pulumi-vault 6.2.0__py3-none-any.whl → 6.2.0a1712470779__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (192) hide show
  1. pulumi_vault/__init__.py +0 -26
  2. pulumi_vault/_inputs.py +20 -0
  3. pulumi_vault/ad/secret_backend.py +6 -2
  4. pulumi_vault/ad/secret_library.py +4 -2
  5. pulumi_vault/ad/secret_role.py +4 -0
  6. pulumi_vault/alicloud/auth_backend_role.py +192 -69
  7. pulumi_vault/approle/auth_backend_login.py +4 -0
  8. pulumi_vault/approle/auth_backend_role.py +186 -63
  9. pulumi_vault/approle/auth_backend_role_secret_id.py +4 -0
  10. pulumi_vault/approle/get_auth_backend_role_id.py +4 -0
  11. pulumi_vault/audit.py +20 -12
  12. pulumi_vault/audit_request_header.py +6 -6
  13. pulumi_vault/auth_backend.py +0 -47
  14. pulumi_vault/aws/auth_backend_client.py +17 -253
  15. pulumi_vault/aws/auth_backend_config_identity.py +4 -0
  16. pulumi_vault/aws/auth_backend_identity_whitelist.py +10 -6
  17. pulumi_vault/aws/auth_backend_login.py +8 -0
  18. pulumi_vault/aws/auth_backend_role.py +186 -63
  19. pulumi_vault/aws/auth_backend_roletag_blacklist.py +10 -6
  20. pulumi_vault/aws/auth_backend_sts_role.py +4 -0
  21. pulumi_vault/aws/secret_backend_role.py +4 -56
  22. pulumi_vault/aws/secret_backend_static_role.py +4 -2
  23. pulumi_vault/azure/auth_backend_config.py +10 -139
  24. pulumi_vault/azure/auth_backend_role.py +186 -63
  25. pulumi_vault/azure/backend.py +22 -217
  26. pulumi_vault/azure/backend_role.py +18 -14
  27. pulumi_vault/azure/get_access_credentials.py +4 -0
  28. pulumi_vault/cert_auth_backend_role.py +208 -75
  29. pulumi_vault/consul/secret_backend.py +18 -10
  30. pulumi_vault/consul/secret_backend_role.py +4 -2
  31. pulumi_vault/database/_inputs.py +784 -522
  32. pulumi_vault/database/outputs.py +784 -522
  33. pulumi_vault/database/secret_backend_connection.py +4 -2
  34. pulumi_vault/database/secret_backend_role.py +4 -4
  35. pulumi_vault/database/secret_backend_static_role.py +8 -10
  36. pulumi_vault/database/secrets_mount.py +4 -286
  37. pulumi_vault/egp_policy.py +8 -4
  38. pulumi_vault/gcp/auth_backend.py +18 -226
  39. pulumi_vault/gcp/auth_backend_role.py +264 -63
  40. pulumi_vault/gcp/get_auth_backend_role.py +4 -0
  41. pulumi_vault/gcp/secret_backend.py +9 -275
  42. pulumi_vault/gcp/secret_impersonated_account.py +14 -12
  43. pulumi_vault/gcp/secret_roleset.py +6 -4
  44. pulumi_vault/gcp/secret_static_account.py +16 -14
  45. pulumi_vault/generic/endpoint.py +8 -4
  46. pulumi_vault/generic/get_secret.py +4 -40
  47. pulumi_vault/get_auth_backend.py +4 -0
  48. pulumi_vault/get_auth_backends.py +8 -0
  49. pulumi_vault/get_namespace.py +12 -0
  50. pulumi_vault/get_namespaces.py +12 -4
  51. pulumi_vault/get_nomad_access_token.py +4 -0
  52. pulumi_vault/get_policy_document.py +8 -8
  53. pulumi_vault/get_raft_autopilot_state.py +4 -0
  54. pulumi_vault/github/auth_backend.py +4 -0
  55. pulumi_vault/github/team.py +6 -2
  56. pulumi_vault/github/user.py +6 -2
  57. pulumi_vault/identity/entity.py +8 -6
  58. pulumi_vault/identity/entity_alias.py +8 -6
  59. pulumi_vault/identity/entity_policies.py +12 -12
  60. pulumi_vault/identity/get_entity.py +4 -0
  61. pulumi_vault/identity/get_group.py +4 -0
  62. pulumi_vault/identity/get_oidc_client_creds.py +4 -2
  63. pulumi_vault/identity/get_oidc_openid_config.py +6 -10
  64. pulumi_vault/identity/get_oidc_public_keys.py +6 -10
  65. pulumi_vault/identity/group.py +42 -38
  66. pulumi_vault/identity/group_alias.py +4 -2
  67. pulumi_vault/identity/group_member_entity_ids.py +16 -12
  68. pulumi_vault/identity/group_member_group_ids.py +20 -24
  69. pulumi_vault/identity/group_policies.py +8 -4
  70. pulumi_vault/identity/mfa_duo.py +8 -4
  71. pulumi_vault/identity/mfa_login_enforcement.py +8 -8
  72. pulumi_vault/identity/mfa_okta.py +8 -4
  73. pulumi_vault/identity/mfa_pingid.py +4 -0
  74. pulumi_vault/identity/mfa_totp.py +4 -0
  75. pulumi_vault/identity/oidc.py +4 -0
  76. pulumi_vault/identity/oidc_assignment.py +6 -10
  77. pulumi_vault/identity/oidc_client.py +10 -10
  78. pulumi_vault/identity/oidc_key.py +12 -16
  79. pulumi_vault/identity/oidc_key_allowed_client_id.py +12 -16
  80. pulumi_vault/identity/oidc_provider.py +16 -22
  81. pulumi_vault/identity/oidc_role.py +20 -28
  82. pulumi_vault/identity/oidc_scope.py +8 -6
  83. pulumi_vault/jwt/auth_backend.py +32 -20
  84. pulumi_vault/jwt/auth_backend_role.py +225 -91
  85. pulumi_vault/kmip/secret_backend.py +14 -10
  86. pulumi_vault/kmip/secret_role.py +4 -0
  87. pulumi_vault/kmip/secret_scope.py +4 -0
  88. pulumi_vault/kubernetes/auth_backend_config.py +4 -0
  89. pulumi_vault/kubernetes/auth_backend_role.py +172 -56
  90. pulumi_vault/kubernetes/get_service_account_token.py +8 -8
  91. pulumi_vault/kubernetes/secret_backend.py +8 -288
  92. pulumi_vault/kubernetes/secret_backend_role.py +24 -24
  93. pulumi_vault/kv/get_secret.py +4 -0
  94. pulumi_vault/kv/get_secret_subkeys_v2.py +6 -4
  95. pulumi_vault/kv/get_secret_v2.py +0 -58
  96. pulumi_vault/kv/get_secrets_list.py +8 -4
  97. pulumi_vault/kv/get_secrets_list_v2.py +12 -14
  98. pulumi_vault/kv/secret.py +4 -0
  99. pulumi_vault/kv/secret_backend_v2.py +4 -0
  100. pulumi_vault/kv/secret_v2.py +4 -2
  101. pulumi_vault/ldap/auth_backend.py +161 -66
  102. pulumi_vault/ldap/auth_backend_group.py +4 -0
  103. pulumi_vault/ldap/auth_backend_user.py +4 -0
  104. pulumi_vault/ldap/secret_backend.py +8 -286
  105. pulumi_vault/ldap/secret_backend_dynamic_role.py +4 -0
  106. pulumi_vault/ldap/secret_backend_library_set.py +4 -2
  107. pulumi_vault/ldap/secret_backend_static_role.py +4 -0
  108. pulumi_vault/managed/_inputs.py +132 -84
  109. pulumi_vault/managed/keys.py +28 -7
  110. pulumi_vault/managed/outputs.py +132 -84
  111. pulumi_vault/mfa_duo.py +6 -4
  112. pulumi_vault/mfa_okta.py +6 -4
  113. pulumi_vault/mfa_pingid.py +6 -4
  114. pulumi_vault/mfa_totp.py +12 -10
  115. pulumi_vault/mongodbatlas/secret_backend.py +4 -0
  116. pulumi_vault/mongodbatlas/secret_role.py +4 -2
  117. pulumi_vault/mount.py +42 -350
  118. pulumi_vault/nomad_secret_backend.py +8 -4
  119. pulumi_vault/nomad_secret_role.py +4 -0
  120. pulumi_vault/okta/_inputs.py +8 -8
  121. pulumi_vault/okta/auth_backend.py +10 -459
  122. pulumi_vault/okta/auth_backend_group.py +4 -0
  123. pulumi_vault/okta/auth_backend_user.py +4 -0
  124. pulumi_vault/okta/outputs.py +8 -8
  125. pulumi_vault/outputs.py +20 -0
  126. pulumi_vault/password_policy.py +8 -6
  127. pulumi_vault/pkisecret/__init__.py +0 -2
  128. pulumi_vault/pkisecret/_inputs.py +0 -30
  129. pulumi_vault/pkisecret/backend_config_cluster.py +4 -0
  130. pulumi_vault/pkisecret/get_backend_issuer.py +0 -36
  131. pulumi_vault/pkisecret/get_backend_issuers.py +4 -0
  132. pulumi_vault/pkisecret/get_backend_key.py +6 -2
  133. pulumi_vault/pkisecret/get_backend_keys.py +4 -0
  134. pulumi_vault/pkisecret/outputs.py +0 -54
  135. pulumi_vault/pkisecret/secret_backend_cert.py +8 -6
  136. pulumi_vault/pkisecret/secret_backend_config_ca.py +8 -4
  137. pulumi_vault/pkisecret/secret_backend_config_issuers.py +4 -0
  138. pulumi_vault/pkisecret/secret_backend_config_urls.py +4 -0
  139. pulumi_vault/pkisecret/secret_backend_crl_config.py +6 -2
  140. pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +8 -4
  141. pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +14 -10
  142. pulumi_vault/pkisecret/secret_backend_issuer.py +4 -0
  143. pulumi_vault/pkisecret/secret_backend_role.py +4 -2
  144. pulumi_vault/pkisecret/secret_backend_root_cert.py +8 -4
  145. pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +10 -6
  146. pulumi_vault/pkisecret/secret_backend_sign.py +8 -6
  147. pulumi_vault/provider.py +8 -0
  148. pulumi_vault/pulumi-plugin.json +1 -2
  149. pulumi_vault/quota_lease_count.py +8 -53
  150. pulumi_vault/quota_rate_limit.py +4 -49
  151. pulumi_vault/rabbitmq/secret_backend.py +8 -4
  152. pulumi_vault/rabbitmq/secret_backend_role.py +4 -2
  153. pulumi_vault/raft_autopilot.py +4 -0
  154. pulumi_vault/raft_snapshot_agent_config.py +304 -109
  155. pulumi_vault/rgp_policy.py +6 -2
  156. pulumi_vault/saml/auth_backend.py +12 -8
  157. pulumi_vault/saml/auth_backend_role.py +178 -64
  158. pulumi_vault/secrets/sync_association.py +10 -12
  159. pulumi_vault/secrets/sync_aws_destination.py +8 -6
  160. pulumi_vault/secrets/sync_azure_destination.py +12 -10
  161. pulumi_vault/secrets/sync_config.py +6 -2
  162. pulumi_vault/secrets/sync_gcp_destination.py +6 -6
  163. pulumi_vault/secrets/sync_gh_destination.py +8 -6
  164. pulumi_vault/secrets/sync_github_apps.py +8 -8
  165. pulumi_vault/secrets/sync_vercel_destination.py +8 -6
  166. pulumi_vault/ssh/_inputs.py +32 -6
  167. pulumi_vault/ssh/outputs.py +32 -6
  168. pulumi_vault/ssh/secret_backend_ca.py +4 -94
  169. pulumi_vault/ssh/secret_backend_role.py +4 -4
  170. pulumi_vault/terraformcloud/secret_backend.py +56 -0
  171. pulumi_vault/terraformcloud/secret_creds.py +17 -2
  172. pulumi_vault/terraformcloud/secret_role.py +69 -2
  173. pulumi_vault/token.py +18 -14
  174. pulumi_vault/tokenauth/auth_backend_role.py +180 -64
  175. pulumi_vault/transform/alphabet.py +6 -4
  176. pulumi_vault/transform/get_decode.py +4 -4
  177. pulumi_vault/transform/get_encode.py +4 -4
  178. pulumi_vault/transform/role.py +6 -4
  179. pulumi_vault/transform/template.py +4 -4
  180. pulumi_vault/transit/get_decrypt.py +20 -4
  181. pulumi_vault/transit/get_encrypt.py +14 -0
  182. pulumi_vault/transit/secret_backend_key.py +6 -6
  183. pulumi_vault/transit/secret_cache_config.py +4 -0
  184. {pulumi_vault-6.2.0.dist-info → pulumi_vault-6.2.0a1712470779.dist-info}/METADATA +1 -1
  185. pulumi_vault-6.2.0a1712470779.dist-info/RECORD +252 -0
  186. {pulumi_vault-6.2.0.dist-info → pulumi_vault-6.2.0a1712470779.dist-info}/WHEEL +1 -1
  187. pulumi_vault/pkisecret/backend_config_est.py +0 -614
  188. pulumi_vault/pkisecret/get_backend_config_est.py +0 -233
  189. pulumi_vault/plugin.py +0 -590
  190. pulumi_vault/plugin_pinned_version.py +0 -293
  191. pulumi_vault-6.2.0.dist-info/RECORD +0 -256
  192. {pulumi_vault-6.2.0.dist-info → pulumi_vault-6.2.0a1712470779.dist-info}/top_level.txt +0 -0
pulumi_vault/aws/auth_backend_client.py CHANGED
@@ -19,11 +19,7 @@ class AuthBackendClientArgs:
19
19
  ec2_endpoint: Optional[pulumi.Input[str]] = None,
20
20
  iam_endpoint: Optional[pulumi.Input[str]] = None,
21
21
  iam_server_id_header_value: Optional[pulumi.Input[str]] = None,
22
- identity_token_audience: Optional[pulumi.Input[str]] = None,
23
- identity_token_ttl: Optional[pulumi.Input[int]] = None,
24
- max_retries: Optional[pulumi.Input[int]] = None,
25
22
  namespace: Optional[pulumi.Input[str]] = None,
26
- role_arn: Optional[pulumi.Input[str]] = None,
27
23
  secret_key: Optional[pulumi.Input[str]] = None,
28
24
  sts_endpoint: Optional[pulumi.Input[str]] = None,
29
25
  sts_region: Optional[pulumi.Input[str]] = None,
@@ -31,7 +27,7 @@ class AuthBackendClientArgs:
31
27
  """
32
28
  The set of arguments for constructing a AuthBackendClient resource.
33
29
  :param pulumi.Input[str] access_key: The AWS access key that Vault should use for the
34
- auth backend. Mutually exclusive with `identity_token_audience`.
30
+ auth backend.
35
31
  :param pulumi.Input[str] backend: The path the AWS auth backend being configured was
36
32
  mounted at. Defaults to `aws`.
37
33
  :param pulumi.Input[str] ec2_endpoint: Override the URL Vault uses when making EC2 API
@@ -41,18 +37,10 @@ class AuthBackendClientArgs:
41
37
  :param pulumi.Input[str] iam_server_id_header_value: The value to require in the
42
38
  `X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
43
39
  that are used in the IAM auth method.
44
- :param pulumi.Input[str] identity_token_audience: The audience claim value. Mutually exclusive with `access_key`.
45
- Requires Vault 1.17+. *Available only for Vault Enterprise*
46
- :param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
47
- *Available only for Vault Enterprise*
48
- :param pulumi.Input[int] max_retries: Number of max retries the client should use for recoverable errors.
49
- The default `-1` falls back to the AWS SDK's default behavior.
50
40
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
51
41
  The value should not contain leading or trailing forward slashes.
52
42
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
53
43
  *Available only for Vault Enterprise*.
54
- :param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
55
- *Available only for Vault Enterprise*
56
44
  :param pulumi.Input[str] secret_key: The AWS secret key that Vault should use for the
57
45
  auth backend.
58
46
  :param pulumi.Input[str] sts_endpoint: Override the URL Vault uses when making STS API
@@ -75,16 +63,8 @@ class AuthBackendClientArgs:
75
63
  pulumi.set(__self__, "iam_endpoint", iam_endpoint)
76
64
  if iam_server_id_header_value is not None:
77
65
  pulumi.set(__self__, "iam_server_id_header_value", iam_server_id_header_value)
78
- if identity_token_audience is not None:
79
- pulumi.set(__self__, "identity_token_audience", identity_token_audience)
80
- if identity_token_ttl is not None:
81
- pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
82
- if max_retries is not None:
83
- pulumi.set(__self__, "max_retries", max_retries)
84
66
  if namespace is not None:
85
67
  pulumi.set(__self__, "namespace", namespace)
86
- if role_arn is not None:
87
- pulumi.set(__self__, "role_arn", role_arn)
88
68
  if secret_key is not None:
89
69
  pulumi.set(__self__, "secret_key", secret_key)
90
70
  if sts_endpoint is not None:
@@ -99,7 +79,7 @@ class AuthBackendClientArgs:
99
79
  def access_key(self) -> Optional[pulumi.Input[str]]:
100
80
  """
101
81
  The AWS access key that Vault should use for the
102
- auth backend. Mutually exclusive with `identity_token_audience`.
82
+ auth backend.
103
83
  """
104
84
  return pulumi.get(self, "access_key")
105
85
 
@@ -160,45 +140,6 @@ class AuthBackendClientArgs:
160
140
  def iam_server_id_header_value(self, value: Optional[pulumi.Input[str]]):
161
141
  pulumi.set(self, "iam_server_id_header_value", value)
162
142
 
163
- @property
164
- @pulumi.getter(name="identityTokenAudience")
165
- def identity_token_audience(self) -> Optional[pulumi.Input[str]]:
166
- """
167
- The audience claim value. Mutually exclusive with `access_key`.
168
- Requires Vault 1.17+. *Available only for Vault Enterprise*
169
- """
170
- return pulumi.get(self, "identity_token_audience")
171
-
172
- @identity_token_audience.setter
173
- def identity_token_audience(self, value: Optional[pulumi.Input[str]]):
174
- pulumi.set(self, "identity_token_audience", value)
175
-
176
- @property
177
- @pulumi.getter(name="identityTokenTtl")
178
- def identity_token_ttl(self) -> Optional[pulumi.Input[int]]:
179
- """
180
- The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
181
- *Available only for Vault Enterprise*
182
- """
183
- return pulumi.get(self, "identity_token_ttl")
184
-
185
- @identity_token_ttl.setter
186
- def identity_token_ttl(self, value: Optional[pulumi.Input[int]]):
187
- pulumi.set(self, "identity_token_ttl", value)
188
-
189
- @property
190
- @pulumi.getter(name="maxRetries")
191
- def max_retries(self) -> Optional[pulumi.Input[int]]:
192
- """
193
- Number of max retries the client should use for recoverable errors.
194
- The default `-1` falls back to the AWS SDK's default behavior.
195
- """
196
- return pulumi.get(self, "max_retries")
197
-
198
- @max_retries.setter
199
- def max_retries(self, value: Optional[pulumi.Input[int]]):
200
- pulumi.set(self, "max_retries", value)
201
-
202
143
  @property
203
144
  @pulumi.getter
204
145
  def namespace(self) -> Optional[pulumi.Input[str]]:
@@ -214,19 +155,6 @@ class AuthBackendClientArgs:
214
155
  def namespace(self, value: Optional[pulumi.Input[str]]):
215
156
  pulumi.set(self, "namespace", value)
216
157
 
217
- @property
218
- @pulumi.getter(name="roleArn")
219
- def role_arn(self) -> Optional[pulumi.Input[str]]:
220
- """
221
- Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
222
- *Available only for Vault Enterprise*
223
- """
224
- return pulumi.get(self, "role_arn")
225
-
226
- @role_arn.setter
227
- def role_arn(self, value: Optional[pulumi.Input[str]]):
228
- pulumi.set(self, "role_arn", value)
229
-
230
158
  @property
231
159
  @pulumi.getter(name="secretKey")
232
160
  def secret_key(self) -> Optional[pulumi.Input[str]]:
@@ -291,11 +219,7 @@ class _AuthBackendClientState:
291
219
  ec2_endpoint: Optional[pulumi.Input[str]] = None,
292
220
  iam_endpoint: Optional[pulumi.Input[str]] = None,
293
221
  iam_server_id_header_value: Optional[pulumi.Input[str]] = None,
294
- identity_token_audience: Optional[pulumi.Input[str]] = None,
295
- identity_token_ttl: Optional[pulumi.Input[int]] = None,
296
- max_retries: Optional[pulumi.Input[int]] = None,
297
222
  namespace: Optional[pulumi.Input[str]] = None,
298
- role_arn: Optional[pulumi.Input[str]] = None,
299
223
  secret_key: Optional[pulumi.Input[str]] = None,
300
224
  sts_endpoint: Optional[pulumi.Input[str]] = None,
301
225
  sts_region: Optional[pulumi.Input[str]] = None,
@@ -303,7 +227,7 @@ class _AuthBackendClientState:
303
227
  """
304
228
  Input properties used for looking up and filtering AuthBackendClient resources.
305
229
  :param pulumi.Input[str] access_key: The AWS access key that Vault should use for the
306
- auth backend. Mutually exclusive with `identity_token_audience`.
230
+ auth backend.
307
231
  :param pulumi.Input[str] backend: The path the AWS auth backend being configured was
308
232
  mounted at. Defaults to `aws`.
309
233
  :param pulumi.Input[str] ec2_endpoint: Override the URL Vault uses when making EC2 API
@@ -313,18 +237,10 @@ class _AuthBackendClientState:
313
237
  :param pulumi.Input[str] iam_server_id_header_value: The value to require in the
314
238
  `X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
315
239
  that are used in the IAM auth method.
316
- :param pulumi.Input[str] identity_token_audience: The audience claim value. Mutually exclusive with `access_key`.
317
- Requires Vault 1.17+. *Available only for Vault Enterprise*
318
- :param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
319
- *Available only for Vault Enterprise*
320
- :param pulumi.Input[int] max_retries: Number of max retries the client should use for recoverable errors.
321
- The default `-1` falls back to the AWS SDK's default behavior.
322
240
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
323
241
  The value should not contain leading or trailing forward slashes.
324
242
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
325
243
  *Available only for Vault Enterprise*.
326
- :param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
327
- *Available only for Vault Enterprise*
328
244
  :param pulumi.Input[str] secret_key: The AWS secret key that Vault should use for the
329
245
  auth backend.
330
246
  :param pulumi.Input[str] sts_endpoint: Override the URL Vault uses when making STS API
@@ -347,16 +263,8 @@ class _AuthBackendClientState:
347
263
  pulumi.set(__self__, "iam_endpoint", iam_endpoint)
348
264
  if iam_server_id_header_value is not None:
349
265
  pulumi.set(__self__, "iam_server_id_header_value", iam_server_id_header_value)
350
- if identity_token_audience is not None:
351
- pulumi.set(__self__, "identity_token_audience", identity_token_audience)
352
- if identity_token_ttl is not None:
353
- pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
354
- if max_retries is not None:
355
- pulumi.set(__self__, "max_retries", max_retries)
356
266
  if namespace is not None:
357
267
  pulumi.set(__self__, "namespace", namespace)
358
- if role_arn is not None:
359
- pulumi.set(__self__, "role_arn", role_arn)
360
268
  if secret_key is not None:
361
269
  pulumi.set(__self__, "secret_key", secret_key)
362
270
  if sts_endpoint is not None:
@@ -371,7 +279,7 @@ class _AuthBackendClientState:
371
279
  def access_key(self) -> Optional[pulumi.Input[str]]:
372
280
  """
373
281
  The AWS access key that Vault should use for the
374
- auth backend. Mutually exclusive with `identity_token_audience`.
282
+ auth backend.
375
283
  """
376
284
  return pulumi.get(self, "access_key")
377
285
 
@@ -432,45 +340,6 @@ class _AuthBackendClientState:
432
340
  def iam_server_id_header_value(self, value: Optional[pulumi.Input[str]]):
433
341
  pulumi.set(self, "iam_server_id_header_value", value)
434
342
 
435
- @property
436
- @pulumi.getter(name="identityTokenAudience")
437
- def identity_token_audience(self) -> Optional[pulumi.Input[str]]:
438
- """
439
- The audience claim value. Mutually exclusive with `access_key`.
440
- Requires Vault 1.17+. *Available only for Vault Enterprise*
441
- """
442
- return pulumi.get(self, "identity_token_audience")
443
-
444
- @identity_token_audience.setter
445
- def identity_token_audience(self, value: Optional[pulumi.Input[str]]):
446
- pulumi.set(self, "identity_token_audience", value)
447
-
448
- @property
449
- @pulumi.getter(name="identityTokenTtl")
450
- def identity_token_ttl(self) -> Optional[pulumi.Input[int]]:
451
- """
452
- The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
453
- *Available only for Vault Enterprise*
454
- """
455
- return pulumi.get(self, "identity_token_ttl")
456
-
457
- @identity_token_ttl.setter
458
- def identity_token_ttl(self, value: Optional[pulumi.Input[int]]):
459
- pulumi.set(self, "identity_token_ttl", value)
460
-
461
- @property
462
- @pulumi.getter(name="maxRetries")
463
- def max_retries(self) -> Optional[pulumi.Input[int]]:
464
- """
465
- Number of max retries the client should use for recoverable errors.
466
- The default `-1` falls back to the AWS SDK's default behavior.
467
- """
468
- return pulumi.get(self, "max_retries")
469
-
470
- @max_retries.setter
471
- def max_retries(self, value: Optional[pulumi.Input[int]]):
472
- pulumi.set(self, "max_retries", value)
473
-
474
343
  @property
475
344
  @pulumi.getter
476
345
  def namespace(self) -> Optional[pulumi.Input[str]]:
@@ -486,19 +355,6 @@ class _AuthBackendClientState:
486
355
  def namespace(self, value: Optional[pulumi.Input[str]]):
487
356
  pulumi.set(self, "namespace", value)
488
357
 
489
- @property
490
- @pulumi.getter(name="roleArn")
491
- def role_arn(self) -> Optional[pulumi.Input[str]]:
492
- """
493
- Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
494
- *Available only for Vault Enterprise*
495
- """
496
- return pulumi.get(self, "role_arn")
497
-
498
- @role_arn.setter
499
- def role_arn(self, value: Optional[pulumi.Input[str]]):
500
- pulumi.set(self, "role_arn", value)
501
-
502
358
  @property
503
359
  @pulumi.getter(name="secretKey")
504
360
  def secret_key(self) -> Optional[pulumi.Input[str]]:
@@ -565,11 +421,7 @@ class AuthBackendClient(pulumi.CustomResource):
565
421
  ec2_endpoint: Optional[pulumi.Input[str]] = None,
566
422
  iam_endpoint: Optional[pulumi.Input[str]] = None,
567
423
  iam_server_id_header_value: Optional[pulumi.Input[str]] = None,
568
- identity_token_audience: Optional[pulumi.Input[str]] = None,
569
- identity_token_ttl: Optional[pulumi.Input[int]] = None,
570
- max_retries: Optional[pulumi.Input[int]] = None,
571
424
  namespace: Optional[pulumi.Input[str]] = None,
572
- role_arn: Optional[pulumi.Input[str]] = None,
573
425
  secret_key: Optional[pulumi.Input[str]] = None,
574
426
  sts_endpoint: Optional[pulumi.Input[str]] = None,
575
427
  sts_region: Optional[pulumi.Input[str]] = None,
@@ -578,28 +430,18 @@ class AuthBackendClient(pulumi.CustomResource):
578
430
  """
579
431
  ## Example Usage
580
432
 
581
- You can setup the AWS auth engine with Workload Identity Federation (WIF) for a secret-less configuration:
433
+ <!--Start PulumiCodeChooser -->
582
434
  ```python
583
435
  import pulumi
584
436
  import pulumi_vault as vault
585
437
 
586
- example = vault.AuthBackend("example", type="aws")
587
- example_auth_backend_client = vault.aws.AuthBackendClient("example",
588
- identity_token_audience="<TOKEN_AUDIENCE>",
589
- identity_token_ttl="<TOKEN_TTL>",
590
- role_arn="<AWS_ROLE_ARN>")
591
- ```
592
-
593
- ```python
594
- import pulumi
595
- import pulumi_vault as vault
596
-
597
- example = vault.AuthBackend("example", type="aws")
598
- example_auth_backend_client = vault.aws.AuthBackendClient("example",
599
- backend=example.path,
438
+ example_auth_backend = vault.AuthBackend("exampleAuthBackend", type="aws")
439
+ example_auth_backend_client = vault.aws.AuthBackendClient("exampleAuthBackendClient",
440
+ backend=example_auth_backend.path,
600
441
  access_key="INSERT_AWS_ACCESS_KEY",
601
442
  secret_key="INSERT_AWS_SECRET_KEY")
602
443
  ```
444
+ <!--End PulumiCodeChooser -->
603
445
 
604
446
  ## Import
605
447
 
@@ -612,7 +454,7 @@ class AuthBackendClient(pulumi.CustomResource):
612
454
  :param str resource_name: The name of the resource.
613
455
  :param pulumi.ResourceOptions opts: Options for the resource.
614
456
  :param pulumi.Input[str] access_key: The AWS access key that Vault should use for the
615
- auth backend. Mutually exclusive with `identity_token_audience`.
457
+ auth backend.
616
458
  :param pulumi.Input[str] backend: The path the AWS auth backend being configured was
617
459
  mounted at. Defaults to `aws`.
618
460
  :param pulumi.Input[str] ec2_endpoint: Override the URL Vault uses when making EC2 API
@@ -622,18 +464,10 @@ class AuthBackendClient(pulumi.CustomResource):
622
464
  :param pulumi.Input[str] iam_server_id_header_value: The value to require in the
623
465
  `X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
624
466
  that are used in the IAM auth method.
625
- :param pulumi.Input[str] identity_token_audience: The audience claim value. Mutually exclusive with `access_key`.
626
- Requires Vault 1.17+. *Available only for Vault Enterprise*
627
- :param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
628
- *Available only for Vault Enterprise*
629
- :param pulumi.Input[int] max_retries: Number of max retries the client should use for recoverable errors.
630
- The default `-1` falls back to the AWS SDK's default behavior.
631
467
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
632
468
  The value should not contain leading or trailing forward slashes.
633
469
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
634
470
  *Available only for Vault Enterprise*.
635
- :param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
636
- *Available only for Vault Enterprise*
637
471
  :param pulumi.Input[str] secret_key: The AWS secret key that Vault should use for the
638
472
  auth backend.
639
473
  :param pulumi.Input[str] sts_endpoint: Override the URL Vault uses when making STS API
@@ -655,28 +489,18 @@ class AuthBackendClient(pulumi.CustomResource):
655
489
  """
656
490
  ## Example Usage
657
491
 
658
- You can setup the AWS auth engine with Workload Identity Federation (WIF) for a secret-less configuration:
659
- ```python
660
- import pulumi
661
- import pulumi_vault as vault
662
-
663
- example = vault.AuthBackend("example", type="aws")
664
- example_auth_backend_client = vault.aws.AuthBackendClient("example",
665
- identity_token_audience="<TOKEN_AUDIENCE>",
666
- identity_token_ttl="<TOKEN_TTL>",
667
- role_arn="<AWS_ROLE_ARN>")
668
- ```
669
-
492
+ <!--Start PulumiCodeChooser -->
670
493
  ```python
671
494
  import pulumi
672
495
  import pulumi_vault as vault
673
496
 
674
- example = vault.AuthBackend("example", type="aws")
675
- example_auth_backend_client = vault.aws.AuthBackendClient("example",
676
- backend=example.path,
497
+ example_auth_backend = vault.AuthBackend("exampleAuthBackend", type="aws")
498
+ example_auth_backend_client = vault.aws.AuthBackendClient("exampleAuthBackendClient",
499
+ backend=example_auth_backend.path,
677
500
  access_key="INSERT_AWS_ACCESS_KEY",
678
501
  secret_key="INSERT_AWS_SECRET_KEY")
679
502
  ```
503
+ <!--End PulumiCodeChooser -->
680
504
 
681
505
  ## Import
682
506
 
@@ -706,11 +530,7 @@ class AuthBackendClient(pulumi.CustomResource):
706
530
  ec2_endpoint: Optional[pulumi.Input[str]] = None,
707
531
  iam_endpoint: Optional[pulumi.Input[str]] = None,
708
532
  iam_server_id_header_value: Optional[pulumi.Input[str]] = None,
709
- identity_token_audience: Optional[pulumi.Input[str]] = None,
710
- identity_token_ttl: Optional[pulumi.Input[int]] = None,
711
- max_retries: Optional[pulumi.Input[int]] = None,
712
533
  namespace: Optional[pulumi.Input[str]] = None,
713
- role_arn: Optional[pulumi.Input[str]] = None,
714
534
  secret_key: Optional[pulumi.Input[str]] = None,
715
535
  sts_endpoint: Optional[pulumi.Input[str]] = None,
716
536
  sts_region: Optional[pulumi.Input[str]] = None,
@@ -729,11 +549,7 @@ class AuthBackendClient(pulumi.CustomResource):
729
549
  __props__.__dict__["ec2_endpoint"] = ec2_endpoint
730
550
  __props__.__dict__["iam_endpoint"] = iam_endpoint
731
551
  __props__.__dict__["iam_server_id_header_value"] = iam_server_id_header_value
732
- __props__.__dict__["identity_token_audience"] = identity_token_audience
733
- __props__.__dict__["identity_token_ttl"] = identity_token_ttl
734
- __props__.__dict__["max_retries"] = max_retries
735
552
  __props__.__dict__["namespace"] = namespace
736
- __props__.__dict__["role_arn"] = role_arn
737
553
  __props__.__dict__["secret_key"] = None if secret_key is None else pulumi.Output.secret(secret_key)
738
554
  __props__.__dict__["sts_endpoint"] = sts_endpoint
739
555
  __props__.__dict__["sts_region"] = sts_region
@@ -755,11 +571,7 @@ class AuthBackendClient(pulumi.CustomResource):
755
571
  ec2_endpoint: Optional[pulumi.Input[str]] = None,
756
572
  iam_endpoint: Optional[pulumi.Input[str]] = None,
757
573
  iam_server_id_header_value: Optional[pulumi.Input[str]] = None,
758
- identity_token_audience: Optional[pulumi.Input[str]] = None,
759
- identity_token_ttl: Optional[pulumi.Input[int]] = None,
760
- max_retries: Optional[pulumi.Input[int]] = None,
761
574
  namespace: Optional[pulumi.Input[str]] = None,
762
- role_arn: Optional[pulumi.Input[str]] = None,
763
575
  secret_key: Optional[pulumi.Input[str]] = None,
764
576
  sts_endpoint: Optional[pulumi.Input[str]] = None,
765
577
  sts_region: Optional[pulumi.Input[str]] = None,
@@ -772,7 +584,7 @@ class AuthBackendClient(pulumi.CustomResource):
772
584
  :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
773
585
  :param pulumi.ResourceOptions opts: Options for the resource.
774
586
  :param pulumi.Input[str] access_key: The AWS access key that Vault should use for the
775
- auth backend. Mutually exclusive with `identity_token_audience`.
587
+ auth backend.
776
588
  :param pulumi.Input[str] backend: The path the AWS auth backend being configured was
777
589
  mounted at. Defaults to `aws`.
778
590
  :param pulumi.Input[str] ec2_endpoint: Override the URL Vault uses when making EC2 API
@@ -782,18 +594,10 @@ class AuthBackendClient(pulumi.CustomResource):
782
594
  :param pulumi.Input[str] iam_server_id_header_value: The value to require in the
783
595
  `X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
784
596
  that are used in the IAM auth method.
785
- :param pulumi.Input[str] identity_token_audience: The audience claim value. Mutually exclusive with `access_key`.
786
- Requires Vault 1.17+. *Available only for Vault Enterprise*
787
- :param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
788
- *Available only for Vault Enterprise*
789
- :param pulumi.Input[int] max_retries: Number of max retries the client should use for recoverable errors.
790
- The default `-1` falls back to the AWS SDK's default behavior.
791
597
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
792
598
  The value should not contain leading or trailing forward slashes.
793
599
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
794
600
  *Available only for Vault Enterprise*.
795
- :param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
796
- *Available only for Vault Enterprise*
797
601
  :param pulumi.Input[str] secret_key: The AWS secret key that Vault should use for the
798
602
  auth backend.
799
603
  :param pulumi.Input[str] sts_endpoint: Override the URL Vault uses when making STS API
@@ -815,11 +619,7 @@ class AuthBackendClient(pulumi.CustomResource):
815
619
  __props__.__dict__["ec2_endpoint"] = ec2_endpoint
816
620
  __props__.__dict__["iam_endpoint"] = iam_endpoint
817
621
  __props__.__dict__["iam_server_id_header_value"] = iam_server_id_header_value
818
- __props__.__dict__["identity_token_audience"] = identity_token_audience
819
- __props__.__dict__["identity_token_ttl"] = identity_token_ttl
820
- __props__.__dict__["max_retries"] = max_retries
821
622
  __props__.__dict__["namespace"] = namespace
822
- __props__.__dict__["role_arn"] = role_arn
823
623
  __props__.__dict__["secret_key"] = secret_key
824
624
  __props__.__dict__["sts_endpoint"] = sts_endpoint
825
625
  __props__.__dict__["sts_region"] = sts_region
@@ -831,7 +631,7 @@ class AuthBackendClient(pulumi.CustomResource):
831
631
  def access_key(self) -> pulumi.Output[Optional[str]]:
832
632
  """
833
633
  The AWS access key that Vault should use for the
834
- auth backend. Mutually exclusive with `identity_token_audience`.
634
+ auth backend.
835
635
  """
836
636
  return pulumi.get(self, "access_key")
837
637
 
@@ -872,33 +672,6 @@ class AuthBackendClient(pulumi.CustomResource):
872
672
  """
873
673
  return pulumi.get(self, "iam_server_id_header_value")
874
674
 
875
- @property
876
- @pulumi.getter(name="identityTokenAudience")
877
- def identity_token_audience(self) -> pulumi.Output[Optional[str]]:
878
- """
879
- The audience claim value. Mutually exclusive with `access_key`.
880
- Requires Vault 1.17+. *Available only for Vault Enterprise*
881
- """
882
- return pulumi.get(self, "identity_token_audience")
883
-
884
- @property
885
- @pulumi.getter(name="identityTokenTtl")
886
- def identity_token_ttl(self) -> pulumi.Output[int]:
887
- """
888
- The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
889
- *Available only for Vault Enterprise*
890
- """
891
- return pulumi.get(self, "identity_token_ttl")
892
-
893
- @property
894
- @pulumi.getter(name="maxRetries")
895
- def max_retries(self) -> pulumi.Output[Optional[int]]:
896
- """
897
- Number of max retries the client should use for recoverable errors.
898
- The default `-1` falls back to the AWS SDK's default behavior.
899
- """
900
- return pulumi.get(self, "max_retries")
901
-
902
675
  @property
903
676
  @pulumi.getter
904
677
  def namespace(self) -> pulumi.Output[Optional[str]]:
@@ -910,15 +683,6 @@ class AuthBackendClient(pulumi.CustomResource):
910
683
  """
911
684
  return pulumi.get(self, "namespace")
912
685
 
913
- @property
914
- @pulumi.getter(name="roleArn")
915
- def role_arn(self) -> pulumi.Output[Optional[str]]:
916
- """
917
- Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
918
- *Available only for Vault Enterprise*
919
- """
920
- return pulumi.get(self, "role_arn")
921
-
922
686
  @property
923
687
  @pulumi.getter(name="secretKey")
924
688
  def secret_key(self) -> pulumi.Output[Optional[str]]:
pulumi_vault/aws/auth_backend_config_identity.py CHANGED
@@ -266,6 +266,7 @@ class AuthBackendConfigIdentity(pulumi.CustomResource):
266
266
 
267
267
  ## Example Usage
268
268
 
269
+ <!--Start PulumiCodeChooser -->
269
270
  ```python
270
271
  import pulumi
271
272
  import pulumi_vault as vault
@@ -279,6 +280,7 @@ class AuthBackendConfigIdentity(pulumi.CustomResource):
279
280
  "account_id",
280
281
  ])
281
282
  ```
283
+ <!--End PulumiCodeChooser -->
282
284
 
283
285
  ## Import
284
286
 
@@ -317,6 +319,7 @@ class AuthBackendConfigIdentity(pulumi.CustomResource):
317
319
 
318
320
  ## Example Usage
319
321
 
322
+ <!--Start PulumiCodeChooser -->
320
323
  ```python
321
324
  import pulumi
322
325
  import pulumi_vault as vault
@@ -330,6 +333,7 @@ class AuthBackendConfigIdentity(pulumi.CustomResource):
330
333
  "account_id",
331
334
  ])
332
335
  ```
336
+ <!--End PulumiCodeChooser -->
333
337
 
334
338
  ## Import
335
339
 
pulumi_vault/aws/auth_backend_identity_whitelist.py CHANGED
@@ -197,15 +197,17 @@ class AuthBackendIdentityWhitelist(pulumi.CustomResource):
197
197
 
198
198
  ## Example Usage
199
199
 
200
+ <!--Start PulumiCodeChooser -->
200
201
  ```python
201
202
  import pulumi
202
203
  import pulumi_vault as vault
203
204
 
204
- example = vault.AuthBackend("example", type="aws")
205
- example_auth_backend_identity_whitelist = vault.aws.AuthBackendIdentityWhitelist("example",
206
- backend=example.path,
205
+ example_auth_backend = vault.AuthBackend("exampleAuthBackend", type="aws")
206
+ example_auth_backend_identity_whitelist = vault.aws.AuthBackendIdentityWhitelist("exampleAuthBackendIdentityWhitelist",
207
+ backend=example_auth_backend.path,
207
208
  safety_buffer=3600)
208
209
  ```
210
+ <!--End PulumiCodeChooser -->
209
211
 
210
212
  ## Import
211
213
 
@@ -242,15 +244,17 @@ class AuthBackendIdentityWhitelist(pulumi.CustomResource):
242
244
 
243
245
  ## Example Usage
244
246
 
247
+ <!--Start PulumiCodeChooser -->
245
248
  ```python
246
249
  import pulumi
247
250
  import pulumi_vault as vault
248
251
 
249
- example = vault.AuthBackend("example", type="aws")
250
- example_auth_backend_identity_whitelist = vault.aws.AuthBackendIdentityWhitelist("example",
251
- backend=example.path,
252
+ example_auth_backend = vault.AuthBackend("exampleAuthBackend", type="aws")
253
+ example_auth_backend_identity_whitelist = vault.aws.AuthBackendIdentityWhitelist("exampleAuthBackendIdentityWhitelist",
254
+ backend=example_auth_backend.path,
252
255
  safety_buffer=3600)
253
256
  ```
257
+ <!--End PulumiCodeChooser -->
254
258
 
255
259
  ## Import
256
260
 
pulumi_vault/aws/auth_backend_login.py CHANGED
@@ -270,6 +270,7 @@ class _AuthBackendLoginState:
270
270
  authenticate with. Can be retrieved from the EC2 metadata server.
271
271
  :param pulumi.Input[int] lease_duration: The duration in seconds the token will be valid, relative
272
272
  to the time in `lease_start_time`.
273
+ :param pulumi.Input[str] lease_start_time: Time at which the lease was read, using the clock of the system where Terraform was running
273
274
  :param pulumi.Input[Mapping[str, Any]] metadata: A map of information returned by the Vault server about the
274
275
  authentication used to generate this token.
275
276
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -460,6 +461,9 @@ class _AuthBackendLoginState:
460
461
  @property
461
462
  @pulumi.getter(name="leaseStartTime")
462
463
  def lease_start_time(self) -> Optional[pulumi.Input[str]]:
464
+ """
465
+ Time at which the lease was read, using the clock of the system where Terraform was running
466
+ """
463
467
  return pulumi.get(self, "lease_start_time")
464
468
 
465
469
  @lease_start_time.setter
@@ -750,6 +754,7 @@ class AuthBackendLogin(pulumi.CustomResource):
750
754
  authenticate with. Can be retrieved from the EC2 metadata server.
751
755
  :param pulumi.Input[int] lease_duration: The duration in seconds the token will be valid, relative
752
756
  to the time in `lease_start_time`.
757
+ :param pulumi.Input[str] lease_start_time: Time at which the lease was read, using the clock of the system where Terraform was running
753
758
  :param pulumi.Input[Mapping[str, Any]] metadata: A map of information returned by the Vault server about the
754
759
  authentication used to generate this token.
755
760
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -886,6 +891,9 @@ class AuthBackendLogin(pulumi.CustomResource):
886
891
  @property
887
892
  @pulumi.getter(name="leaseStartTime")
888
893
  def lease_start_time(self) -> pulumi.Output[str]:
894
+ """
895
+ Time at which the lease was read, using the clock of the system where Terraform was running
896
+ """
889
897
  return pulumi.get(self, "lease_start_time")
890
898
 
891
899
  @property