pulumi-vault 6.5.0a1736850018__py3-none-any.whl → 6.6.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +32 -0
- pulumi_vault/_utilities.py +8 -4
- pulumi_vault/aws/auth_backend_client.py +228 -4
- pulumi_vault/aws/auth_backend_sts_role.py +47 -0
- pulumi_vault/aws/secret_backend.py +395 -38
- pulumi_vault/aws/secret_backend_static_role.py +217 -0
- pulumi_vault/azure/auth_backend_config.py +257 -5
- pulumi_vault/azure/backend.py +249 -4
- pulumi_vault/database/_inputs.py +1740 -44
- pulumi_vault/database/outputs.py +1198 -18
- pulumi_vault/database/secret_backend_connection.py +220 -0
- pulumi_vault/database/secret_backend_static_role.py +143 -1
- pulumi_vault/database/secrets_mount.py +8 -0
- pulumi_vault/gcp/auth_backend.py +222 -2
- pulumi_vault/gcp/secret_backend.py +244 -4
- pulumi_vault/ldap/auth_backend.py +222 -2
- pulumi_vault/ldap/secret_backend.py +222 -2
- pulumi_vault/pkisecret/__init__.py +6 -0
- pulumi_vault/pkisecret/_inputs.py +34 -6
- pulumi_vault/pkisecret/backend_acme_eab.py +549 -0
- pulumi_vault/pkisecret/backend_config_acme.py +689 -0
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +1376 -0
- pulumi_vault/pkisecret/backend_config_cmpv2.py +572 -0
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +277 -0
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +226 -0
- pulumi_vault/pkisecret/get_backend_issuer.py +114 -1
- pulumi_vault/pkisecret/outputs.py +40 -4
- pulumi_vault/pkisecret/secret_backend_cert.py +148 -7
- pulumi_vault/pkisecret/secret_backend_crl_config.py +54 -0
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +141 -0
- pulumi_vault/pkisecret/secret_backend_issuer.py +265 -0
- pulumi_vault/pkisecret/secret_backend_role.py +299 -3
- pulumi_vault/pkisecret/secret_backend_root_cert.py +423 -0
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +581 -3
- pulumi_vault/pkisecret/secret_backend_sign.py +94 -0
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/ssh/__init__.py +1 -0
- pulumi_vault/ssh/get_secret_backend_sign.py +294 -0
- pulumi_vault/ssh/secret_backend_role.py +27 -0
- pulumi_vault/terraformcloud/secret_role.py +7 -7
- pulumi_vault/transit/__init__.py +2 -0
- pulumi_vault/transit/get_sign.py +324 -0
- pulumi_vault/transit/get_verify.py +354 -0
- pulumi_vault/transit/secret_backend_key.py +162 -0
- {pulumi_vault-6.5.0a1736850018.dist-info → pulumi_vault-6.6.0.dist-info}/METADATA +1 -1
- {pulumi_vault-6.5.0a1736850018.dist-info → pulumi_vault-6.6.0.dist-info}/RECORD +48 -39
- {pulumi_vault-6.5.0a1736850018.dist-info → pulumi_vault-6.6.0.dist-info}/WHEEL +1 -1
- {pulumi_vault-6.5.0a1736850018.dist-info → pulumi_vault-6.6.0.dist-info}/top_level.txt +0 -0
|
@@ -22,6 +22,7 @@ class SecretBackendArgs:
|
|
|
22
22
|
access_key: Optional[pulumi.Input[str]] = None,
|
|
23
23
|
default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
|
|
24
24
|
description: Optional[pulumi.Input[str]] = None,
|
|
25
|
+
disable_automated_rotation: Optional[pulumi.Input[bool]] = None,
|
|
25
26
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
26
27
|
iam_endpoint: Optional[pulumi.Input[str]] = None,
|
|
27
28
|
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
@@ -33,8 +34,14 @@ class SecretBackendArgs:
|
|
|
33
34
|
path: Optional[pulumi.Input[str]] = None,
|
|
34
35
|
region: Optional[pulumi.Input[str]] = None,
|
|
35
36
|
role_arn: Optional[pulumi.Input[str]] = None,
|
|
37
|
+
rotation_period: Optional[pulumi.Input[int]] = None,
|
|
38
|
+
rotation_schedule: Optional[pulumi.Input[str]] = None,
|
|
39
|
+
rotation_window: Optional[pulumi.Input[int]] = None,
|
|
36
40
|
secret_key: Optional[pulumi.Input[str]] = None,
|
|
37
41
|
sts_endpoint: Optional[pulumi.Input[str]] = None,
|
|
42
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
43
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
44
|
+
sts_region: Optional[pulumi.Input[str]] = None,
|
|
38
45
|
username_template: Optional[pulumi.Input[str]] = None):
|
|
39
46
|
"""
|
|
40
47
|
The set of arguments for constructing a SecretBackend resource.
|
|
@@ -43,6 +50,7 @@ class SecretBackendArgs:
|
|
|
43
50
|
:param pulumi.Input[int] default_lease_ttl_seconds: The default TTL for credentials
|
|
44
51
|
issued by this backend.
|
|
45
52
|
:param pulumi.Input[str] description: A human-friendly description for this backend.
|
|
53
|
+
:param pulumi.Input[bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
46
54
|
:param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
47
55
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
48
56
|
:param pulumi.Input[str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
@@ -60,6 +68,19 @@ class SecretBackendArgs:
|
|
|
60
68
|
not begin or end with a `/`. Defaults to `aws`.
|
|
61
69
|
:param pulumi.Input[str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
62
70
|
:param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
71
|
+
:param pulumi.Input[int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
72
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
73
|
+
:param pulumi.Input[str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
74
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
75
|
+
:param pulumi.Input[int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
76
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
77
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
78
|
+
:param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
79
|
+
:param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
80
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
81
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] sts_fallback_regions: Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
82
|
+
:param pulumi.Input[str] sts_region: Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
83
|
+
:param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
63
84
|
|
|
64
85
|
```
|
|
65
86
|
{{ if (eq .Type "STS") }}
|
|
@@ -69,9 +90,6 @@ class SecretBackendArgs:
|
|
|
69
90
|
{{ end }}
|
|
70
91
|
|
|
71
92
|
```
|
|
72
|
-
:param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
73
|
-
:param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
74
|
-
:param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
75
93
|
"""
|
|
76
94
|
if access_key is not None:
|
|
77
95
|
pulumi.set(__self__, "access_key", access_key)
|
|
@@ -79,6 +97,8 @@ class SecretBackendArgs:
|
|
|
79
97
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
80
98
|
if description is not None:
|
|
81
99
|
pulumi.set(__self__, "description", description)
|
|
100
|
+
if disable_automated_rotation is not None:
|
|
101
|
+
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
82
102
|
if disable_remount is not None:
|
|
83
103
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
84
104
|
if iam_endpoint is not None:
|
|
@@ -101,10 +121,22 @@ class SecretBackendArgs:
|
|
|
101
121
|
pulumi.set(__self__, "region", region)
|
|
102
122
|
if role_arn is not None:
|
|
103
123
|
pulumi.set(__self__, "role_arn", role_arn)
|
|
124
|
+
if rotation_period is not None:
|
|
125
|
+
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
126
|
+
if rotation_schedule is not None:
|
|
127
|
+
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
128
|
+
if rotation_window is not None:
|
|
129
|
+
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
104
130
|
if secret_key is not None:
|
|
105
131
|
pulumi.set(__self__, "secret_key", secret_key)
|
|
106
132
|
if sts_endpoint is not None:
|
|
107
133
|
pulumi.set(__self__, "sts_endpoint", sts_endpoint)
|
|
134
|
+
if sts_fallback_endpoints is not None:
|
|
135
|
+
pulumi.set(__self__, "sts_fallback_endpoints", sts_fallback_endpoints)
|
|
136
|
+
if sts_fallback_regions is not None:
|
|
137
|
+
pulumi.set(__self__, "sts_fallback_regions", sts_fallback_regions)
|
|
138
|
+
if sts_region is not None:
|
|
139
|
+
pulumi.set(__self__, "sts_region", sts_region)
|
|
108
140
|
if username_template is not None:
|
|
109
141
|
pulumi.set(__self__, "username_template", username_template)
|
|
110
142
|
|
|
@@ -146,6 +178,18 @@ class SecretBackendArgs:
|
|
|
146
178
|
def description(self, value: Optional[pulumi.Input[str]]):
|
|
147
179
|
pulumi.set(self, "description", value)
|
|
148
180
|
|
|
181
|
+
@property
|
|
182
|
+
@pulumi.getter(name="disableAutomatedRotation")
|
|
183
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[bool]]:
|
|
184
|
+
"""
|
|
185
|
+
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
186
|
+
"""
|
|
187
|
+
return pulumi.get(self, "disable_automated_rotation")
|
|
188
|
+
|
|
189
|
+
@disable_automated_rotation.setter
|
|
190
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[bool]]):
|
|
191
|
+
pulumi.set(self, "disable_automated_rotation", value)
|
|
192
|
+
|
|
149
193
|
@property
|
|
150
194
|
@pulumi.getter(name="disableRemount")
|
|
151
195
|
def disable_remount(self) -> Optional[pulumi.Input[bool]]:
|
|
@@ -277,15 +321,6 @@ class SecretBackendArgs:
|
|
|
277
321
|
def role_arn(self) -> Optional[pulumi.Input[str]]:
|
|
278
322
|
"""
|
|
279
323
|
Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
280
|
-
|
|
281
|
-
```
|
|
282
|
-
{{ if (eq .Type "STS") }}
|
|
283
|
-
{{ printf "vault-%s-%s" (unix_time) (random 20) | truncate 32 }}
|
|
284
|
-
{{ else }}
|
|
285
|
-
{{ printf "vault-%s-%s-%s" (printf "%s-%s" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}
|
|
286
|
-
{{ end }}
|
|
287
|
-
|
|
288
|
-
```
|
|
289
324
|
"""
|
|
290
325
|
return pulumi.get(self, "role_arn")
|
|
291
326
|
|
|
@@ -293,6 +328,46 @@ class SecretBackendArgs:
|
|
|
293
328
|
def role_arn(self, value: Optional[pulumi.Input[str]]):
|
|
294
329
|
pulumi.set(self, "role_arn", value)
|
|
295
330
|
|
|
331
|
+
@property
|
|
332
|
+
@pulumi.getter(name="rotationPeriod")
|
|
333
|
+
def rotation_period(self) -> Optional[pulumi.Input[int]]:
|
|
334
|
+
"""
|
|
335
|
+
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
336
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
337
|
+
"""
|
|
338
|
+
return pulumi.get(self, "rotation_period")
|
|
339
|
+
|
|
340
|
+
@rotation_period.setter
|
|
341
|
+
def rotation_period(self, value: Optional[pulumi.Input[int]]):
|
|
342
|
+
pulumi.set(self, "rotation_period", value)
|
|
343
|
+
|
|
344
|
+
@property
|
|
345
|
+
@pulumi.getter(name="rotationSchedule")
|
|
346
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[str]]:
|
|
347
|
+
"""
|
|
348
|
+
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
349
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
350
|
+
"""
|
|
351
|
+
return pulumi.get(self, "rotation_schedule")
|
|
352
|
+
|
|
353
|
+
@rotation_schedule.setter
|
|
354
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[str]]):
|
|
355
|
+
pulumi.set(self, "rotation_schedule", value)
|
|
356
|
+
|
|
357
|
+
@property
|
|
358
|
+
@pulumi.getter(name="rotationWindow")
|
|
359
|
+
def rotation_window(self) -> Optional[pulumi.Input[int]]:
|
|
360
|
+
"""
|
|
361
|
+
The maximum amount of time in seconds allowed to complete
|
|
362
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
363
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
364
|
+
"""
|
|
365
|
+
return pulumi.get(self, "rotation_window")
|
|
366
|
+
|
|
367
|
+
@rotation_window.setter
|
|
368
|
+
def rotation_window(self, value: Optional[pulumi.Input[int]]):
|
|
369
|
+
pulumi.set(self, "rotation_window", value)
|
|
370
|
+
|
|
296
371
|
@property
|
|
297
372
|
@pulumi.getter(name="secretKey")
|
|
298
373
|
def secret_key(self) -> Optional[pulumi.Input[str]]:
|
|
@@ -317,11 +392,56 @@ class SecretBackendArgs:
|
|
|
317
392
|
def sts_endpoint(self, value: Optional[pulumi.Input[str]]):
|
|
318
393
|
pulumi.set(self, "sts_endpoint", value)
|
|
319
394
|
|
|
395
|
+
@property
|
|
396
|
+
@pulumi.getter(name="stsFallbackEndpoints")
|
|
397
|
+
def sts_fallback_endpoints(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
398
|
+
"""
|
|
399
|
+
Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
400
|
+
"""
|
|
401
|
+
return pulumi.get(self, "sts_fallback_endpoints")
|
|
402
|
+
|
|
403
|
+
@sts_fallback_endpoints.setter
|
|
404
|
+
def sts_fallback_endpoints(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
405
|
+
pulumi.set(self, "sts_fallback_endpoints", value)
|
|
406
|
+
|
|
407
|
+
@property
|
|
408
|
+
@pulumi.getter(name="stsFallbackRegions")
|
|
409
|
+
def sts_fallback_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
410
|
+
"""
|
|
411
|
+
Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
412
|
+
"""
|
|
413
|
+
return pulumi.get(self, "sts_fallback_regions")
|
|
414
|
+
|
|
415
|
+
@sts_fallback_regions.setter
|
|
416
|
+
def sts_fallback_regions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
417
|
+
pulumi.set(self, "sts_fallback_regions", value)
|
|
418
|
+
|
|
419
|
+
@property
|
|
420
|
+
@pulumi.getter(name="stsRegion")
|
|
421
|
+
def sts_region(self) -> Optional[pulumi.Input[str]]:
|
|
422
|
+
"""
|
|
423
|
+
Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
424
|
+
"""
|
|
425
|
+
return pulumi.get(self, "sts_region")
|
|
426
|
+
|
|
427
|
+
@sts_region.setter
|
|
428
|
+
def sts_region(self, value: Optional[pulumi.Input[str]]):
|
|
429
|
+
pulumi.set(self, "sts_region", value)
|
|
430
|
+
|
|
320
431
|
@property
|
|
321
432
|
@pulumi.getter(name="usernameTemplate")
|
|
322
433
|
def username_template(self) -> Optional[pulumi.Input[str]]:
|
|
323
434
|
"""
|
|
324
435
|
Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
436
|
+
|
|
437
|
+
```
|
|
438
|
+
{{ if (eq .Type "STS") }}
|
|
439
|
+
{{ printf "vault-%s-%s" (unix_time) (random 20) | truncate 32 }}
|
|
440
|
+
{{ else }}
|
|
441
|
+
{{ printf "vault-%s-%s-%s" (printf "%s-%s" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}
|
|
442
|
+
{{ end }}
|
|
443
|
+
|
|
444
|
+
```
|
|
325
445
|
"""
|
|
326
446
|
return pulumi.get(self, "username_template")
|
|
327
447
|
|
|
@@ -336,6 +456,7 @@ class _SecretBackendState:
|
|
|
336
456
|
access_key: Optional[pulumi.Input[str]] = None,
|
|
337
457
|
default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
|
|
338
458
|
description: Optional[pulumi.Input[str]] = None,
|
|
459
|
+
disable_automated_rotation: Optional[pulumi.Input[bool]] = None,
|
|
339
460
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
340
461
|
iam_endpoint: Optional[pulumi.Input[str]] = None,
|
|
341
462
|
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
@@ -347,8 +468,14 @@ class _SecretBackendState:
|
|
|
347
468
|
path: Optional[pulumi.Input[str]] = None,
|
|
348
469
|
region: Optional[pulumi.Input[str]] = None,
|
|
349
470
|
role_arn: Optional[pulumi.Input[str]] = None,
|
|
471
|
+
rotation_period: Optional[pulumi.Input[int]] = None,
|
|
472
|
+
rotation_schedule: Optional[pulumi.Input[str]] = None,
|
|
473
|
+
rotation_window: Optional[pulumi.Input[int]] = None,
|
|
350
474
|
secret_key: Optional[pulumi.Input[str]] = None,
|
|
351
475
|
sts_endpoint: Optional[pulumi.Input[str]] = None,
|
|
476
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
477
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
478
|
+
sts_region: Optional[pulumi.Input[str]] = None,
|
|
352
479
|
username_template: Optional[pulumi.Input[str]] = None):
|
|
353
480
|
"""
|
|
354
481
|
Input properties used for looking up and filtering SecretBackend resources.
|
|
@@ -357,6 +484,7 @@ class _SecretBackendState:
|
|
|
357
484
|
:param pulumi.Input[int] default_lease_ttl_seconds: The default TTL for credentials
|
|
358
485
|
issued by this backend.
|
|
359
486
|
:param pulumi.Input[str] description: A human-friendly description for this backend.
|
|
487
|
+
:param pulumi.Input[bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
360
488
|
:param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
361
489
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
362
490
|
:param pulumi.Input[str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
@@ -374,6 +502,19 @@ class _SecretBackendState:
|
|
|
374
502
|
not begin or end with a `/`. Defaults to `aws`.
|
|
375
503
|
:param pulumi.Input[str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
376
504
|
:param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
505
|
+
:param pulumi.Input[int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
506
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
507
|
+
:param pulumi.Input[str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
508
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
509
|
+
:param pulumi.Input[int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
510
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
511
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
512
|
+
:param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
513
|
+
:param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
514
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
515
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] sts_fallback_regions: Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
516
|
+
:param pulumi.Input[str] sts_region: Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
517
|
+
:param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
377
518
|
|
|
378
519
|
```
|
|
379
520
|
{{ if (eq .Type "STS") }}
|
|
@@ -383,9 +524,6 @@ class _SecretBackendState:
|
|
|
383
524
|
{{ end }}
|
|
384
525
|
|
|
385
526
|
```
|
|
386
|
-
:param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
387
|
-
:param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
388
|
-
:param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
389
527
|
"""
|
|
390
528
|
if access_key is not None:
|
|
391
529
|
pulumi.set(__self__, "access_key", access_key)
|
|
@@ -393,6 +531,8 @@ class _SecretBackendState:
|
|
|
393
531
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
394
532
|
if description is not None:
|
|
395
533
|
pulumi.set(__self__, "description", description)
|
|
534
|
+
if disable_automated_rotation is not None:
|
|
535
|
+
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
396
536
|
if disable_remount is not None:
|
|
397
537
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
398
538
|
if iam_endpoint is not None:
|
|
@@ -415,10 +555,22 @@ class _SecretBackendState:
|
|
|
415
555
|
pulumi.set(__self__, "region", region)
|
|
416
556
|
if role_arn is not None:
|
|
417
557
|
pulumi.set(__self__, "role_arn", role_arn)
|
|
558
|
+
if rotation_period is not None:
|
|
559
|
+
pulumi.set(__self__, "rotation_period", rotation_period)
|
|
560
|
+
if rotation_schedule is not None:
|
|
561
|
+
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
562
|
+
if rotation_window is not None:
|
|
563
|
+
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
418
564
|
if secret_key is not None:
|
|
419
565
|
pulumi.set(__self__, "secret_key", secret_key)
|
|
420
566
|
if sts_endpoint is not None:
|
|
421
567
|
pulumi.set(__self__, "sts_endpoint", sts_endpoint)
|
|
568
|
+
if sts_fallback_endpoints is not None:
|
|
569
|
+
pulumi.set(__self__, "sts_fallback_endpoints", sts_fallback_endpoints)
|
|
570
|
+
if sts_fallback_regions is not None:
|
|
571
|
+
pulumi.set(__self__, "sts_fallback_regions", sts_fallback_regions)
|
|
572
|
+
if sts_region is not None:
|
|
573
|
+
pulumi.set(__self__, "sts_region", sts_region)
|
|
422
574
|
if username_template is not None:
|
|
423
575
|
pulumi.set(__self__, "username_template", username_template)
|
|
424
576
|
|
|
@@ -460,6 +612,18 @@ class _SecretBackendState:
|
|
|
460
612
|
def description(self, value: Optional[pulumi.Input[str]]):
|
|
461
613
|
pulumi.set(self, "description", value)
|
|
462
614
|
|
|
615
|
+
@property
|
|
616
|
+
@pulumi.getter(name="disableAutomatedRotation")
|
|
617
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[bool]]:
|
|
618
|
+
"""
|
|
619
|
+
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
620
|
+
"""
|
|
621
|
+
return pulumi.get(self, "disable_automated_rotation")
|
|
622
|
+
|
|
623
|
+
@disable_automated_rotation.setter
|
|
624
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[bool]]):
|
|
625
|
+
pulumi.set(self, "disable_automated_rotation", value)
|
|
626
|
+
|
|
463
627
|
@property
|
|
464
628
|
@pulumi.getter(name="disableRemount")
|
|
465
629
|
def disable_remount(self) -> Optional[pulumi.Input[bool]]:
|
|
@@ -591,15 +755,6 @@ class _SecretBackendState:
|
|
|
591
755
|
def role_arn(self) -> Optional[pulumi.Input[str]]:
|
|
592
756
|
"""
|
|
593
757
|
Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
594
|
-
|
|
595
|
-
```
|
|
596
|
-
{{ if (eq .Type "STS") }}
|
|
597
|
-
{{ printf "vault-%s-%s" (unix_time) (random 20) | truncate 32 }}
|
|
598
|
-
{{ else }}
|
|
599
|
-
{{ printf "vault-%s-%s-%s" (printf "%s-%s" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}
|
|
600
|
-
{{ end }}
|
|
601
|
-
|
|
602
|
-
```
|
|
603
758
|
"""
|
|
604
759
|
return pulumi.get(self, "role_arn")
|
|
605
760
|
|
|
@@ -607,6 +762,46 @@ class _SecretBackendState:
|
|
|
607
762
|
def role_arn(self, value: Optional[pulumi.Input[str]]):
|
|
608
763
|
pulumi.set(self, "role_arn", value)
|
|
609
764
|
|
|
765
|
+
@property
|
|
766
|
+
@pulumi.getter(name="rotationPeriod")
|
|
767
|
+
def rotation_period(self) -> Optional[pulumi.Input[int]]:
|
|
768
|
+
"""
|
|
769
|
+
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
770
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
771
|
+
"""
|
|
772
|
+
return pulumi.get(self, "rotation_period")
|
|
773
|
+
|
|
774
|
+
@rotation_period.setter
|
|
775
|
+
def rotation_period(self, value: Optional[pulumi.Input[int]]):
|
|
776
|
+
pulumi.set(self, "rotation_period", value)
|
|
777
|
+
|
|
778
|
+
@property
|
|
779
|
+
@pulumi.getter(name="rotationSchedule")
|
|
780
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[str]]:
|
|
781
|
+
"""
|
|
782
|
+
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
783
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
784
|
+
"""
|
|
785
|
+
return pulumi.get(self, "rotation_schedule")
|
|
786
|
+
|
|
787
|
+
@rotation_schedule.setter
|
|
788
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[str]]):
|
|
789
|
+
pulumi.set(self, "rotation_schedule", value)
|
|
790
|
+
|
|
791
|
+
@property
|
|
792
|
+
@pulumi.getter(name="rotationWindow")
|
|
793
|
+
def rotation_window(self) -> Optional[pulumi.Input[int]]:
|
|
794
|
+
"""
|
|
795
|
+
The maximum amount of time in seconds allowed to complete
|
|
796
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
797
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
798
|
+
"""
|
|
799
|
+
return pulumi.get(self, "rotation_window")
|
|
800
|
+
|
|
801
|
+
@rotation_window.setter
|
|
802
|
+
def rotation_window(self, value: Optional[pulumi.Input[int]]):
|
|
803
|
+
pulumi.set(self, "rotation_window", value)
|
|
804
|
+
|
|
610
805
|
@property
|
|
611
806
|
@pulumi.getter(name="secretKey")
|
|
612
807
|
def secret_key(self) -> Optional[pulumi.Input[str]]:
|
|
@@ -631,11 +826,56 @@ class _SecretBackendState:
|
|
|
631
826
|
def sts_endpoint(self, value: Optional[pulumi.Input[str]]):
|
|
632
827
|
pulumi.set(self, "sts_endpoint", value)
|
|
633
828
|
|
|
829
|
+
@property
|
|
830
|
+
@pulumi.getter(name="stsFallbackEndpoints")
|
|
831
|
+
def sts_fallback_endpoints(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
832
|
+
"""
|
|
833
|
+
Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
834
|
+
"""
|
|
835
|
+
return pulumi.get(self, "sts_fallback_endpoints")
|
|
836
|
+
|
|
837
|
+
@sts_fallback_endpoints.setter
|
|
838
|
+
def sts_fallback_endpoints(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
839
|
+
pulumi.set(self, "sts_fallback_endpoints", value)
|
|
840
|
+
|
|
841
|
+
@property
|
|
842
|
+
@pulumi.getter(name="stsFallbackRegions")
|
|
843
|
+
def sts_fallback_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
844
|
+
"""
|
|
845
|
+
Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
846
|
+
"""
|
|
847
|
+
return pulumi.get(self, "sts_fallback_regions")
|
|
848
|
+
|
|
849
|
+
@sts_fallback_regions.setter
|
|
850
|
+
def sts_fallback_regions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
851
|
+
pulumi.set(self, "sts_fallback_regions", value)
|
|
852
|
+
|
|
853
|
+
@property
|
|
854
|
+
@pulumi.getter(name="stsRegion")
|
|
855
|
+
def sts_region(self) -> Optional[pulumi.Input[str]]:
|
|
856
|
+
"""
|
|
857
|
+
Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
858
|
+
"""
|
|
859
|
+
return pulumi.get(self, "sts_region")
|
|
860
|
+
|
|
861
|
+
@sts_region.setter
|
|
862
|
+
def sts_region(self, value: Optional[pulumi.Input[str]]):
|
|
863
|
+
pulumi.set(self, "sts_region", value)
|
|
864
|
+
|
|
634
865
|
@property
|
|
635
866
|
@pulumi.getter(name="usernameTemplate")
|
|
636
867
|
def username_template(self) -> Optional[pulumi.Input[str]]:
|
|
637
868
|
"""
|
|
638
869
|
Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
870
|
+
|
|
871
|
+
```
|
|
872
|
+
{{ if (eq .Type "STS") }}
|
|
873
|
+
{{ printf "vault-%s-%s" (unix_time) (random 20) | truncate 32 }}
|
|
874
|
+
{{ else }}
|
|
875
|
+
{{ printf "vault-%s-%s-%s" (printf "%s-%s" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}
|
|
876
|
+
{{ end }}
|
|
877
|
+
|
|
878
|
+
```
|
|
639
879
|
"""
|
|
640
880
|
return pulumi.get(self, "username_template")
|
|
641
881
|
|
|
@@ -652,6 +892,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
652
892
|
access_key: Optional[pulumi.Input[str]] = None,
|
|
653
893
|
default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
|
|
654
894
|
description: Optional[pulumi.Input[str]] = None,
|
|
895
|
+
disable_automated_rotation: Optional[pulumi.Input[bool]] = None,
|
|
655
896
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
656
897
|
iam_endpoint: Optional[pulumi.Input[str]] = None,
|
|
657
898
|
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
@@ -663,8 +904,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
663
904
|
path: Optional[pulumi.Input[str]] = None,
|
|
664
905
|
region: Optional[pulumi.Input[str]] = None,
|
|
665
906
|
role_arn: Optional[pulumi.Input[str]] = None,
|
|
907
|
+
rotation_period: Optional[pulumi.Input[int]] = None,
|
|
908
|
+
rotation_schedule: Optional[pulumi.Input[str]] = None,
|
|
909
|
+
rotation_window: Optional[pulumi.Input[int]] = None,
|
|
666
910
|
secret_key: Optional[pulumi.Input[str]] = None,
|
|
667
911
|
sts_endpoint: Optional[pulumi.Input[str]] = None,
|
|
912
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
913
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
914
|
+
sts_region: Optional[pulumi.Input[str]] = None,
|
|
668
915
|
username_template: Optional[pulumi.Input[str]] = None,
|
|
669
916
|
__props__=None):
|
|
670
917
|
"""
|
|
@@ -683,6 +930,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
683
930
|
:param pulumi.Input[int] default_lease_ttl_seconds: The default TTL for credentials
|
|
684
931
|
issued by this backend.
|
|
685
932
|
:param pulumi.Input[str] description: A human-friendly description for this backend.
|
|
933
|
+
:param pulumi.Input[bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
686
934
|
:param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
687
935
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
688
936
|
:param pulumi.Input[str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
@@ -700,6 +948,19 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
700
948
|
not begin or end with a `/`. Defaults to `aws`.
|
|
701
949
|
:param pulumi.Input[str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
702
950
|
:param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
951
|
+
:param pulumi.Input[int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
952
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
953
|
+
:param pulumi.Input[str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
954
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
955
|
+
:param pulumi.Input[int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
956
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
957
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
958
|
+
:param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
959
|
+
:param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
960
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
961
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] sts_fallback_regions: Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
962
|
+
:param pulumi.Input[str] sts_region: Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
963
|
+
:param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
703
964
|
|
|
704
965
|
```
|
|
705
966
|
{{ if (eq .Type "STS") }}
|
|
@@ -709,9 +970,6 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
709
970
|
{{ end }}
|
|
710
971
|
|
|
711
972
|
```
|
|
712
|
-
:param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
713
|
-
:param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
714
|
-
:param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
715
973
|
"""
|
|
716
974
|
...
|
|
717
975
|
@overload
|
|
@@ -746,6 +1004,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
746
1004
|
access_key: Optional[pulumi.Input[str]] = None,
|
|
747
1005
|
default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
|
|
748
1006
|
description: Optional[pulumi.Input[str]] = None,
|
|
1007
|
+
disable_automated_rotation: Optional[pulumi.Input[bool]] = None,
|
|
749
1008
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
750
1009
|
iam_endpoint: Optional[pulumi.Input[str]] = None,
|
|
751
1010
|
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
@@ -757,8 +1016,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
757
1016
|
path: Optional[pulumi.Input[str]] = None,
|
|
758
1017
|
region: Optional[pulumi.Input[str]] = None,
|
|
759
1018
|
role_arn: Optional[pulumi.Input[str]] = None,
|
|
1019
|
+
rotation_period: Optional[pulumi.Input[int]] = None,
|
|
1020
|
+
rotation_schedule: Optional[pulumi.Input[str]] = None,
|
|
1021
|
+
rotation_window: Optional[pulumi.Input[int]] = None,
|
|
760
1022
|
secret_key: Optional[pulumi.Input[str]] = None,
|
|
761
1023
|
sts_endpoint: Optional[pulumi.Input[str]] = None,
|
|
1024
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
1025
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
1026
|
+
sts_region: Optional[pulumi.Input[str]] = None,
|
|
762
1027
|
username_template: Optional[pulumi.Input[str]] = None,
|
|
763
1028
|
__props__=None):
|
|
764
1029
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
@@ -772,6 +1037,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
772
1037
|
__props__.__dict__["access_key"] = None if access_key is None else pulumi.Output.secret(access_key)
|
|
773
1038
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
774
1039
|
__props__.__dict__["description"] = description
|
|
1040
|
+
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
775
1041
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
776
1042
|
__props__.__dict__["iam_endpoint"] = iam_endpoint
|
|
777
1043
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
@@ -783,8 +1049,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
783
1049
|
__props__.__dict__["path"] = path
|
|
784
1050
|
__props__.__dict__["region"] = region
|
|
785
1051
|
__props__.__dict__["role_arn"] = role_arn
|
|
1052
|
+
__props__.__dict__["rotation_period"] = rotation_period
|
|
1053
|
+
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
1054
|
+
__props__.__dict__["rotation_window"] = rotation_window
|
|
786
1055
|
__props__.__dict__["secret_key"] = None if secret_key is None else pulumi.Output.secret(secret_key)
|
|
787
1056
|
__props__.__dict__["sts_endpoint"] = sts_endpoint
|
|
1057
|
+
__props__.__dict__["sts_fallback_endpoints"] = sts_fallback_endpoints
|
|
1058
|
+
__props__.__dict__["sts_fallback_regions"] = sts_fallback_regions
|
|
1059
|
+
__props__.__dict__["sts_region"] = sts_region
|
|
788
1060
|
__props__.__dict__["username_template"] = username_template
|
|
789
1061
|
secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["accessKey", "secretKey"])
|
|
790
1062
|
opts = pulumi.ResourceOptions.merge(opts, secret_opts)
|
|
@@ -801,6 +1073,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
801
1073
|
access_key: Optional[pulumi.Input[str]] = None,
|
|
802
1074
|
default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
|
|
803
1075
|
description: Optional[pulumi.Input[str]] = None,
|
|
1076
|
+
disable_automated_rotation: Optional[pulumi.Input[bool]] = None,
|
|
804
1077
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
805
1078
|
iam_endpoint: Optional[pulumi.Input[str]] = None,
|
|
806
1079
|
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
@@ -812,8 +1085,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
812
1085
|
path: Optional[pulumi.Input[str]] = None,
|
|
813
1086
|
region: Optional[pulumi.Input[str]] = None,
|
|
814
1087
|
role_arn: Optional[pulumi.Input[str]] = None,
|
|
1088
|
+
rotation_period: Optional[pulumi.Input[int]] = None,
|
|
1089
|
+
rotation_schedule: Optional[pulumi.Input[str]] = None,
|
|
1090
|
+
rotation_window: Optional[pulumi.Input[int]] = None,
|
|
815
1091
|
secret_key: Optional[pulumi.Input[str]] = None,
|
|
816
1092
|
sts_endpoint: Optional[pulumi.Input[str]] = None,
|
|
1093
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
1094
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
1095
|
+
sts_region: Optional[pulumi.Input[str]] = None,
|
|
817
1096
|
username_template: Optional[pulumi.Input[str]] = None) -> 'SecretBackend':
|
|
818
1097
|
"""
|
|
819
1098
|
Get an existing SecretBackend resource's state with the given name, id, and optional extra
|
|
@@ -827,6 +1106,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
827
1106
|
:param pulumi.Input[int] default_lease_ttl_seconds: The default TTL for credentials
|
|
828
1107
|
issued by this backend.
|
|
829
1108
|
:param pulumi.Input[str] description: A human-friendly description for this backend.
|
|
1109
|
+
:param pulumi.Input[bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
830
1110
|
:param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
831
1111
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
832
1112
|
:param pulumi.Input[str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
@@ -844,6 +1124,19 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
844
1124
|
not begin or end with a `/`. Defaults to `aws`.
|
|
845
1125
|
:param pulumi.Input[str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
846
1126
|
:param pulumi.Input[str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
1127
|
+
:param pulumi.Input[int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1128
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1129
|
+
:param pulumi.Input[str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1130
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1131
|
+
:param pulumi.Input[int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
1132
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
1133
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1134
|
+
:param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
1135
|
+
:param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
1136
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
1137
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] sts_fallback_regions: Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
1138
|
+
:param pulumi.Input[str] sts_region: Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
1139
|
+
:param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
847
1140
|
|
|
848
1141
|
```
|
|
849
1142
|
{{ if (eq .Type "STS") }}
|
|
@@ -853,9 +1146,6 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
853
1146
|
{{ end }}
|
|
854
1147
|
|
|
855
1148
|
```
|
|
856
|
-
:param pulumi.Input[str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
857
|
-
:param pulumi.Input[str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
858
|
-
:param pulumi.Input[str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
859
1149
|
"""
|
|
860
1150
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
861
1151
|
|
|
@@ -864,6 +1154,7 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
864
1154
|
__props__.__dict__["access_key"] = access_key
|
|
865
1155
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
866
1156
|
__props__.__dict__["description"] = description
|
|
1157
|
+
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
867
1158
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
868
1159
|
__props__.__dict__["iam_endpoint"] = iam_endpoint
|
|
869
1160
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
@@ -875,8 +1166,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
875
1166
|
__props__.__dict__["path"] = path
|
|
876
1167
|
__props__.__dict__["region"] = region
|
|
877
1168
|
__props__.__dict__["role_arn"] = role_arn
|
|
1169
|
+
__props__.__dict__["rotation_period"] = rotation_period
|
|
1170
|
+
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
1171
|
+
__props__.__dict__["rotation_window"] = rotation_window
|
|
878
1172
|
__props__.__dict__["secret_key"] = secret_key
|
|
879
1173
|
__props__.__dict__["sts_endpoint"] = sts_endpoint
|
|
1174
|
+
__props__.__dict__["sts_fallback_endpoints"] = sts_fallback_endpoints
|
|
1175
|
+
__props__.__dict__["sts_fallback_regions"] = sts_fallback_regions
|
|
1176
|
+
__props__.__dict__["sts_region"] = sts_region
|
|
880
1177
|
__props__.__dict__["username_template"] = username_template
|
|
881
1178
|
return SecretBackend(resource_name, opts=opts, __props__=__props__)
|
|
882
1179
|
|
|
@@ -906,6 +1203,14 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
906
1203
|
"""
|
|
907
1204
|
return pulumi.get(self, "description")
|
|
908
1205
|
|
|
1206
|
+
@property
|
|
1207
|
+
@pulumi.getter(name="disableAutomatedRotation")
|
|
1208
|
+
def disable_automated_rotation(self) -> pulumi.Output[Optional[bool]]:
|
|
1209
|
+
"""
|
|
1210
|
+
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1211
|
+
"""
|
|
1212
|
+
return pulumi.get(self, "disable_automated_rotation")
|
|
1213
|
+
|
|
909
1214
|
@property
|
|
910
1215
|
@pulumi.getter(name="disableRemount")
|
|
911
1216
|
def disable_remount(self) -> pulumi.Output[Optional[bool]]:
|
|
@@ -997,17 +1302,36 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
997
1302
|
def role_arn(self) -> pulumi.Output[Optional[str]]:
|
|
998
1303
|
"""
|
|
999
1304
|
Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
1305
|
+
"""
|
|
1306
|
+
return pulumi.get(self, "role_arn")
|
|
1000
1307
|
|
|
1001
|
-
|
|
1002
|
-
|
|
1003
|
-
|
|
1004
|
-
|
|
1005
|
-
|
|
1006
|
-
|
|
1308
|
+
@property
|
|
1309
|
+
@pulumi.getter(name="rotationPeriod")
|
|
1310
|
+
def rotation_period(self) -> pulumi.Output[Optional[int]]:
|
|
1311
|
+
"""
|
|
1312
|
+
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1313
|
+
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1314
|
+
"""
|
|
1315
|
+
return pulumi.get(self, "rotation_period")
|
|
1007
1316
|
|
|
1008
|
-
|
|
1317
|
+
@property
|
|
1318
|
+
@pulumi.getter(name="rotationSchedule")
|
|
1319
|
+
def rotation_schedule(self) -> pulumi.Output[Optional[str]]:
|
|
1009
1320
|
"""
|
|
1010
|
-
|
|
1321
|
+
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1322
|
+
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1323
|
+
"""
|
|
1324
|
+
return pulumi.get(self, "rotation_schedule")
|
|
1325
|
+
|
|
1326
|
+
@property
|
|
1327
|
+
@pulumi.getter(name="rotationWindow")
|
|
1328
|
+
def rotation_window(self) -> pulumi.Output[Optional[int]]:
|
|
1329
|
+
"""
|
|
1330
|
+
The maximum amount of time in seconds allowed to complete
|
|
1331
|
+
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
1332
|
+
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1333
|
+
"""
|
|
1334
|
+
return pulumi.get(self, "rotation_window")
|
|
1011
1335
|
|
|
1012
1336
|
@property
|
|
1013
1337
|
@pulumi.getter(name="secretKey")
|
|
@@ -1025,11 +1349,44 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1025
1349
|
"""
|
|
1026
1350
|
return pulumi.get(self, "sts_endpoint")
|
|
1027
1351
|
|
|
1352
|
+
@property
|
|
1353
|
+
@pulumi.getter(name="stsFallbackEndpoints")
|
|
1354
|
+
def sts_fallback_endpoints(self) -> pulumi.Output[Optional[Sequence[str]]]:
|
|
1355
|
+
"""
|
|
1356
|
+
Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
1357
|
+
"""
|
|
1358
|
+
return pulumi.get(self, "sts_fallback_endpoints")
|
|
1359
|
+
|
|
1360
|
+
@property
|
|
1361
|
+
@pulumi.getter(name="stsFallbackRegions")
|
|
1362
|
+
def sts_fallback_regions(self) -> pulumi.Output[Optional[Sequence[str]]]:
|
|
1363
|
+
"""
|
|
1364
|
+
Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
1365
|
+
"""
|
|
1366
|
+
return pulumi.get(self, "sts_fallback_regions")
|
|
1367
|
+
|
|
1368
|
+
@property
|
|
1369
|
+
@pulumi.getter(name="stsRegion")
|
|
1370
|
+
def sts_region(self) -> pulumi.Output[Optional[str]]:
|
|
1371
|
+
"""
|
|
1372
|
+
Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
1373
|
+
"""
|
|
1374
|
+
return pulumi.get(self, "sts_region")
|
|
1375
|
+
|
|
1028
1376
|
@property
|
|
1029
1377
|
@pulumi.getter(name="usernameTemplate")
|
|
1030
1378
|
def username_template(self) -> pulumi.Output[str]:
|
|
1031
1379
|
"""
|
|
1032
1380
|
Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
1381
|
+
|
|
1382
|
+
```
|
|
1383
|
+
{{ if (eq .Type "STS") }}
|
|
1384
|
+
{{ printf "vault-%s-%s" (unix_time) (random 20) | truncate 32 }}
|
|
1385
|
+
{{ else }}
|
|
1386
|
+
{{ printf "vault-%s-%s-%s" (printf "%s-%s" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}
|
|
1387
|
+
{{ end }}
|
|
1388
|
+
|
|
1389
|
+
```
|
|
1033
1390
|
"""
|
|
1034
1391
|
return pulumi.get(self, "username_template")
|
|
1035
1392
|
|