pulumi-vault 6.2.0__py3-none-any.whl → 6.2.0a1712731873__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (192) hide show
  1. pulumi_vault/__init__.py +0 -26
  2. pulumi_vault/_inputs.py +20 -0
  3. pulumi_vault/ad/secret_backend.py +6 -2
  4. pulumi_vault/ad/secret_library.py +4 -2
  5. pulumi_vault/ad/secret_role.py +4 -0
  6. pulumi_vault/alicloud/auth_backend_role.py +192 -69
  7. pulumi_vault/approle/auth_backend_login.py +4 -0
  8. pulumi_vault/approle/auth_backend_role.py +186 -63
  9. pulumi_vault/approle/auth_backend_role_secret_id.py +4 -0
  10. pulumi_vault/approle/get_auth_backend_role_id.py +4 -0
  11. pulumi_vault/audit.py +20 -12
  12. pulumi_vault/audit_request_header.py +6 -6
  13. pulumi_vault/auth_backend.py +0 -47
  14. pulumi_vault/aws/auth_backend_client.py +17 -253
  15. pulumi_vault/aws/auth_backend_config_identity.py +4 -0
  16. pulumi_vault/aws/auth_backend_identity_whitelist.py +10 -6
  17. pulumi_vault/aws/auth_backend_login.py +8 -0
  18. pulumi_vault/aws/auth_backend_role.py +186 -63
  19. pulumi_vault/aws/auth_backend_roletag_blacklist.py +10 -6
  20. pulumi_vault/aws/auth_backend_sts_role.py +4 -0
  21. pulumi_vault/aws/secret_backend_role.py +4 -56
  22. pulumi_vault/aws/secret_backend_static_role.py +4 -2
  23. pulumi_vault/azure/auth_backend_config.py +10 -139
  24. pulumi_vault/azure/auth_backend_role.py +186 -63
  25. pulumi_vault/azure/backend.py +22 -217
  26. pulumi_vault/azure/backend_role.py +18 -14
  27. pulumi_vault/azure/get_access_credentials.py +4 -0
  28. pulumi_vault/cert_auth_backend_role.py +208 -75
  29. pulumi_vault/consul/secret_backend.py +18 -10
  30. pulumi_vault/consul/secret_backend_role.py +4 -2
  31. pulumi_vault/database/_inputs.py +784 -522
  32. pulumi_vault/database/outputs.py +784 -522
  33. pulumi_vault/database/secret_backend_connection.py +4 -2
  34. pulumi_vault/database/secret_backend_role.py +4 -4
  35. pulumi_vault/database/secret_backend_static_role.py +8 -10
  36. pulumi_vault/database/secrets_mount.py +4 -286
  37. pulumi_vault/egp_policy.py +8 -4
  38. pulumi_vault/gcp/auth_backend.py +18 -226
  39. pulumi_vault/gcp/auth_backend_role.py +264 -63
  40. pulumi_vault/gcp/get_auth_backend_role.py +4 -0
  41. pulumi_vault/gcp/secret_backend.py +9 -275
  42. pulumi_vault/gcp/secret_impersonated_account.py +14 -12
  43. pulumi_vault/gcp/secret_roleset.py +6 -4
  44. pulumi_vault/gcp/secret_static_account.py +16 -14
  45. pulumi_vault/generic/endpoint.py +8 -4
  46. pulumi_vault/generic/get_secret.py +4 -40
  47. pulumi_vault/get_auth_backend.py +4 -0
  48. pulumi_vault/get_auth_backends.py +8 -0
  49. pulumi_vault/get_namespace.py +12 -0
  50. pulumi_vault/get_namespaces.py +12 -4
  51. pulumi_vault/get_nomad_access_token.py +4 -0
  52. pulumi_vault/get_policy_document.py +8 -8
  53. pulumi_vault/get_raft_autopilot_state.py +4 -0
  54. pulumi_vault/github/auth_backend.py +4 -0
  55. pulumi_vault/github/team.py +6 -2
  56. pulumi_vault/github/user.py +6 -2
  57. pulumi_vault/identity/entity.py +8 -6
  58. pulumi_vault/identity/entity_alias.py +8 -6
  59. pulumi_vault/identity/entity_policies.py +12 -12
  60. pulumi_vault/identity/get_entity.py +4 -0
  61. pulumi_vault/identity/get_group.py +4 -0
  62. pulumi_vault/identity/get_oidc_client_creds.py +4 -2
  63. pulumi_vault/identity/get_oidc_openid_config.py +6 -10
  64. pulumi_vault/identity/get_oidc_public_keys.py +6 -10
  65. pulumi_vault/identity/group.py +42 -38
  66. pulumi_vault/identity/group_alias.py +4 -2
  67. pulumi_vault/identity/group_member_entity_ids.py +16 -12
  68. pulumi_vault/identity/group_member_group_ids.py +20 -24
  69. pulumi_vault/identity/group_policies.py +8 -4
  70. pulumi_vault/identity/mfa_duo.py +8 -4
  71. pulumi_vault/identity/mfa_login_enforcement.py +8 -8
  72. pulumi_vault/identity/mfa_okta.py +8 -4
  73. pulumi_vault/identity/mfa_pingid.py +4 -0
  74. pulumi_vault/identity/mfa_totp.py +4 -0
  75. pulumi_vault/identity/oidc.py +4 -0
  76. pulumi_vault/identity/oidc_assignment.py +6 -10
  77. pulumi_vault/identity/oidc_client.py +10 -10
  78. pulumi_vault/identity/oidc_key.py +12 -16
  79. pulumi_vault/identity/oidc_key_allowed_client_id.py +12 -16
  80. pulumi_vault/identity/oidc_provider.py +16 -22
  81. pulumi_vault/identity/oidc_role.py +20 -28
  82. pulumi_vault/identity/oidc_scope.py +8 -6
  83. pulumi_vault/jwt/auth_backend.py +32 -20
  84. pulumi_vault/jwt/auth_backend_role.py +225 -91
  85. pulumi_vault/kmip/secret_backend.py +14 -10
  86. pulumi_vault/kmip/secret_role.py +4 -0
  87. pulumi_vault/kmip/secret_scope.py +4 -0
  88. pulumi_vault/kubernetes/auth_backend_config.py +4 -0
  89. pulumi_vault/kubernetes/auth_backend_role.py +172 -56
  90. pulumi_vault/kubernetes/get_service_account_token.py +8 -8
  91. pulumi_vault/kubernetes/secret_backend.py +8 -288
  92. pulumi_vault/kubernetes/secret_backend_role.py +24 -24
  93. pulumi_vault/kv/get_secret.py +4 -0
  94. pulumi_vault/kv/get_secret_subkeys_v2.py +6 -4
  95. pulumi_vault/kv/get_secret_v2.py +0 -58
  96. pulumi_vault/kv/get_secrets_list.py +8 -4
  97. pulumi_vault/kv/get_secrets_list_v2.py +12 -14
  98. pulumi_vault/kv/secret.py +4 -0
  99. pulumi_vault/kv/secret_backend_v2.py +4 -0
  100. pulumi_vault/kv/secret_v2.py +4 -2
  101. pulumi_vault/ldap/auth_backend.py +161 -66
  102. pulumi_vault/ldap/auth_backend_group.py +4 -0
  103. pulumi_vault/ldap/auth_backend_user.py +4 -0
  104. pulumi_vault/ldap/secret_backend.py +8 -286
  105. pulumi_vault/ldap/secret_backend_dynamic_role.py +4 -0
  106. pulumi_vault/ldap/secret_backend_library_set.py +4 -2
  107. pulumi_vault/ldap/secret_backend_static_role.py +4 -0
  108. pulumi_vault/managed/_inputs.py +132 -84
  109. pulumi_vault/managed/keys.py +28 -7
  110. pulumi_vault/managed/outputs.py +132 -84
  111. pulumi_vault/mfa_duo.py +6 -4
  112. pulumi_vault/mfa_okta.py +6 -4
  113. pulumi_vault/mfa_pingid.py +6 -4
  114. pulumi_vault/mfa_totp.py +12 -10
  115. pulumi_vault/mongodbatlas/secret_backend.py +4 -0
  116. pulumi_vault/mongodbatlas/secret_role.py +4 -2
  117. pulumi_vault/mount.py +42 -350
  118. pulumi_vault/nomad_secret_backend.py +8 -4
  119. pulumi_vault/nomad_secret_role.py +4 -0
  120. pulumi_vault/okta/_inputs.py +8 -8
  121. pulumi_vault/okta/auth_backend.py +10 -459
  122. pulumi_vault/okta/auth_backend_group.py +4 -0
  123. pulumi_vault/okta/auth_backend_user.py +4 -0
  124. pulumi_vault/okta/outputs.py +8 -8
  125. pulumi_vault/outputs.py +20 -0
  126. pulumi_vault/password_policy.py +8 -6
  127. pulumi_vault/pkisecret/__init__.py +0 -2
  128. pulumi_vault/pkisecret/_inputs.py +0 -30
  129. pulumi_vault/pkisecret/backend_config_cluster.py +4 -0
  130. pulumi_vault/pkisecret/get_backend_issuer.py +0 -36
  131. pulumi_vault/pkisecret/get_backend_issuers.py +4 -0
  132. pulumi_vault/pkisecret/get_backend_key.py +6 -2
  133. pulumi_vault/pkisecret/get_backend_keys.py +4 -0
  134. pulumi_vault/pkisecret/outputs.py +0 -54
  135. pulumi_vault/pkisecret/secret_backend_cert.py +8 -6
  136. pulumi_vault/pkisecret/secret_backend_config_ca.py +8 -4
  137. pulumi_vault/pkisecret/secret_backend_config_issuers.py +4 -0
  138. pulumi_vault/pkisecret/secret_backend_config_urls.py +4 -0
  139. pulumi_vault/pkisecret/secret_backend_crl_config.py +6 -2
  140. pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +8 -4
  141. pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +14 -10
  142. pulumi_vault/pkisecret/secret_backend_issuer.py +4 -0
  143. pulumi_vault/pkisecret/secret_backend_role.py +4 -2
  144. pulumi_vault/pkisecret/secret_backend_root_cert.py +8 -4
  145. pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +10 -6
  146. pulumi_vault/pkisecret/secret_backend_sign.py +8 -6
  147. pulumi_vault/provider.py +8 -0
  148. pulumi_vault/pulumi-plugin.json +1 -2
  149. pulumi_vault/quota_lease_count.py +8 -53
  150. pulumi_vault/quota_rate_limit.py +4 -49
  151. pulumi_vault/rabbitmq/secret_backend.py +8 -4
  152. pulumi_vault/rabbitmq/secret_backend_role.py +4 -2
  153. pulumi_vault/raft_autopilot.py +4 -0
  154. pulumi_vault/raft_snapshot_agent_config.py +304 -109
  155. pulumi_vault/rgp_policy.py +6 -2
  156. pulumi_vault/saml/auth_backend.py +12 -8
  157. pulumi_vault/saml/auth_backend_role.py +178 -64
  158. pulumi_vault/secrets/sync_association.py +10 -12
  159. pulumi_vault/secrets/sync_aws_destination.py +8 -6
  160. pulumi_vault/secrets/sync_azure_destination.py +12 -10
  161. pulumi_vault/secrets/sync_config.py +6 -2
  162. pulumi_vault/secrets/sync_gcp_destination.py +6 -6
  163. pulumi_vault/secrets/sync_gh_destination.py +8 -6
  164. pulumi_vault/secrets/sync_github_apps.py +8 -8
  165. pulumi_vault/secrets/sync_vercel_destination.py +8 -6
  166. pulumi_vault/ssh/_inputs.py +32 -6
  167. pulumi_vault/ssh/outputs.py +32 -6
  168. pulumi_vault/ssh/secret_backend_ca.py +4 -94
  169. pulumi_vault/ssh/secret_backend_role.py +4 -4
  170. pulumi_vault/terraformcloud/secret_backend.py +56 -0
  171. pulumi_vault/terraformcloud/secret_creds.py +17 -2
  172. pulumi_vault/terraformcloud/secret_role.py +69 -2
  173. pulumi_vault/token.py +18 -14
  174. pulumi_vault/tokenauth/auth_backend_role.py +180 -64
  175. pulumi_vault/transform/alphabet.py +6 -4
  176. pulumi_vault/transform/get_decode.py +4 -4
  177. pulumi_vault/transform/get_encode.py +4 -4
  178. pulumi_vault/transform/role.py +6 -4
  179. pulumi_vault/transform/template.py +4 -4
  180. pulumi_vault/transit/get_decrypt.py +20 -4
  181. pulumi_vault/transit/get_encrypt.py +14 -0
  182. pulumi_vault/transit/secret_backend_key.py +6 -6
  183. pulumi_vault/transit/secret_cache_config.py +4 -0
  184. {pulumi_vault-6.2.0.dist-info → pulumi_vault-6.2.0a1712731873.dist-info}/METADATA +1 -1
  185. pulumi_vault-6.2.0a1712731873.dist-info/RECORD +252 -0
  186. {pulumi_vault-6.2.0.dist-info → pulumi_vault-6.2.0a1712731873.dist-info}/WHEEL +1 -1
  187. pulumi_vault/pkisecret/backend_config_est.py +0 -614
  188. pulumi_vault/pkisecret/get_backend_config_est.py +0 -233
  189. pulumi_vault/plugin.py +0 -590
  190. pulumi_vault/plugin_pinned_version.py +0 -293
  191. pulumi_vault-6.2.0.dist-info/RECORD +0 -256
  192. {pulumi_vault-6.2.0.dist-info → pulumi_vault-6.2.0a1712731873.dist-info}/top_level.txt +0 -0
pulumi_vault/gcp/auth_backend_role.py CHANGED
@@ -40,22 +40,45 @@ class AuthBackendRoleArgs:
40
40
  The set of arguments for constructing a AuthBackendRole resource.
41
41
  :param pulumi.Input[str] role: Name of the GCP role
42
42
  :param pulumi.Input[str] type: Type of GCP authentication role (either `gce` or `iam`)
43
+ :param pulumi.Input[bool] allow_gce_inference: A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
43
44
  :param pulumi.Input[str] backend: Path to the mounted GCP auth backend
45
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_instance_groups: The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
46
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_labels: A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
44
47
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_projects: An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.
48
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_regions: The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
45
49
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_service_accounts: GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is `iam`)
50
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_zones: The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
51
+ :param pulumi.Input[str] max_jwt_exp: The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
46
52
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
47
53
  The value should not contain leading or trailing forward slashes.
48
54
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
49
55
  *Available only for Vault Enterprise*.
50
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
51
- :param pulumi.Input[int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
52
- :param pulumi.Input[int] token_max_ttl: The maximum lifetime of the generated token
53
- :param pulumi.Input[bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
54
- :param pulumi.Input[int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
55
- :param pulumi.Input[int] token_period: Generated Token's Period
56
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: Generated Token's Policies
57
- :param pulumi.Input[int] token_ttl: The initial ttl of the token to generate in seconds
58
- :param pulumi.Input[str] token_type: The type of token to generate, service or batch
56
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: List of CIDR blocks; if set, specifies blocks of IP
57
+ addresses which can authenticate successfully, and ties the resulting token to these blocks
58
+ as well.
59
+ :param pulumi.Input[int] token_explicit_max_ttl: If set, will encode an
60
+ [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
61
+ onto the token in number of seconds. This is a hard cap even if `token_ttl` and
62
+ `token_max_ttl` would otherwise allow a renewal.
63
+ :param pulumi.Input[int] token_max_ttl: The maximum lifetime for generated tokens in number of seconds.
64
+ Its current value will be referenced at renewal time.
65
+ :param pulumi.Input[bool] token_no_default_policy: If set, the default policy will not be set on
66
+ generated tokens; otherwise it will be added to the policies set in token_policies.
67
+ :param pulumi.Input[int] token_num_uses: The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
68
+ of times a generated token may be used (within its lifetime); 0 means unlimited.
69
+ :param pulumi.Input[int] token_period: If set, indicates that the
70
+ token generated using this role should never expire. The token should be renewed within the
71
+ duration specified by this value. At each renewal, the token's TTL will be set to the
72
+ value of this field. Specified in seconds.
73
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: List of policies to encode onto generated tokens. Depending
74
+ on the auth method, this list may be supplemented by user/group/other values.
75
+ :param pulumi.Input[int] token_ttl: The incremental lifetime for generated tokens in number of seconds.
76
+ Its current value will be referenced at renewal time.
77
+ :param pulumi.Input[str] token_type: The type of token that should be generated. Can be `service`,
78
+ `batch`, or `default` to use the mount's tuned default (which unless changed will be
79
+ `service` tokens). For token store roles, there are two additional possibilities:
80
+ `default-service` and `default-batch` which specify the type to return unless the client
81
+ requests a different type at generation time.
59
82
  """
60
83
  pulumi.set(__self__, "role", role)
61
84
  pulumi.set(__self__, "type", type)
@@ -136,6 +159,9 @@ class AuthBackendRoleArgs:
136
159
  @property
137
160
  @pulumi.getter(name="allowGceInference")
138
161
  def allow_gce_inference(self) -> Optional[pulumi.Input[bool]]:
162
+ """
163
+ A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
164
+ """
139
165
  return pulumi.get(self, "allow_gce_inference")
140
166
 
141
167
  @allow_gce_inference.setter
@@ -157,6 +183,9 @@ class AuthBackendRoleArgs:
157
183
  @property
158
184
  @pulumi.getter(name="boundInstanceGroups")
159
185
  def bound_instance_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
186
+ """
187
+ The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
188
+ """
160
189
  return pulumi.get(self, "bound_instance_groups")
161
190
 
162
191
  @bound_instance_groups.setter
@@ -166,6 +195,9 @@ class AuthBackendRoleArgs:
166
195
  @property
167
196
  @pulumi.getter(name="boundLabels")
168
197
  def bound_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
198
+ """
199
+ A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
200
+ """
169
201
  return pulumi.get(self, "bound_labels")
170
202
 
171
203
  @bound_labels.setter
@@ -187,6 +219,9 @@ class AuthBackendRoleArgs:
187
219
  @property
188
220
  @pulumi.getter(name="boundRegions")
189
221
  def bound_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
222
+ """
223
+ The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
224
+ """
190
225
  return pulumi.get(self, "bound_regions")
191
226
 
192
227
  @bound_regions.setter
@@ -208,6 +243,9 @@ class AuthBackendRoleArgs:
208
243
  @property
209
244
  @pulumi.getter(name="boundZones")
210
245
  def bound_zones(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
246
+ """
247
+ The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
248
+ """
211
249
  return pulumi.get(self, "bound_zones")
212
250
 
213
251
  @bound_zones.setter
@@ -217,6 +255,9 @@ class AuthBackendRoleArgs:
217
255
  @property
218
256
  @pulumi.getter(name="maxJwtExp")
219
257
  def max_jwt_exp(self) -> Optional[pulumi.Input[str]]:
258
+ """
259
+ The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
260
+ """
220
261
  return pulumi.get(self, "max_jwt_exp")
221
262
 
222
263
  @max_jwt_exp.setter
@@ -242,7 +283,9 @@ class AuthBackendRoleArgs:
242
283
  @pulumi.getter(name="tokenBoundCidrs")
243
284
  def token_bound_cidrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
244
285
  """
245
- Specifies the blocks of IP addresses which are allowed to use the generated token
286
+ List of CIDR blocks; if set, specifies blocks of IP
287
+ addresses which can authenticate successfully, and ties the resulting token to these blocks
288
+ as well.
246
289
  """
247
290
  return pulumi.get(self, "token_bound_cidrs")
248
291
 
@@ -254,7 +297,10 @@ class AuthBackendRoleArgs:
254
297
  @pulumi.getter(name="tokenExplicitMaxTtl")
255
298
  def token_explicit_max_ttl(self) -> Optional[pulumi.Input[int]]:
256
299
  """
257
- Generated Token's Explicit Maximum TTL in seconds
300
+ If set, will encode an
301
+ [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
302
+ onto the token in number of seconds. This is a hard cap even if `token_ttl` and
303
+ `token_max_ttl` would otherwise allow a renewal.
258
304
  """
259
305
  return pulumi.get(self, "token_explicit_max_ttl")
260
306
 
@@ -266,7 +312,8 @@ class AuthBackendRoleArgs:
266
312
  @pulumi.getter(name="tokenMaxTtl")
267
313
  def token_max_ttl(self) -> Optional[pulumi.Input[int]]:
268
314
  """
269
- The maximum lifetime of the generated token
315
+ The maximum lifetime for generated tokens in number of seconds.
316
+ Its current value will be referenced at renewal time.
270
317
  """
271
318
  return pulumi.get(self, "token_max_ttl")
272
319
 
@@ -278,7 +325,8 @@ class AuthBackendRoleArgs:
278
325
  @pulumi.getter(name="tokenNoDefaultPolicy")
279
326
  def token_no_default_policy(self) -> Optional[pulumi.Input[bool]]:
280
327
  """
281
- If true, the 'default' policy will not automatically be added to generated tokens
328
+ If set, the default policy will not be set on
329
+ generated tokens; otherwise it will be added to the policies set in token_policies.
282
330
  """
283
331
  return pulumi.get(self, "token_no_default_policy")
284
332
 
@@ -290,7 +338,8 @@ class AuthBackendRoleArgs:
290
338
  @pulumi.getter(name="tokenNumUses")
291
339
  def token_num_uses(self) -> Optional[pulumi.Input[int]]:
292
340
  """
293
- The maximum number of times a token may be used, a value of zero means unlimited
341
+ The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
342
+ of times a generated token may be used (within its lifetime); 0 means unlimited.
294
343
  """
295
344
  return pulumi.get(self, "token_num_uses")
296
345
 
@@ -302,7 +351,10 @@ class AuthBackendRoleArgs:
302
351
  @pulumi.getter(name="tokenPeriod")
303
352
  def token_period(self) -> Optional[pulumi.Input[int]]:
304
353
  """
305
- Generated Token's Period
354
+ If set, indicates that the
355
+ token generated using this role should never expire. The token should be renewed within the
356
+ duration specified by this value. At each renewal, the token's TTL will be set to the
357
+ value of this field. Specified in seconds.
306
358
  """
307
359
  return pulumi.get(self, "token_period")
308
360
 
@@ -314,7 +366,8 @@ class AuthBackendRoleArgs:
314
366
  @pulumi.getter(name="tokenPolicies")
315
367
  def token_policies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
316
368
  """
317
- Generated Token's Policies
369
+ List of policies to encode onto generated tokens. Depending
370
+ on the auth method, this list may be supplemented by user/group/other values.
318
371
  """
319
372
  return pulumi.get(self, "token_policies")
320
373
 
@@ -326,7 +379,8 @@ class AuthBackendRoleArgs:
326
379
  @pulumi.getter(name="tokenTtl")
327
380
  def token_ttl(self) -> Optional[pulumi.Input[int]]:
328
381
  """
329
- The initial ttl of the token to generate in seconds
382
+ The incremental lifetime for generated tokens in number of seconds.
383
+ Its current value will be referenced at renewal time.
330
384
  """
331
385
  return pulumi.get(self, "token_ttl")
332
386
 
@@ -338,7 +392,11 @@ class AuthBackendRoleArgs:
338
392
  @pulumi.getter(name="tokenType")
339
393
  def token_type(self) -> Optional[pulumi.Input[str]]:
340
394
  """
341
- The type of token to generate, service or batch
395
+ The type of token that should be generated. Can be `service`,
396
+ `batch`, or `default` to use the mount's tuned default (which unless changed will be
397
+ `service` tokens). For token store roles, there are two additional possibilities:
398
+ `default-service` and `default-batch` which specify the type to return unless the client
399
+ requests a different type at generation time.
342
400
  """
343
401
  return pulumi.get(self, "token_type")
344
402
 
@@ -374,23 +432,46 @@ class _AuthBackendRoleState:
374
432
  type: Optional[pulumi.Input[str]] = None):
375
433
  """
376
434
  Input properties used for looking up and filtering AuthBackendRole resources.
435
+ :param pulumi.Input[bool] allow_gce_inference: A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
377
436
  :param pulumi.Input[str] backend: Path to the mounted GCP auth backend
437
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_instance_groups: The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
438
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_labels: A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
378
439
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_projects: An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.
440
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_regions: The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
379
441
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_service_accounts: GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is `iam`)
442
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_zones: The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
443
+ :param pulumi.Input[str] max_jwt_exp: The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
380
444
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
381
445
  The value should not contain leading or trailing forward slashes.
382
446
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
383
447
  *Available only for Vault Enterprise*.
384
448
  :param pulumi.Input[str] role: Name of the GCP role
385
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
386
- :param pulumi.Input[int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
387
- :param pulumi.Input[int] token_max_ttl: The maximum lifetime of the generated token
388
- :param pulumi.Input[bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
389
- :param pulumi.Input[int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
390
- :param pulumi.Input[int] token_period: Generated Token's Period
391
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: Generated Token's Policies
392
- :param pulumi.Input[int] token_ttl: The initial ttl of the token to generate in seconds
393
- :param pulumi.Input[str] token_type: The type of token to generate, service or batch
449
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: List of CIDR blocks; if set, specifies blocks of IP
450
+ addresses which can authenticate successfully, and ties the resulting token to these blocks
451
+ as well.
452
+ :param pulumi.Input[int] token_explicit_max_ttl: If set, will encode an
453
+ [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
454
+ onto the token in number of seconds. This is a hard cap even if `token_ttl` and
455
+ `token_max_ttl` would otherwise allow a renewal.
456
+ :param pulumi.Input[int] token_max_ttl: The maximum lifetime for generated tokens in number of seconds.
457
+ Its current value will be referenced at renewal time.
458
+ :param pulumi.Input[bool] token_no_default_policy: If set, the default policy will not be set on
459
+ generated tokens; otherwise it will be added to the policies set in token_policies.
460
+ :param pulumi.Input[int] token_num_uses: The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
461
+ of times a generated token may be used (within its lifetime); 0 means unlimited.
462
+ :param pulumi.Input[int] token_period: If set, indicates that the
463
+ token generated using this role should never expire. The token should be renewed within the
464
+ duration specified by this value. At each renewal, the token's TTL will be set to the
465
+ value of this field. Specified in seconds.
466
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: List of policies to encode onto generated tokens. Depending
467
+ on the auth method, this list may be supplemented by user/group/other values.
468
+ :param pulumi.Input[int] token_ttl: The incremental lifetime for generated tokens in number of seconds.
469
+ Its current value will be referenced at renewal time.
470
+ :param pulumi.Input[str] token_type: The type of token that should be generated. Can be `service`,
471
+ `batch`, or `default` to use the mount's tuned default (which unless changed will be
472
+ `service` tokens). For token store roles, there are two additional possibilities:
473
+ `default-service` and `default-batch` which specify the type to return unless the client
474
+ requests a different type at generation time.
394
475
  :param pulumi.Input[str] type: Type of GCP authentication role (either `gce` or `iam`)
395
476
  """
396
477
  if add_group_aliases is not None:
@@ -450,6 +531,9 @@ class _AuthBackendRoleState:
450
531
  @property
451
532
  @pulumi.getter(name="allowGceInference")
452
533
  def allow_gce_inference(self) -> Optional[pulumi.Input[bool]]:
534
+ """
535
+ A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
536
+ """
453
537
  return pulumi.get(self, "allow_gce_inference")
454
538
 
455
539
  @allow_gce_inference.setter
@@ -471,6 +555,9 @@ class _AuthBackendRoleState:
471
555
  @property
472
556
  @pulumi.getter(name="boundInstanceGroups")
473
557
  def bound_instance_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
558
+ """
559
+ The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
560
+ """
474
561
  return pulumi.get(self, "bound_instance_groups")
475
562
 
476
563
  @bound_instance_groups.setter
@@ -480,6 +567,9 @@ class _AuthBackendRoleState:
480
567
  @property
481
568
  @pulumi.getter(name="boundLabels")
482
569
  def bound_labels(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
570
+ """
571
+ A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
572
+ """
483
573
  return pulumi.get(self, "bound_labels")
484
574
 
485
575
  @bound_labels.setter
@@ -501,6 +591,9 @@ class _AuthBackendRoleState:
501
591
  @property
502
592
  @pulumi.getter(name="boundRegions")
503
593
  def bound_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
594
+ """
595
+ The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
596
+ """
504
597
  return pulumi.get(self, "bound_regions")
505
598
 
506
599
  @bound_regions.setter
@@ -522,6 +615,9 @@ class _AuthBackendRoleState:
522
615
  @property
523
616
  @pulumi.getter(name="boundZones")
524
617
  def bound_zones(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
618
+ """
619
+ The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
620
+ """
525
621
  return pulumi.get(self, "bound_zones")
526
622
 
527
623
  @bound_zones.setter
@@ -531,6 +627,9 @@ class _AuthBackendRoleState:
531
627
  @property
532
628
  @pulumi.getter(name="maxJwtExp")
533
629
  def max_jwt_exp(self) -> Optional[pulumi.Input[str]]:
630
+ """
631
+ The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
632
+ """
534
633
  return pulumi.get(self, "max_jwt_exp")
535
634
 
536
635
  @max_jwt_exp.setter
@@ -568,7 +667,9 @@ class _AuthBackendRoleState:
568
667
  @pulumi.getter(name="tokenBoundCidrs")
569
668
  def token_bound_cidrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
570
669
  """
571
- Specifies the blocks of IP addresses which are allowed to use the generated token
670
+ List of CIDR blocks; if set, specifies blocks of IP
671
+ addresses which can authenticate successfully, and ties the resulting token to these blocks
672
+ as well.
572
673
  """
573
674
  return pulumi.get(self, "token_bound_cidrs")
574
675
 
@@ -580,7 +681,10 @@ class _AuthBackendRoleState:
580
681
  @pulumi.getter(name="tokenExplicitMaxTtl")
581
682
  def token_explicit_max_ttl(self) -> Optional[pulumi.Input[int]]:
582
683
  """
583
- Generated Token's Explicit Maximum TTL in seconds
684
+ If set, will encode an
685
+ [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
686
+ onto the token in number of seconds. This is a hard cap even if `token_ttl` and
687
+ `token_max_ttl` would otherwise allow a renewal.
584
688
  """
585
689
  return pulumi.get(self, "token_explicit_max_ttl")
586
690
 
@@ -592,7 +696,8 @@ class _AuthBackendRoleState:
592
696
  @pulumi.getter(name="tokenMaxTtl")
593
697
  def token_max_ttl(self) -> Optional[pulumi.Input[int]]:
594
698
  """
595
- The maximum lifetime of the generated token
699
+ The maximum lifetime for generated tokens in number of seconds.
700
+ Its current value will be referenced at renewal time.
596
701
  """
597
702
  return pulumi.get(self, "token_max_ttl")
598
703
 
@@ -604,7 +709,8 @@ class _AuthBackendRoleState:
604
709
  @pulumi.getter(name="tokenNoDefaultPolicy")
605
710
  def token_no_default_policy(self) -> Optional[pulumi.Input[bool]]:
606
711
  """
607
- If true, the 'default' policy will not automatically be added to generated tokens
712
+ If set, the default policy will not be set on
713
+ generated tokens; otherwise it will be added to the policies set in token_policies.
608
714
  """
609
715
  return pulumi.get(self, "token_no_default_policy")
610
716
 
@@ -616,7 +722,8 @@ class _AuthBackendRoleState:
616
722
  @pulumi.getter(name="tokenNumUses")
617
723
  def token_num_uses(self) -> Optional[pulumi.Input[int]]:
618
724
  """
619
- The maximum number of times a token may be used, a value of zero means unlimited
725
+ The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
726
+ of times a generated token may be used (within its lifetime); 0 means unlimited.
620
727
  """
621
728
  return pulumi.get(self, "token_num_uses")
622
729
 
@@ -628,7 +735,10 @@ class _AuthBackendRoleState:
628
735
  @pulumi.getter(name="tokenPeriod")
629
736
  def token_period(self) -> Optional[pulumi.Input[int]]:
630
737
  """
631
- Generated Token's Period
738
+ If set, indicates that the
739
+ token generated using this role should never expire. The token should be renewed within the
740
+ duration specified by this value. At each renewal, the token's TTL will be set to the
741
+ value of this field. Specified in seconds.
632
742
  """
633
743
  return pulumi.get(self, "token_period")
634
744
 
@@ -640,7 +750,8 @@ class _AuthBackendRoleState:
640
750
  @pulumi.getter(name="tokenPolicies")
641
751
  def token_policies(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
642
752
  """
643
- Generated Token's Policies
753
+ List of policies to encode onto generated tokens. Depending
754
+ on the auth method, this list may be supplemented by user/group/other values.
644
755
  """
645
756
  return pulumi.get(self, "token_policies")
646
757
 
@@ -652,7 +763,8 @@ class _AuthBackendRoleState:
652
763
  @pulumi.getter(name="tokenTtl")
653
764
  def token_ttl(self) -> Optional[pulumi.Input[int]]:
654
765
  """
655
- The initial ttl of the token to generate in seconds
766
+ The incremental lifetime for generated tokens in number of seconds.
767
+ Its current value will be referenced at renewal time.
656
768
  """
657
769
  return pulumi.get(self, "token_ttl")
658
770
 
@@ -664,7 +776,11 @@ class _AuthBackendRoleState:
664
776
  @pulumi.getter(name="tokenType")
665
777
  def token_type(self) -> Optional[pulumi.Input[str]]:
666
778
  """
667
- The type of token to generate, service or batch
779
+ The type of token that should be generated. Can be `service`,
780
+ `batch`, or `default` to use the mount's tuned default (which unless changed will be
781
+ `service` tokens). For token store roles, there are two additional possibilities:
782
+ `default-service` and `default-batch` which specify the type to return unless the client
783
+ requests a different type at generation time.
668
784
  """
669
785
  return pulumi.get(self, "token_type")
670
786
 
@@ -718,6 +834,7 @@ class AuthBackendRole(pulumi.CustomResource):
718
834
 
719
835
  ## Example Usage
720
836
 
837
+ <!--Start PulumiCodeChooser -->
721
838
  ```python
722
839
  import pulumi
723
840
  import pulumi_vault as vault
@@ -739,6 +856,7 @@ class AuthBackendRole(pulumi.CustomResource):
739
856
  ],
740
857
  add_group_aliases=True)
741
858
  ```
859
+ <!--End PulumiCodeChooser -->
742
860
 
743
861
  ## Import
744
862
 
@@ -750,23 +868,46 @@ class AuthBackendRole(pulumi.CustomResource):
750
868
 
751
869
  :param str resource_name: The name of the resource.
752
870
  :param pulumi.ResourceOptions opts: Options for the resource.
871
+ :param pulumi.Input[bool] allow_gce_inference: A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
753
872
  :param pulumi.Input[str] backend: Path to the mounted GCP auth backend
873
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_instance_groups: The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
874
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_labels: A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
754
875
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_projects: An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.
876
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_regions: The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
755
877
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_service_accounts: GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is `iam`)
878
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_zones: The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
879
+ :param pulumi.Input[str] max_jwt_exp: The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
756
880
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
757
881
  The value should not contain leading or trailing forward slashes.
758
882
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
759
883
  *Available only for Vault Enterprise*.
760
884
  :param pulumi.Input[str] role: Name of the GCP role
761
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
762
- :param pulumi.Input[int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
763
- :param pulumi.Input[int] token_max_ttl: The maximum lifetime of the generated token
764
- :param pulumi.Input[bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
765
- :param pulumi.Input[int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
766
- :param pulumi.Input[int] token_period: Generated Token's Period
767
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: Generated Token's Policies
768
- :param pulumi.Input[int] token_ttl: The initial ttl of the token to generate in seconds
769
- :param pulumi.Input[str] token_type: The type of token to generate, service or batch
885
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: List of CIDR blocks; if set, specifies blocks of IP
886
+ addresses which can authenticate successfully, and ties the resulting token to these blocks
887
+ as well.
888
+ :param pulumi.Input[int] token_explicit_max_ttl: If set, will encode an
889
+ [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
890
+ onto the token in number of seconds. This is a hard cap even if `token_ttl` and
891
+ `token_max_ttl` would otherwise allow a renewal.
892
+ :param pulumi.Input[int] token_max_ttl: The maximum lifetime for generated tokens in number of seconds.
893
+ Its current value will be referenced at renewal time.
894
+ :param pulumi.Input[bool] token_no_default_policy: If set, the default policy will not be set on
895
+ generated tokens; otherwise it will be added to the policies set in token_policies.
896
+ :param pulumi.Input[int] token_num_uses: The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
897
+ of times a generated token may be used (within its lifetime); 0 means unlimited.
898
+ :param pulumi.Input[int] token_period: If set, indicates that the
899
+ token generated using this role should never expire. The token should be renewed within the
900
+ duration specified by this value. At each renewal, the token's TTL will be set to the
901
+ value of this field. Specified in seconds.
902
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: List of policies to encode onto generated tokens. Depending
903
+ on the auth method, this list may be supplemented by user/group/other values.
904
+ :param pulumi.Input[int] token_ttl: The incremental lifetime for generated tokens in number of seconds.
905
+ Its current value will be referenced at renewal time.
906
+ :param pulumi.Input[str] token_type: The type of token that should be generated. Can be `service`,
907
+ `batch`, or `default` to use the mount's tuned default (which unless changed will be
908
+ `service` tokens). For token store roles, there are two additional possibilities:
909
+ `default-service` and `default-batch` which specify the type to return unless the client
910
+ requests a different type at generation time.
770
911
  :param pulumi.Input[str] type: Type of GCP authentication role (either `gce` or `iam`)
771
912
  """
772
913
  ...
@@ -780,6 +921,7 @@ class AuthBackendRole(pulumi.CustomResource):
780
921
 
781
922
  ## Example Usage
782
923
 
924
+ <!--Start PulumiCodeChooser -->
783
925
  ```python
784
926
  import pulumi
785
927
  import pulumi_vault as vault
@@ -801,6 +943,7 @@ class AuthBackendRole(pulumi.CustomResource):
801
943
  ],
802
944
  add_group_aliases=True)
803
945
  ```
946
+ <!--End PulumiCodeChooser -->
804
947
 
805
948
  ## Import
806
949
 
@@ -921,23 +1064,46 @@ class AuthBackendRole(pulumi.CustomResource):
921
1064
  :param str resource_name: The unique name of the resulting resource.
922
1065
  :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
923
1066
  :param pulumi.ResourceOptions opts: Options for the resource.
1067
+ :param pulumi.Input[bool] allow_gce_inference: A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
924
1068
  :param pulumi.Input[str] backend: Path to the mounted GCP auth backend
1069
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_instance_groups: The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
1070
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_labels: A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
925
1071
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_projects: An array of GCP project IDs. Only entities belonging to this project can authenticate under the role.
1072
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_regions: The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
926
1073
  :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_service_accounts: GCP Service Accounts allowed to issue tokens under this role. (Note: **Required** if role is `iam`)
1074
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_zones: The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
1075
+ :param pulumi.Input[str] max_jwt_exp: The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
927
1076
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
928
1077
  The value should not contain leading or trailing forward slashes.
929
1078
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
930
1079
  *Available only for Vault Enterprise*.
931
1080
  :param pulumi.Input[str] role: Name of the GCP role
932
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: Specifies the blocks of IP addresses which are allowed to use the generated token
933
- :param pulumi.Input[int] token_explicit_max_ttl: Generated Token's Explicit Maximum TTL in seconds
934
- :param pulumi.Input[int] token_max_ttl: The maximum lifetime of the generated token
935
- :param pulumi.Input[bool] token_no_default_policy: If true, the 'default' policy will not automatically be added to generated tokens
936
- :param pulumi.Input[int] token_num_uses: The maximum number of times a token may be used, a value of zero means unlimited
937
- :param pulumi.Input[int] token_period: Generated Token's Period
938
- :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: Generated Token's Policies
939
- :param pulumi.Input[int] token_ttl: The initial ttl of the token to generate in seconds
940
- :param pulumi.Input[str] token_type: The type of token to generate, service or batch
1081
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_bound_cidrs: List of CIDR blocks; if set, specifies blocks of IP
1082
+ addresses which can authenticate successfully, and ties the resulting token to these blocks
1083
+ as well.
1084
+ :param pulumi.Input[int] token_explicit_max_ttl: If set, will encode an
1085
+ [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
1086
+ onto the token in number of seconds. This is a hard cap even if `token_ttl` and
1087
+ `token_max_ttl` would otherwise allow a renewal.
1088
+ :param pulumi.Input[int] token_max_ttl: The maximum lifetime for generated tokens in number of seconds.
1089
+ Its current value will be referenced at renewal time.
1090
+ :param pulumi.Input[bool] token_no_default_policy: If set, the default policy will not be set on
1091
+ generated tokens; otherwise it will be added to the policies set in token_policies.
1092
+ :param pulumi.Input[int] token_num_uses: The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
1093
+ of times a generated token may be used (within its lifetime); 0 means unlimited.
1094
+ :param pulumi.Input[int] token_period: If set, indicates that the
1095
+ token generated using this role should never expire. The token should be renewed within the
1096
+ duration specified by this value. At each renewal, the token's TTL will be set to the
1097
+ value of this field. Specified in seconds.
1098
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] token_policies: List of policies to encode onto generated tokens. Depending
1099
+ on the auth method, this list may be supplemented by user/group/other values.
1100
+ :param pulumi.Input[int] token_ttl: The incremental lifetime for generated tokens in number of seconds.
1101
+ Its current value will be referenced at renewal time.
1102
+ :param pulumi.Input[str] token_type: The type of token that should be generated. Can be `service`,
1103
+ `batch`, or `default` to use the mount's tuned default (which unless changed will be
1104
+ `service` tokens). For token store roles, there are two additional possibilities:
1105
+ `default-service` and `default-batch` which specify the type to return unless the client
1106
+ requests a different type at generation time.
941
1107
  :param pulumi.Input[str] type: Type of GCP authentication role (either `gce` or `iam`)
942
1108
  """
943
1109
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
@@ -976,6 +1142,9 @@ class AuthBackendRole(pulumi.CustomResource):
976
1142
  @property
977
1143
  @pulumi.getter(name="allowGceInference")
978
1144
  def allow_gce_inference(self) -> pulumi.Output[bool]:
1145
+ """
1146
+ A flag to determine if this role should allow GCE instances to authenticate by inferring service accounts from the GCE identity metadata token.
1147
+ """
979
1148
  return pulumi.get(self, "allow_gce_inference")
980
1149
 
981
1150
  @property
@@ -989,11 +1158,17 @@ class AuthBackendRole(pulumi.CustomResource):
989
1158
  @property
990
1159
  @pulumi.getter(name="boundInstanceGroups")
991
1160
  def bound_instance_groups(self) -> pulumi.Output[Sequence[str]]:
1161
+ """
1162
+ The instance groups that an authorized instance must belong to in order to be authenticated. If specified, either `bound_zones` or `bound_regions` must be set too.
1163
+ """
992
1164
  return pulumi.get(self, "bound_instance_groups")
993
1165
 
994
1166
  @property
995
1167
  @pulumi.getter(name="boundLabels")
996
1168
  def bound_labels(self) -> pulumi.Output[Sequence[str]]:
1169
+ """
1170
+ A comma-separated list of GCP labels formatted as `"key:value"` strings that must be set on authorized GCE instances. Because GCP labels are not currently ACL'd, we recommend that this be used in conjunction with other restrictions.
1171
+ """
997
1172
  return pulumi.get(self, "bound_labels")
998
1173
 
999
1174
  @property
@@ -1007,6 +1182,9 @@ class AuthBackendRole(pulumi.CustomResource):
1007
1182
  @property
1008
1183
  @pulumi.getter(name="boundRegions")
1009
1184
  def bound_regions(self) -> pulumi.Output[Sequence[str]]:
1185
+ """
1186
+ The list of regions that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
1187
+ """
1010
1188
  return pulumi.get(self, "bound_regions")
1011
1189
 
1012
1190
  @property
@@ -1020,11 +1198,17 @@ class AuthBackendRole(pulumi.CustomResource):
1020
1198
  @property
1021
1199
  @pulumi.getter(name="boundZones")
1022
1200
  def bound_zones(self) -> pulumi.Output[Sequence[str]]:
1201
+ """
1202
+ The list of zones that a GCE instance must belong to in order to be authenticated. If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
1203
+ """
1023
1204
  return pulumi.get(self, "bound_zones")
1024
1205
 
1025
1206
  @property
1026
1207
  @pulumi.getter(name="maxJwtExp")
1027
1208
  def max_jwt_exp(self) -> pulumi.Output[str]:
1209
+ """
1210
+ The number of seconds past the time of authentication that the login param JWT must expire within. For example, if a user attempts to login with a token that expires within an hour and this is set to 15 minutes, Vault will return an error prompting the user to create a new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not allow the `exp` claim to be customized.
1211
+ """
1028
1212
  return pulumi.get(self, "max_jwt_exp")
1029
1213
 
1030
1214
  @property
@@ -1050,7 +1234,9 @@ class AuthBackendRole(pulumi.CustomResource):
1050
1234
  @pulumi.getter(name="tokenBoundCidrs")
1051
1235
  def token_bound_cidrs(self) -> pulumi.Output[Optional[Sequence[str]]]:
1052
1236
  """
1053
- Specifies the blocks of IP addresses which are allowed to use the generated token
1237
+ List of CIDR blocks; if set, specifies blocks of IP
1238
+ addresses which can authenticate successfully, and ties the resulting token to these blocks
1239
+ as well.
1054
1240
  """
1055
1241
  return pulumi.get(self, "token_bound_cidrs")
1056
1242
 
@@ -1058,7 +1244,10 @@ class AuthBackendRole(pulumi.CustomResource):
1058
1244
  @pulumi.getter(name="tokenExplicitMaxTtl")
1059
1245
  def token_explicit_max_ttl(self) -> pulumi.Output[Optional[int]]:
1060
1246
  """
1061
- Generated Token's Explicit Maximum TTL in seconds
1247
+ If set, will encode an
1248
+ [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
1249
+ onto the token in number of seconds. This is a hard cap even if `token_ttl` and
1250
+ `token_max_ttl` would otherwise allow a renewal.
1062
1251
  """
1063
1252
  return pulumi.get(self, "token_explicit_max_ttl")
1064
1253
 
@@ -1066,7 +1255,8 @@ class AuthBackendRole(pulumi.CustomResource):
1066
1255
  @pulumi.getter(name="tokenMaxTtl")
1067
1256
  def token_max_ttl(self) -> pulumi.Output[Optional[int]]:
1068
1257
  """
1069
- The maximum lifetime of the generated token
1258
+ The maximum lifetime for generated tokens in number of seconds.
1259
+ Its current value will be referenced at renewal time.
1070
1260
  """
1071
1261
  return pulumi.get(self, "token_max_ttl")
1072
1262
 
@@ -1074,7 +1264,8 @@ class AuthBackendRole(pulumi.CustomResource):
1074
1264
  @pulumi.getter(name="tokenNoDefaultPolicy")
1075
1265
  def token_no_default_policy(self) -> pulumi.Output[Optional[bool]]:
1076
1266
  """
1077
- If true, the 'default' policy will not automatically be added to generated tokens
1267
+ If set, the default policy will not be set on
1268
+ generated tokens; otherwise it will be added to the policies set in token_policies.
1078
1269
  """
1079
1270
  return pulumi.get(self, "token_no_default_policy")
1080
1271
 
@@ -1082,7 +1273,8 @@ class AuthBackendRole(pulumi.CustomResource):
1082
1273
  @pulumi.getter(name="tokenNumUses")
1083
1274
  def token_num_uses(self) -> pulumi.Output[Optional[int]]:
1084
1275
  """
1085
- The maximum number of times a token may be used, a value of zero means unlimited
1276
+ The [maximum number](https://www.vaultproject.io/api-docs/gcp#token_num_uses)
1277
+ of times a generated token may be used (within its lifetime); 0 means unlimited.
1086
1278
  """
1087
1279
  return pulumi.get(self, "token_num_uses")
1088
1280
 
@@ -1090,7 +1282,10 @@ class AuthBackendRole(pulumi.CustomResource):
1090
1282
  @pulumi.getter(name="tokenPeriod")
1091
1283
  def token_period(self) -> pulumi.Output[Optional[int]]:
1092
1284
  """
1093
- Generated Token's Period
1285
+ If set, indicates that the
1286
+ token generated using this role should never expire. The token should be renewed within the
1287
+ duration specified by this value. At each renewal, the token's TTL will be set to the
1288
+ value of this field. Specified in seconds.
1094
1289
  """
1095
1290
  return pulumi.get(self, "token_period")
1096
1291
 
@@ -1098,7 +1293,8 @@ class AuthBackendRole(pulumi.CustomResource):
1098
1293
  @pulumi.getter(name="tokenPolicies")
1099
1294
  def token_policies(self) -> pulumi.Output[Optional[Sequence[str]]]:
1100
1295
  """
1101
- Generated Token's Policies
1296
+ List of policies to encode onto generated tokens. Depending
1297
+ on the auth method, this list may be supplemented by user/group/other values.
1102
1298
  """
1103
1299
  return pulumi.get(self, "token_policies")
1104
1300
 
@@ -1106,7 +1302,8 @@ class AuthBackendRole(pulumi.CustomResource):
1106
1302
  @pulumi.getter(name="tokenTtl")
1107
1303
  def token_ttl(self) -> pulumi.Output[Optional[int]]:
1108
1304
  """
1109
- The initial ttl of the token to generate in seconds
1305
+ The incremental lifetime for generated tokens in number of seconds.
1306
+ Its current value will be referenced at renewal time.
1110
1307
  """
1111
1308
  return pulumi.get(self, "token_ttl")
1112
1309
 
@@ -1114,7 +1311,11 @@ class AuthBackendRole(pulumi.CustomResource):
1114
1311
  @pulumi.getter(name="tokenType")
1115
1312
  def token_type(self) -> pulumi.Output[Optional[str]]:
1116
1313
  """
1117
- The type of token to generate, service or batch
1314
+ The type of token that should be generated. Can be `service`,
1315
+ `batch`, or `default` to use the mount's tuned default (which unless changed will be
1316
+ `service` tokens). For token store roles, there are two additional possibilities:
1317
+ `default-service` and `default-batch` which specify the type to return unless the client
1318
+ requests a different type at generation time.
1118
1319
  """
1119
1320
  return pulumi.get(self, "token_type")
1120
1321