pulumi-vault 6.2.0a1718953130__py3-none-any.whl → 6.3.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (41) hide show
  1. pulumi_vault/__init__.py +26 -0
  2. pulumi_vault/_inputs.py +20 -0
  3. pulumi_vault/_utilities.py +40 -4
  4. pulumi_vault/auth_backend.py +47 -0
  5. pulumi_vault/aws/auth_backend_client.py +247 -7
  6. pulumi_vault/aws/secret_backend_role.py +169 -0
  7. pulumi_vault/azure/auth_backend_config.py +133 -0
  8. pulumi_vault/azure/backend.py +197 -0
  9. pulumi_vault/database/secrets_mount.py +282 -0
  10. pulumi_vault/gcp/auth_backend.py +244 -0
  11. pulumi_vault/gcp/secret_backend.py +271 -3
  12. pulumi_vault/generic/endpoint.py +6 -6
  13. pulumi_vault/identity/get_entity.py +2 -2
  14. pulumi_vault/jwt/auth_backend_role.py +28 -35
  15. pulumi_vault/kubernetes/secret_backend.py +282 -0
  16. pulumi_vault/ldap/secret_backend.py +282 -0
  17. pulumi_vault/mount.py +331 -0
  18. pulumi_vault/okta/auth_backend.py +441 -0
  19. pulumi_vault/outputs.py +20 -0
  20. pulumi_vault/pkisecret/__init__.py +2 -0
  21. pulumi_vault/pkisecret/_inputs.py +40 -0
  22. pulumi_vault/pkisecret/backend_config_est.py +614 -0
  23. pulumi_vault/pkisecret/get_backend_config_est.py +233 -0
  24. pulumi_vault/pkisecret/outputs.py +64 -0
  25. pulumi_vault/pkisecret/secret_backend_cert.py +2 -2
  26. pulumi_vault/pkisecret/secret_backend_config_ca.py +2 -2
  27. pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +2 -2
  28. pulumi_vault/pkisecret/secret_backend_root_cert.py +2 -2
  29. pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +2 -2
  30. pulumi_vault/pkisecret/secret_backend_sign.py +2 -2
  31. pulumi_vault/plugin.py +590 -0
  32. pulumi_vault/plugin_pinned_version.py +293 -0
  33. pulumi_vault/provider.py +1 -3
  34. pulumi_vault/pulumi-plugin.json +1 -1
  35. pulumi_vault/quota_lease_count.py +47 -0
  36. pulumi_vault/quota_rate_limit.py +47 -0
  37. pulumi_vault/ssh/secret_backend_ca.py +94 -0
  38. {pulumi_vault-6.2.0a1718953130.dist-info → pulumi_vault-6.3.0.dist-info}/METADATA +1 -1
  39. {pulumi_vault-6.2.0a1718953130.dist-info → pulumi_vault-6.3.0.dist-info}/RECORD +41 -37
  40. {pulumi_vault-6.2.0a1718953130.dist-info → pulumi_vault-6.3.0.dist-info}/WHEEL +1 -1
  41. {pulumi_vault-6.2.0a1718953130.dist-info → pulumi_vault-6.3.0.dist-info}/top_level.txt +0 -0
pulumi_vault/aws/secret_backend_role.py CHANGED
@@ -17,7 +17,9 @@ class SecretBackendRoleArgs:
17
17
  backend: pulumi.Input[str],
18
18
  credential_type: pulumi.Input[str],
19
19
  default_sts_ttl: Optional[pulumi.Input[int]] = None,
20
+ external_id: Optional[pulumi.Input[str]] = None,
20
21
  iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
22
+ iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
21
23
  max_sts_ttl: Optional[pulumi.Input[int]] = None,
22
24
  name: Optional[pulumi.Input[str]] = None,
23
25
  namespace: Optional[pulumi.Input[str]] = None,
@@ -25,6 +27,7 @@ class SecretBackendRoleArgs:
25
27
  policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
26
28
  policy_document: Optional[pulumi.Input[str]] = None,
27
29
  role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
30
+ session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
28
31
  user_path: Optional[pulumi.Input[str]] = None):
29
32
  """
30
33
  The set of arguments for constructing a SecretBackendRole resource.
@@ -38,12 +41,16 @@ class SecretBackendRoleArgs:
38
41
  and a default TTL is specified on the role,
39
42
  then this default TTL will be used. Valid only when `credential_type` is one of
40
43
  `assumed_role` or `federation_token`.
44
+ :param pulumi.Input[str] external_id: External ID to set for assume role creds.
45
+ Valid only when `credential_type` is set to `assumed_role`.
41
46
  :param pulumi.Input[Sequence[pulumi.Input[str]]] iam_groups: A list of IAM group names. IAM users generated
42
47
  against this vault role will be added to these IAM Groups. For a credential
43
48
  type of `assumed_role` or `federation_token`, the policies sent to the
44
49
  corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the
45
50
  policies from each group in `iam_groups` combined with the `policy_document`
46
51
  and `policy_arns` parameters.
52
+ :param pulumi.Input[Mapping[str, pulumi.Input[str]]] iam_tags: A map of strings representing key/value pairs
53
+ to be used as tags for any IAM user that is created by this role.
47
54
  :param pulumi.Input[int] max_sts_ttl: The max allowed TTL in seconds for STS credentials
48
55
  (credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
49
56
  one of `assumed_role` or `federation_token`.
@@ -72,6 +79,9 @@ class SecretBackendRoleArgs:
72
79
  :param pulumi.Input[Sequence[pulumi.Input[str]]] role_arns: Specifies the ARNs of the AWS roles this Vault role
73
80
  is allowed to assume. Required when `credential_type` is `assumed_role` and
74
81
  prohibited otherwise.
82
+ :param pulumi.Input[Mapping[str, pulumi.Input[str]]] session_tags: A map of strings representing key/value pairs to be set
83
+ during assume role creds creation. Valid only when `credential_type` is set to
84
+ `assumed_role`.
75
85
  :param pulumi.Input[str] user_path: The path for the user name. Valid only when
76
86
  `credential_type` is `iam_user`. Default is `/`.
77
87
  """
@@ -79,8 +89,12 @@ class SecretBackendRoleArgs:
79
89
  pulumi.set(__self__, "credential_type", credential_type)
80
90
  if default_sts_ttl is not None:
81
91
  pulumi.set(__self__, "default_sts_ttl", default_sts_ttl)
92
+ if external_id is not None:
93
+ pulumi.set(__self__, "external_id", external_id)
82
94
  if iam_groups is not None:
83
95
  pulumi.set(__self__, "iam_groups", iam_groups)
96
+ if iam_tags is not None:
97
+ pulumi.set(__self__, "iam_tags", iam_tags)
84
98
  if max_sts_ttl is not None:
85
99
  pulumi.set(__self__, "max_sts_ttl", max_sts_ttl)
86
100
  if name is not None:
@@ -95,6 +109,8 @@ class SecretBackendRoleArgs:
95
109
  pulumi.set(__self__, "policy_document", policy_document)
96
110
  if role_arns is not None:
97
111
  pulumi.set(__self__, "role_arns", role_arns)
112
+ if session_tags is not None:
113
+ pulumi.set(__self__, "session_tags", session_tags)
98
114
  if user_path is not None:
99
115
  pulumi.set(__self__, "user_path", user_path)
100
116
 
@@ -141,6 +157,19 @@ class SecretBackendRoleArgs:
141
157
  def default_sts_ttl(self, value: Optional[pulumi.Input[int]]):
142
158
  pulumi.set(self, "default_sts_ttl", value)
143
159
 
160
+ @property
161
+ @pulumi.getter(name="externalId")
162
+ def external_id(self) -> Optional[pulumi.Input[str]]:
163
+ """
164
+ External ID to set for assume role creds.
165
+ Valid only when `credential_type` is set to `assumed_role`.
166
+ """
167
+ return pulumi.get(self, "external_id")
168
+
169
+ @external_id.setter
170
+ def external_id(self, value: Optional[pulumi.Input[str]]):
171
+ pulumi.set(self, "external_id", value)
172
+
144
173
  @property
145
174
  @pulumi.getter(name="iamGroups")
146
175
  def iam_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
@@ -158,6 +187,19 @@ class SecretBackendRoleArgs:
158
187
  def iam_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
159
188
  pulumi.set(self, "iam_groups", value)
160
189
 
190
+ @property
191
+ @pulumi.getter(name="iamTags")
192
+ def iam_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
193
+ """
194
+ A map of strings representing key/value pairs
195
+ to be used as tags for any IAM user that is created by this role.
196
+ """
197
+ return pulumi.get(self, "iam_tags")
198
+
199
+ @iam_tags.setter
200
+ def iam_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
201
+ pulumi.set(self, "iam_tags", value)
202
+
161
203
  @property
162
204
  @pulumi.getter(name="maxStsTtl")
163
205
  def max_sts_ttl(self) -> Optional[pulumi.Input[int]]:
@@ -263,6 +305,20 @@ class SecretBackendRoleArgs:
263
305
  def role_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
264
306
  pulumi.set(self, "role_arns", value)
265
307
 
308
+ @property
309
+ @pulumi.getter(name="sessionTags")
310
+ def session_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
311
+ """
312
+ A map of strings representing key/value pairs to be set
313
+ during assume role creds creation. Valid only when `credential_type` is set to
314
+ `assumed_role`.
315
+ """
316
+ return pulumi.get(self, "session_tags")
317
+
318
+ @session_tags.setter
319
+ def session_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
320
+ pulumi.set(self, "session_tags", value)
321
+
266
322
  @property
267
323
  @pulumi.getter(name="userPath")
268
324
  def user_path(self) -> Optional[pulumi.Input[str]]:
@@ -283,7 +339,9 @@ class _SecretBackendRoleState:
283
339
  backend: Optional[pulumi.Input[str]] = None,
284
340
  credential_type: Optional[pulumi.Input[str]] = None,
285
341
  default_sts_ttl: Optional[pulumi.Input[int]] = None,
342
+ external_id: Optional[pulumi.Input[str]] = None,
286
343
  iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
344
+ iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
287
345
  max_sts_ttl: Optional[pulumi.Input[int]] = None,
288
346
  name: Optional[pulumi.Input[str]] = None,
289
347
  namespace: Optional[pulumi.Input[str]] = None,
@@ -291,6 +349,7 @@ class _SecretBackendRoleState:
291
349
  policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
292
350
  policy_document: Optional[pulumi.Input[str]] = None,
293
351
  role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
352
+ session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
294
353
  user_path: Optional[pulumi.Input[str]] = None):
295
354
  """
296
355
  Input properties used for looking up and filtering SecretBackendRole resources.
@@ -304,12 +363,16 @@ class _SecretBackendRoleState:
304
363
  and a default TTL is specified on the role,
305
364
  then this default TTL will be used. Valid only when `credential_type` is one of
306
365
  `assumed_role` or `federation_token`.
366
+ :param pulumi.Input[str] external_id: External ID to set for assume role creds.
367
+ Valid only when `credential_type` is set to `assumed_role`.
307
368
  :param pulumi.Input[Sequence[pulumi.Input[str]]] iam_groups: A list of IAM group names. IAM users generated
308
369
  against this vault role will be added to these IAM Groups. For a credential
309
370
  type of `assumed_role` or `federation_token`, the policies sent to the
310
371
  corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the
311
372
  policies from each group in `iam_groups` combined with the `policy_document`
312
373
  and `policy_arns` parameters.
374
+ :param pulumi.Input[Mapping[str, pulumi.Input[str]]] iam_tags: A map of strings representing key/value pairs
375
+ to be used as tags for any IAM user that is created by this role.
313
376
  :param pulumi.Input[int] max_sts_ttl: The max allowed TTL in seconds for STS credentials
314
377
  (credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
315
378
  one of `assumed_role` or `federation_token`.
@@ -338,6 +401,9 @@ class _SecretBackendRoleState:
338
401
  :param pulumi.Input[Sequence[pulumi.Input[str]]] role_arns: Specifies the ARNs of the AWS roles this Vault role
339
402
  is allowed to assume. Required when `credential_type` is `assumed_role` and
340
403
  prohibited otherwise.
404
+ :param pulumi.Input[Mapping[str, pulumi.Input[str]]] session_tags: A map of strings representing key/value pairs to be set
405
+ during assume role creds creation. Valid only when `credential_type` is set to
406
+ `assumed_role`.
341
407
  :param pulumi.Input[str] user_path: The path for the user name. Valid only when
342
408
  `credential_type` is `iam_user`. Default is `/`.
343
409
  """
@@ -347,8 +413,12 @@ class _SecretBackendRoleState:
347
413
  pulumi.set(__self__, "credential_type", credential_type)
348
414
  if default_sts_ttl is not None:
349
415
  pulumi.set(__self__, "default_sts_ttl", default_sts_ttl)
416
+ if external_id is not None:
417
+ pulumi.set(__self__, "external_id", external_id)
350
418
  if iam_groups is not None:
351
419
  pulumi.set(__self__, "iam_groups", iam_groups)
420
+ if iam_tags is not None:
421
+ pulumi.set(__self__, "iam_tags", iam_tags)
352
422
  if max_sts_ttl is not None:
353
423
  pulumi.set(__self__, "max_sts_ttl", max_sts_ttl)
354
424
  if name is not None:
@@ -363,6 +433,8 @@ class _SecretBackendRoleState:
363
433
  pulumi.set(__self__, "policy_document", policy_document)
364
434
  if role_arns is not None:
365
435
  pulumi.set(__self__, "role_arns", role_arns)
436
+ if session_tags is not None:
437
+ pulumi.set(__self__, "session_tags", session_tags)
366
438
  if user_path is not None:
367
439
  pulumi.set(__self__, "user_path", user_path)
368
440
 
@@ -409,6 +481,19 @@ class _SecretBackendRoleState:
409
481
  def default_sts_ttl(self, value: Optional[pulumi.Input[int]]):
410
482
  pulumi.set(self, "default_sts_ttl", value)
411
483
 
484
+ @property
485
+ @pulumi.getter(name="externalId")
486
+ def external_id(self) -> Optional[pulumi.Input[str]]:
487
+ """
488
+ External ID to set for assume role creds.
489
+ Valid only when `credential_type` is set to `assumed_role`.
490
+ """
491
+ return pulumi.get(self, "external_id")
492
+
493
+ @external_id.setter
494
+ def external_id(self, value: Optional[pulumi.Input[str]]):
495
+ pulumi.set(self, "external_id", value)
496
+
412
497
  @property
413
498
  @pulumi.getter(name="iamGroups")
414
499
  def iam_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
@@ -426,6 +511,19 @@ class _SecretBackendRoleState:
426
511
  def iam_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
427
512
  pulumi.set(self, "iam_groups", value)
428
513
 
514
+ @property
515
+ @pulumi.getter(name="iamTags")
516
+ def iam_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
517
+ """
518
+ A map of strings representing key/value pairs
519
+ to be used as tags for any IAM user that is created by this role.
520
+ """
521
+ return pulumi.get(self, "iam_tags")
522
+
523
+ @iam_tags.setter
524
+ def iam_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
525
+ pulumi.set(self, "iam_tags", value)
526
+
429
527
  @property
430
528
  @pulumi.getter(name="maxStsTtl")
431
529
  def max_sts_ttl(self) -> Optional[pulumi.Input[int]]:
@@ -531,6 +629,20 @@ class _SecretBackendRoleState:
531
629
  def role_arns(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
532
630
  pulumi.set(self, "role_arns", value)
533
631
 
632
+ @property
633
+ @pulumi.getter(name="sessionTags")
634
+ def session_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
635
+ """
636
+ A map of strings representing key/value pairs to be set
637
+ during assume role creds creation. Valid only when `credential_type` is set to
638
+ `assumed_role`.
639
+ """
640
+ return pulumi.get(self, "session_tags")
641
+
642
+ @session_tags.setter
643
+ def session_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
644
+ pulumi.set(self, "session_tags", value)
645
+
534
646
  @property
535
647
  @pulumi.getter(name="userPath")
536
648
  def user_path(self) -> Optional[pulumi.Input[str]]:
@@ -553,7 +665,9 @@ class SecretBackendRole(pulumi.CustomResource):
553
665
  backend: Optional[pulumi.Input[str]] = None,
554
666
  credential_type: Optional[pulumi.Input[str]] = None,
555
667
  default_sts_ttl: Optional[pulumi.Input[int]] = None,
668
+ external_id: Optional[pulumi.Input[str]] = None,
556
669
  iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
670
+ iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
557
671
  max_sts_ttl: Optional[pulumi.Input[int]] = None,
558
672
  name: Optional[pulumi.Input[str]] = None,
559
673
  namespace: Optional[pulumi.Input[str]] = None,
@@ -561,6 +675,7 @@ class SecretBackendRole(pulumi.CustomResource):
561
675
  policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
562
676
  policy_document: Optional[pulumi.Input[str]] = None,
563
677
  role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
678
+ session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
564
679
  user_path: Optional[pulumi.Input[str]] = None,
565
680
  __props__=None):
566
681
  """
@@ -610,12 +725,16 @@ class SecretBackendRole(pulumi.CustomResource):
610
725
  and a default TTL is specified on the role,
611
726
  then this default TTL will be used. Valid only when `credential_type` is one of
612
727
  `assumed_role` or `federation_token`.
728
+ :param pulumi.Input[str] external_id: External ID to set for assume role creds.
729
+ Valid only when `credential_type` is set to `assumed_role`.
613
730
  :param pulumi.Input[Sequence[pulumi.Input[str]]] iam_groups: A list of IAM group names. IAM users generated
614
731
  against this vault role will be added to these IAM Groups. For a credential
615
732
  type of `assumed_role` or `federation_token`, the policies sent to the
616
733
  corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the
617
734
  policies from each group in `iam_groups` combined with the `policy_document`
618
735
  and `policy_arns` parameters.
736
+ :param pulumi.Input[Mapping[str, pulumi.Input[str]]] iam_tags: A map of strings representing key/value pairs
737
+ to be used as tags for any IAM user that is created by this role.
619
738
  :param pulumi.Input[int] max_sts_ttl: The max allowed TTL in seconds for STS credentials
620
739
  (credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
621
740
  one of `assumed_role` or `federation_token`.
@@ -644,6 +763,9 @@ class SecretBackendRole(pulumi.CustomResource):
644
763
  :param pulumi.Input[Sequence[pulumi.Input[str]]] role_arns: Specifies the ARNs of the AWS roles this Vault role
645
764
  is allowed to assume. Required when `credential_type` is `assumed_role` and
646
765
  prohibited otherwise.
766
+ :param pulumi.Input[Mapping[str, pulumi.Input[str]]] session_tags: A map of strings representing key/value pairs to be set
767
+ during assume role creds creation. Valid only when `credential_type` is set to
768
+ `assumed_role`.
647
769
  :param pulumi.Input[str] user_path: The path for the user name. Valid only when
648
770
  `credential_type` is `iam_user`. Default is `/`.
649
771
  """
@@ -706,7 +828,9 @@ class SecretBackendRole(pulumi.CustomResource):
706
828
  backend: Optional[pulumi.Input[str]] = None,
707
829
  credential_type: Optional[pulumi.Input[str]] = None,
708
830
  default_sts_ttl: Optional[pulumi.Input[int]] = None,
831
+ external_id: Optional[pulumi.Input[str]] = None,
709
832
  iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
833
+ iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
710
834
  max_sts_ttl: Optional[pulumi.Input[int]] = None,
711
835
  name: Optional[pulumi.Input[str]] = None,
712
836
  namespace: Optional[pulumi.Input[str]] = None,
@@ -714,6 +838,7 @@ class SecretBackendRole(pulumi.CustomResource):
714
838
  policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
715
839
  policy_document: Optional[pulumi.Input[str]] = None,
716
840
  role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
841
+ session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
717
842
  user_path: Optional[pulumi.Input[str]] = None,
718
843
  __props__=None):
719
844
  opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
@@ -731,7 +856,9 @@ class SecretBackendRole(pulumi.CustomResource):
731
856
  raise TypeError("Missing required property 'credential_type'")
732
857
  __props__.__dict__["credential_type"] = credential_type
733
858
  __props__.__dict__["default_sts_ttl"] = default_sts_ttl
859
+ __props__.__dict__["external_id"] = external_id
734
860
  __props__.__dict__["iam_groups"] = iam_groups
861
+ __props__.__dict__["iam_tags"] = iam_tags
735
862
  __props__.__dict__["max_sts_ttl"] = max_sts_ttl
736
863
  __props__.__dict__["name"] = name
737
864
  __props__.__dict__["namespace"] = namespace
@@ -739,6 +866,7 @@ class SecretBackendRole(pulumi.CustomResource):
739
866
  __props__.__dict__["policy_arns"] = policy_arns
740
867
  __props__.__dict__["policy_document"] = policy_document
741
868
  __props__.__dict__["role_arns"] = role_arns
869
+ __props__.__dict__["session_tags"] = session_tags
742
870
  __props__.__dict__["user_path"] = user_path
743
871
  super(SecretBackendRole, __self__).__init__(
744
872
  'vault:aws/secretBackendRole:SecretBackendRole',
@@ -753,7 +881,9 @@ class SecretBackendRole(pulumi.CustomResource):
753
881
  backend: Optional[pulumi.Input[str]] = None,
754
882
  credential_type: Optional[pulumi.Input[str]] = None,
755
883
  default_sts_ttl: Optional[pulumi.Input[int]] = None,
884
+ external_id: Optional[pulumi.Input[str]] = None,
756
885
  iam_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
886
+ iam_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
757
887
  max_sts_ttl: Optional[pulumi.Input[int]] = None,
758
888
  name: Optional[pulumi.Input[str]] = None,
759
889
  namespace: Optional[pulumi.Input[str]] = None,
@@ -761,6 +891,7 @@ class SecretBackendRole(pulumi.CustomResource):
761
891
  policy_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
762
892
  policy_document: Optional[pulumi.Input[str]] = None,
763
893
  role_arns: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
894
+ session_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
764
895
  user_path: Optional[pulumi.Input[str]] = None) -> 'SecretBackendRole':
765
896
  """
766
897
  Get an existing SecretBackendRole resource's state with the given name, id, and optional extra
@@ -779,12 +910,16 @@ class SecretBackendRole(pulumi.CustomResource):
779
910
  and a default TTL is specified on the role,
780
911
  then this default TTL will be used. Valid only when `credential_type` is one of
781
912
  `assumed_role` or `federation_token`.
913
+ :param pulumi.Input[str] external_id: External ID to set for assume role creds.
914
+ Valid only when `credential_type` is set to `assumed_role`.
782
915
  :param pulumi.Input[Sequence[pulumi.Input[str]]] iam_groups: A list of IAM group names. IAM users generated
783
916
  against this vault role will be added to these IAM Groups. For a credential
784
917
  type of `assumed_role` or `federation_token`, the policies sent to the
785
918
  corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the
786
919
  policies from each group in `iam_groups` combined with the `policy_document`
787
920
  and `policy_arns` parameters.
921
+ :param pulumi.Input[Mapping[str, pulumi.Input[str]]] iam_tags: A map of strings representing key/value pairs
922
+ to be used as tags for any IAM user that is created by this role.
788
923
  :param pulumi.Input[int] max_sts_ttl: The max allowed TTL in seconds for STS credentials
789
924
  (credentials TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is
790
925
  one of `assumed_role` or `federation_token`.
@@ -813,6 +948,9 @@ class SecretBackendRole(pulumi.CustomResource):
813
948
  :param pulumi.Input[Sequence[pulumi.Input[str]]] role_arns: Specifies the ARNs of the AWS roles this Vault role
814
949
  is allowed to assume. Required when `credential_type` is `assumed_role` and
815
950
  prohibited otherwise.
951
+ :param pulumi.Input[Mapping[str, pulumi.Input[str]]] session_tags: A map of strings representing key/value pairs to be set
952
+ during assume role creds creation. Valid only when `credential_type` is set to
953
+ `assumed_role`.
816
954
  :param pulumi.Input[str] user_path: The path for the user name. Valid only when
817
955
  `credential_type` is `iam_user`. Default is `/`.
818
956
  """
@@ -823,7 +961,9 @@ class SecretBackendRole(pulumi.CustomResource):
823
961
  __props__.__dict__["backend"] = backend
824
962
  __props__.__dict__["credential_type"] = credential_type
825
963
  __props__.__dict__["default_sts_ttl"] = default_sts_ttl
964
+ __props__.__dict__["external_id"] = external_id
826
965
  __props__.__dict__["iam_groups"] = iam_groups
966
+ __props__.__dict__["iam_tags"] = iam_tags
827
967
  __props__.__dict__["max_sts_ttl"] = max_sts_ttl
828
968
  __props__.__dict__["name"] = name
829
969
  __props__.__dict__["namespace"] = namespace
@@ -831,6 +971,7 @@ class SecretBackendRole(pulumi.CustomResource):
831
971
  __props__.__dict__["policy_arns"] = policy_arns
832
972
  __props__.__dict__["policy_document"] = policy_document
833
973
  __props__.__dict__["role_arns"] = role_arns
974
+ __props__.__dict__["session_tags"] = session_tags
834
975
  __props__.__dict__["user_path"] = user_path
835
976
  return SecretBackendRole(resource_name, opts=opts, __props__=__props__)
836
977
 
@@ -865,6 +1006,15 @@ class SecretBackendRole(pulumi.CustomResource):
865
1006
  """
866
1007
  return pulumi.get(self, "default_sts_ttl")
867
1008
 
1009
+ @property
1010
+ @pulumi.getter(name="externalId")
1011
+ def external_id(self) -> pulumi.Output[Optional[str]]:
1012
+ """
1013
+ External ID to set for assume role creds.
1014
+ Valid only when `credential_type` is set to `assumed_role`.
1015
+ """
1016
+ return pulumi.get(self, "external_id")
1017
+
868
1018
  @property
869
1019
  @pulumi.getter(name="iamGroups")
870
1020
  def iam_groups(self) -> pulumi.Output[Optional[Sequence[str]]]:
@@ -878,6 +1028,15 @@ class SecretBackendRole(pulumi.CustomResource):
878
1028
  """
879
1029
  return pulumi.get(self, "iam_groups")
880
1030
 
1031
+ @property
1032
+ @pulumi.getter(name="iamTags")
1033
+ def iam_tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
1034
+ """
1035
+ A map of strings representing key/value pairs
1036
+ to be used as tags for any IAM user that is created by this role.
1037
+ """
1038
+ return pulumi.get(self, "iam_tags")
1039
+
881
1040
  @property
882
1041
  @pulumi.getter(name="maxStsTtl")
883
1042
  def max_sts_ttl(self) -> pulumi.Output[int]:
@@ -955,6 +1114,16 @@ class SecretBackendRole(pulumi.CustomResource):
955
1114
  """
956
1115
  return pulumi.get(self, "role_arns")
957
1116
 
1117
+ @property
1118
+ @pulumi.getter(name="sessionTags")
1119
+ def session_tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
1120
+ """
1121
+ A map of strings representing key/value pairs to be set
1122
+ during assume role creds creation. Valid only when `credential_type` is set to
1123
+ `assumed_role`.
1124
+ """
1125
+ return pulumi.get(self, "session_tags")
1126
+
958
1127
  @property
959
1128
  @pulumi.getter(name="userPath")
960
1129
  def user_path(self) -> pulumi.Output[Optional[str]]: