248
361
  path: Optional[pulumi.Input[str]] = None,
362
+ plugin_version: Optional[pulumi.Input[str]] = None,
249
363
  seal_wrap: Optional[pulumi.Input[bool]] = None,
250
364
  type: Optional[pulumi.Input[str]] = None):
251
365
  """
252
366
  Input properties used for looking up and filtering Mount resources.
253
367
  :param pulumi.Input[str] accessor: The accessor for this mount.
254
368
  :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_managed_keys: Set of managed key registry entry names that the mount in question is allowed to access
369
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_response_headers: List of headers to allow, allowing a plugin to include
370
+ them in the response.
255
371
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
256
372
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
257
373
  :param pulumi.Input[int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
374
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] delegated_auth_accessors: List of allowed authentication mount accessors the
375
+ backend can request delegated authentication for.
258
376
  :param pulumi.Input[str] description: Human-friendly description of the mount
259
377
  :param pulumi.Input[bool] external_entropy_access: Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
378
+ :param pulumi.Input[str] identity_token_key: The key to use for signing plugin workload identity tokens. If
379
+ not provided, this will default to Vault's OIDC default key.
380
+ :param pulumi.Input[str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
260
381
  :param pulumi.Input[bool] local: Boolean flag that can be explicitly set to true to enforce local mount in HA environment
261
382
  :param pulumi.Input[int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
262
383
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -264,7 +385,12 @@ class _MountState:
264
385
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
265
386
  *Available only for Vault Enterprise*.
266
387
  :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
388
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to
389
+ the plugin.
267
390
  :param pulumi.Input[str] path: Where the secret backend will be mounted
391
+ :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
392
+ If unspecified, the server will select any matching unversioned plugin that may have been
393
+ registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
268
394
  :param pulumi.Input[bool] seal_wrap: Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
269
395
  :param pulumi.Input[str] type: Type of the backend, such as "aws"
270
396
  """
@@ -272,16 +398,24 @@ class _MountState:
272
398
  pulumi.set(__self__, "accessor", accessor)
273
399
  if allowed_managed_keys is not None:
274
400
  pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
401
+ if allowed_response_headers is not None:
402
+ pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
275
403
  if audit_non_hmac_request_keys is not None:
276
404
  pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
277
405
  if audit_non_hmac_response_keys is not None:
278
406
  pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
279
407
  if default_lease_ttl_seconds is not None:
280
408
  pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
409
+ if delegated_auth_accessors is not None:
410
+ pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
281
411
  if description is not None:
282
412
  pulumi.set(__self__, "description", description)
283
413
  if external_entropy_access is not None:
284
414
  pulumi.set(__self__, "external_entropy_access", external_entropy_access)
415
+ if identity_token_key is not None:
416
+ pulumi.set(__self__, "identity_token_key", identity_token_key)
417
+ if listing_visibility is not None:
418
+ pulumi.set(__self__, "listing_visibility", listing_visibility)
285
419
  if local is not None:
286
420
  pulumi.set(__self__, "local", local)
287
421
  if max_lease_ttl_seconds is not None:
@@ -290,8 +424,12 @@ class _MountState:
290
424
  pulumi.set(__self__, "namespace", namespace)
291
425
  if options is not None:
292
426
  pulumi.set(__self__, "options", options)
427
+ if passthrough_request_headers is not None:
428
+ pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
293
429
  if path is not None:
294
430
  pulumi.set(__self__, "path", path)
431
+ if plugin_version is not None:
432
+ pulumi.set(__self__, "plugin_version", plugin_version)
295
433
  if seal_wrap is not None:
296
434
  pulumi.set(__self__, "seal_wrap", seal_wrap)
297
435
  if type is not None:
@@ -321,6 +459,19 @@ class _MountState:
321
459
  def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
322
460
  pulumi.set(self, "allowed_managed_keys", value)
323
461
 
462
+ @property
463
+ @pulumi.getter(name="allowedResponseHeaders")
464
+ def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
465
+ """
466
+ List of headers to allow, allowing a plugin to include
467
+ them in the response.
468
+ """
469
+ return pulumi.get(self, "allowed_response_headers")
470
+
471
+ @allowed_response_headers.setter
472
+ def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
473
+ pulumi.set(self, "allowed_response_headers", value)
474
+
324
475
  @property
325
476
  @pulumi.getter(name="auditNonHmacRequestKeys")
326
477
  def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
@@ -357,6 +508,19 @@ class _MountState:
357
508
  def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[int]]):
358
509
  pulumi.set(self, "default_lease_ttl_seconds", value)
359
510
 
511
+ @property
512
+ @pulumi.getter(name="delegatedAuthAccessors")
513
+ def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
514
+ """
515
+ List of allowed authentication mount accessors the
516
+ backend can request delegated authentication for.
517
+ """
518
+ return pulumi.get(self, "delegated_auth_accessors")
519
+
520
+ @delegated_auth_accessors.setter
521
+ def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
522
+ pulumi.set(self, "delegated_auth_accessors", value)
523
+
360
524
  @property
361
525
  @pulumi.getter
362
526
  def description(self) -> Optional[pulumi.Input[str]]:
@@ -381,6 +545,31 @@ class _MountState:
381
545
  def external_entropy_access(self, value: Optional[pulumi.Input[bool]]):
382
546
  pulumi.set(self, "external_entropy_access", value)
383
547
 
548
+ @property
549
+ @pulumi.getter(name="identityTokenKey")
550
+ def identity_token_key(self) -> Optional[pulumi.Input[str]]:
551
+ """
552
+ The key to use for signing plugin workload identity tokens. If
553
+ not provided, this will default to Vault's OIDC default key.
554
+ """
555
+ return pulumi.get(self, "identity_token_key")
556
+
557
+ @identity_token_key.setter
558
+ def identity_token_key(self, value: Optional[pulumi.Input[str]]):
559
+ pulumi.set(self, "identity_token_key", value)
560
+
561
+ @property
562
+ @pulumi.getter(name="listingVisibility")
563
+ def listing_visibility(self) -> Optional[pulumi.Input[str]]:
564
+ """
565
+ Specifies whether to show this mount in the UI-specific listing endpoint
566
+ """
567
+ return pulumi.get(self, "listing_visibility")
568
+
569
+ @listing_visibility.setter
570
+ def listing_visibility(self, value: Optional[pulumi.Input[str]]):
571
+ pulumi.set(self, "listing_visibility", value)
572
+
384
573
  @property
385
574
  @pulumi.getter
386
575
  def local(self) -> Optional[pulumi.Input[bool]]:
@@ -432,6 +621,19 @@ class _MountState:
432
621
  def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
433
622
  pulumi.set(self, "options", value)
434
623
 
624
+ @property
625
+ @pulumi.getter(name="passthroughRequestHeaders")
626
+ def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
627
+ """
628
+ List of headers to allow and pass from the request to
629
+ the plugin.
630
+ """
631
+ return pulumi.get(self, "passthrough_request_headers")
632
+
633
+ @passthrough_request_headers.setter
634
+ def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
635
+ pulumi.set(self, "passthrough_request_headers", value)
636
+
435
637
  @property
436
638
  @pulumi.getter
437
639
  def path(self) -> Optional[pulumi.Input[str]]:
@@ -444,6 +646,20 @@ class _MountState:
444
646
  def path(self, value: Optional[pulumi.Input[str]]):
445
647
  pulumi.set(self, "path", value)
446
648
 
649
+ @property
650
+ @pulumi.getter(name="pluginVersion")
651
+ def plugin_version(self) -> Optional[pulumi.Input[str]]:
652
+ """
653
+ Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
654
+ If unspecified, the server will select any matching unversioned plugin that may have been
655
+ registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
656
+ """
657
+ return pulumi.get(self, "plugin_version")
658
+
659
+ @plugin_version.setter
660
+ def plugin_version(self, value: Optional[pulumi.Input[str]]):
661
+ pulumi.set(self, "plugin_version", value)
662
+
447
663
  @property
448
664
  @pulumi.getter(name="sealWrap")
449
665
  def seal_wrap(self) -> Optional[pulumi.Input[bool]]:
@@ -475,16 +691,22 @@ class Mount(pulumi.CustomResource):
475
691
  resource_name: str,
476
692
  opts: Optional[pulumi.ResourceOptions] = None,
477
693
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
694
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
478
695
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
479
696
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
480
697
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
698
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
481
699
  description: Optional[pulumi.Input[str]] = None,
482
700
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
701
+ identity_token_key: Optional[pulumi.Input[str]] = None,
702
+ listing_visibility: Optional[pulumi.Input[str]] = None,
483
703
  local: Optional[pulumi.Input[bool]] = None,
484
704
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
485
705
  namespace: Optional[pulumi.Input[str]] = None,
486
706
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
707
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
487
708
  path: Optional[pulumi.Input[str]] = None,
709
+ plugin_version: Optional[pulumi.Input[str]] = None,
488
710
  seal_wrap: Optional[pulumi.Input[bool]] = None,
489
711
  type: Optional[pulumi.Input[str]] = None,
490
712
  __props__=None):
@@ -553,11 +775,18 @@ class Mount(pulumi.CustomResource):
553
775
  :param str resource_name: The name of the resource.
554
776
  :param pulumi.ResourceOptions opts: Options for the resource.
555
777
  :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_managed_keys: Set of managed key registry entry names that the mount in question is allowed to access
778
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_response_headers: List of headers to allow, allowing a plugin to include
779
+ them in the response.
556
780
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
557
781
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
558
782
  :param pulumi.Input[int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
783
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] delegated_auth_accessors: List of allowed authentication mount accessors the
784
+ backend can request delegated authentication for.
559
785
  :param pulumi.Input[str] description: Human-friendly description of the mount
560
786
  :param pulumi.Input[bool] external_entropy_access: Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
787
+ :param pulumi.Input[str] identity_token_key: The key to use for signing plugin workload identity tokens. If
788
+ not provided, this will default to Vault's OIDC default key.
789
+ :param pulumi.Input[str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
561
790
  :param pulumi.Input[bool] local: Boolean flag that can be explicitly set to true to enforce local mount in HA environment
562
791
  :param pulumi.Input[int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
563
792
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -565,7 +794,12 @@ class Mount(pulumi.CustomResource):
565
794
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
566
795
  *Available only for Vault Enterprise*.
567
796
  :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
797
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to
798
+ the plugin.
568
799
  :param pulumi.Input[str] path: Where the secret backend will be mounted
800
+ :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
801
+ If unspecified, the server will select any matching unversioned plugin that may have been
802
+ registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
569
803
  :param pulumi.Input[bool] seal_wrap: Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
570
804
  :param pulumi.Input[str] type: Type of the backend, such as "aws"
571
805
  """
@@ -653,16 +887,22 @@ class Mount(pulumi.CustomResource):
653
887
  resource_name: str,
654
888
  opts: Optional[pulumi.ResourceOptions] = None,
655
889
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
890
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
656
891
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
657
892
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
658
893
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
894
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
659
895
  description: Optional[pulumi.Input[str]] = None,
660
896
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
897
+ identity_token_key: Optional[pulumi.Input[str]] = None,
898
+ listing_visibility: Optional[pulumi.Input[str]] = None,
661
899
  local: Optional[pulumi.Input[bool]] = None,
662
900
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
663
901
  namespace: Optional[pulumi.Input[str]] = None,
664
902
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
903
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
665
904
  path: Optional[pulumi.Input[str]] = None,
905
+ plugin_version: Optional[pulumi.Input[str]] = None,
666
906
  seal_wrap: Optional[pulumi.Input[bool]] = None,
667
907
  type: Optional[pulumi.Input[str]] = None,
668
908
  __props__=None):
@@ -675,18 +915,24 @@ class Mount(pulumi.CustomResource):
675
915
  __props__ = MountArgs.__new__(MountArgs)
676
916
 
677
917
  __props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
918
+ __props__.__dict__["allowed_response_headers"] = allowed_response_headers
678
919
  __props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
679
920
  __props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
680
921
  __props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
922
+ __props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
681
923
  __props__.__dict__["description"] = description
682
924
  __props__.__dict__["external_entropy_access"] = external_entropy_access
925
+ __props__.__dict__["identity_token_key"] = identity_token_key
926
+ __props__.__dict__["listing_visibility"] = listing_visibility
683
927
  __props__.__dict__["local"] = local
684
928
  __props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
685
929
  __props__.__dict__["namespace"] = namespace
686
930
  __props__.__dict__["options"] = options
931
+ __props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
687
932
  if path is None and not opts.urn:
688
933
  raise TypeError("Missing required property 'path'")
689
934
  __props__.__dict__["path"] = path
935
+ __props__.__dict__["plugin_version"] = plugin_version
690
936
  __props__.__dict__["seal_wrap"] = seal_wrap
691
937
  if type is None and not opts.urn:
692
938
  raise TypeError("Missing required property 'type'")
@@ -704,16 +950,22 @@ class Mount(pulumi.CustomResource):
704
950
  opts: Optional[pulumi.ResourceOptions] = None,
705
951
  accessor: Optional[pulumi.Input[str]] = None,
706
952
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
953
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
707
954
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
708
955
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
709
956
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
957
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
710
958
  description: Optional[pulumi.Input[str]] = None,
711
959
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
960
+ identity_token_key: Optional[pulumi.Input[str]] = None,
961
+ listing_visibility: Optional[pulumi.Input[str]] = None,
712
962
  local: Optional[pulumi.Input[bool]] = None,
713
963
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
714
964
  namespace: Optional[pulumi.Input[str]] = None,
715
965
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
966
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
716
967
  path: Optional[pulumi.Input[str]] = None,
968
+ plugin_version: Optional[pulumi.Input[str]] = None,
717
969
  seal_wrap: Optional[pulumi.Input[bool]] = None,
718
970
  type: Optional[pulumi.Input[str]] = None) -> 'Mount':
719
971
  """
@@ -725,11 +977,18 @@ class Mount(pulumi.CustomResource):
725
977
  :param pulumi.ResourceOptions opts: Options for the resource.
726
978
  :param pulumi.Input[str] accessor: The accessor for this mount.
727
979
  :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_managed_keys: Set of managed key registry entry names that the mount in question is allowed to access
980
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_response_headers: List of headers to allow, allowing a plugin to include
981
+ them in the response.
728
982
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
729
983
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
730
984
  :param pulumi.Input[int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
985
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] delegated_auth_accessors: List of allowed authentication mount accessors the
986
+ backend can request delegated authentication for.
731
987
  :param pulumi.Input[str] description: Human-friendly description of the mount
732
988
  :param pulumi.Input[bool] external_entropy_access: Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
989
+ :param pulumi.Input[str] identity_token_key: The key to use for signing plugin workload identity tokens. If
990
+ not provided, this will default to Vault's OIDC default key.
991
+ :param pulumi.Input[str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
733
992
  :param pulumi.Input[bool] local: Boolean flag that can be explicitly set to true to enforce local mount in HA environment
734
993
  :param pulumi.Input[int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
735
994
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -737,7 +996,12 @@ class Mount(pulumi.CustomResource):
737
996
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
738
997
  *Available only for Vault Enterprise*.
739
998
  :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
999
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to
1000
+ the plugin.
740
1001
  :param pulumi.Input[str] path: Where the secret backend will be mounted
1002
+ :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
1003
+ If unspecified, the server will select any matching unversioned plugin that may have been
1004
+ registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
741
1005
  :param pulumi.Input[bool] seal_wrap: Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
742
1006
  :param pulumi.Input[str] type: Type of the backend, such as "aws"
743
1007
  """
@@ -747,16 +1011,22 @@ class Mount(pulumi.CustomResource):
747
1011
 
748
1012
  __props__.__dict__["accessor"] = accessor
749
1013
  __props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
1014
+ __props__.__dict__["allowed_response_headers"] = allowed_response_headers
750
1015
  __props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
751
1016
  __props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
752
1017
  __props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
1018
+ __props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
753
1019
  __props__.__dict__["description"] = description
754
1020
  __props__.__dict__["external_entropy_access"] = external_entropy_access
1021
+ __props__.__dict__["identity_token_key"] = identity_token_key
1022
+ __props__.__dict__["listing_visibility"] = listing_visibility
755
1023
  __props__.__dict__["local"] = local
756
1024
  __props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
757
1025
  __props__.__dict__["namespace"] = namespace
758
1026
  __props__.__dict__["options"] = options
1027
+ __props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
759
1028
  __props__.__dict__["path"] = path
1029
+ __props__.__dict__["plugin_version"] = plugin_version
760
1030
  __props__.__dict__["seal_wrap"] = seal_wrap
761
1031
  __props__.__dict__["type"] = type
762
1032
  return Mount(resource_name, opts=opts, __props__=__props__)
@@ -777,6 +1047,15 @@ class Mount(pulumi.CustomResource):
777
1047
  """
778
1048
  return pulumi.get(self, "allowed_managed_keys")
779
1049
 
1050
+ @property
1051
+ @pulumi.getter(name="allowedResponseHeaders")
1052
+ def allowed_response_headers(self) -> pulumi.Output[Optional[Sequence[str]]]:
1053
+ """
1054
+ List of headers to allow, allowing a plugin to include
1055
+ them in the response.
1056
+ """
1057
+ return pulumi.get(self, "allowed_response_headers")
1058
+
780
1059
  @property
781
1060
  @pulumi.getter(name="auditNonHmacRequestKeys")
782
1061
  def audit_non_hmac_request_keys(self) -> pulumi.Output[Sequence[str]]:
@@ -801,6 +1080,15 @@ class Mount(pulumi.CustomResource):
801
1080
  """
802
1081
  return pulumi.get(self, "default_lease_ttl_seconds")
803
1082
 
1083
+ @property
1084
+ @pulumi.getter(name="delegatedAuthAccessors")
1085
+ def delegated_auth_accessors(self) -> pulumi.Output[Optional[Sequence[str]]]:
1086
+ """
1087
+ List of allowed authentication mount accessors the
1088
+ backend can request delegated authentication for.
1089
+ """
1090
+ return pulumi.get(self, "delegated_auth_accessors")
1091
+
804
1092
  @property
805
1093
  @pulumi.getter
806
1094
  def description(self) -> pulumi.Output[Optional[str]]:
@@ -817,6 +1105,23 @@ class Mount(pulumi.CustomResource):
817
1105
  """
818
1106
  return pulumi.get(self, "external_entropy_access")
819
1107
 
1108
+ @property
1109
+ @pulumi.getter(name="identityTokenKey")
1110
+ def identity_token_key(self) -> pulumi.Output[Optional[str]]:
1111
+ """
1112
+ The key to use for signing plugin workload identity tokens. If
1113
+ not provided, this will default to Vault's OIDC default key.
1114
+ """
1115
+ return pulumi.get(self, "identity_token_key")
1116
+
1117
+ @property
1118
+ @pulumi.getter(name="listingVisibility")
1119
+ def listing_visibility(self) -> pulumi.Output[Optional[str]]:
1120
+ """
1121
+ Specifies whether to show this mount in the UI-specific listing endpoint
1122
+ """
1123
+ return pulumi.get(self, "listing_visibility")
1124
+
820
1125
  @property
821
1126
  @pulumi.getter
822
1127
  def local(self) -> pulumi.Output[Optional[bool]]:
@@ -852,6 +1157,15 @@ class Mount(pulumi.CustomResource):
852
1157
  """
853
1158
  return pulumi.get(self, "options")
854
1159
 
1160
+ @property
1161
+ @pulumi.getter(name="passthroughRequestHeaders")
1162
+ def passthrough_request_headers(self) -> pulumi.Output[Optional[Sequence[str]]]:
1163
+ """
1164
+ List of headers to allow and pass from the request to
1165
+ the plugin.
1166
+ """
1167
+ return pulumi.get(self, "passthrough_request_headers")
1168
+
855
1169
  @property
856
1170
  @pulumi.getter
857
1171
  def path(self) -> pulumi.Output[str]:
@@ -860,6 +1174,16 @@ class Mount(pulumi.CustomResource):
860
1174
  """
861
1175
  return pulumi.get(self, "path")
862
1176
 
1177
+ @property
1178
+ @pulumi.getter(name="pluginVersion")
1179
+ def plugin_version(self) -> pulumi.Output[Optional[str]]:
1180
+ """
1181
+ Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
1182
+ If unspecified, the server will select any matching unversioned plugin that may have been
1183
+ registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
1184
+ """
1185
+ return pulumi.get(self, "plugin_version")
1186
+
863
1187
  @property
864
1188
  @pulumi.getter(name="sealWrap")
865
1189
  def seal_wrap(self) -> pulumi.Output[bool]: