PyPI - pulumi-vault - Versions diffs - 6.6.0a1741415971__py3-none-any.whl → 6.7.0__py3-none-any.whl - Mend

pulumi-vault 6.6.0a1741415971py3-none-any.whl → 6.7.0py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (264) hide show

pulumi_vault/__init__.py +9 -0
pulumi_vault/_inputs.py +583 -562
pulumi_vault/ad/__init__.py +1 -0
pulumi_vault/ad/get_access_credentials.py +20 -19
pulumi_vault/ad/secret_backend.py +477 -476
pulumi_vault/ad/secret_library.py +99 -98
pulumi_vault/ad/secret_role.py +85 -84
pulumi_vault/alicloud/__init__.py +1 -0
pulumi_vault/alicloud/auth_backend_role.py +183 -182
pulumi_vault/approle/__init__.py +1 -0
pulumi_vault/approle/auth_backend_login.py +106 -105
pulumi_vault/approle/auth_backend_role.py +239 -238
pulumi_vault/approle/auth_backend_role_secret_id.py +162 -161
pulumi_vault/approle/get_auth_backend_role_id.py +18 -17
pulumi_vault/audit.py +85 -84
pulumi_vault/audit_request_header.py +43 -42
pulumi_vault/auth_backend.py +106 -105
pulumi_vault/aws/__init__.py +1 -0
pulumi_vault/aws/auth_backend_cert.py +71 -70
pulumi_vault/aws/auth_backend_client.py +425 -200
pulumi_vault/aws/auth_backend_config_identity.py +85 -84
pulumi_vault/aws/auth_backend_identity_whitelist.py +57 -56
pulumi_vault/aws/auth_backend_login.py +209 -208
pulumi_vault/aws/auth_backend_role.py +400 -399
pulumi_vault/aws/auth_backend_role_tag.py +127 -126
pulumi_vault/aws/auth_backend_roletag_blacklist.py +57 -56
pulumi_vault/aws/auth_backend_sts_role.py +71 -70
pulumi_vault/aws/get_access_credentials.py +44 -43
pulumi_vault/aws/get_static_access_credentials.py +13 -12
pulumi_vault/aws/secret_backend.py +523 -306
pulumi_vault/aws/secret_backend_role.py +211 -210
pulumi_vault/aws/secret_backend_static_role.py +288 -70
pulumi_vault/azure/__init__.py +1 -0
pulumi_vault/azure/_inputs.py +21 -20
pulumi_vault/azure/auth_backend_config.py +383 -130
pulumi_vault/azure/auth_backend_role.py +253 -252
pulumi_vault/azure/backend.py +432 -186
pulumi_vault/azure/backend_role.py +188 -140
pulumi_vault/azure/get_access_credentials.py +58 -57
pulumi_vault/azure/outputs.py +11 -10
pulumi_vault/cert_auth_backend_role.py +365 -364
pulumi_vault/config/__init__.py +1 -0
pulumi_vault/config/__init__.pyi +1 -0
pulumi_vault/config/_inputs.py +11 -10
pulumi_vault/config/outputs.py +287 -286
pulumi_vault/config/ui_custom_message.py +113 -112
pulumi_vault/config/vars.py +1 -0
pulumi_vault/consul/__init__.py +1 -0
pulumi_vault/consul/secret_backend.py +197 -196
pulumi_vault/consul/secret_backend_role.py +183 -182
pulumi_vault/database/__init__.py +1 -0
pulumi_vault/database/_inputs.py +3857 -2200
pulumi_vault/database/outputs.py +2483 -1330
pulumi_vault/database/secret_backend_connection.py +333 -112
pulumi_vault/database/secret_backend_role.py +169 -168
pulumi_vault/database/secret_backend_static_role.py +283 -140
pulumi_vault/database/secrets_mount.py +275 -266
pulumi_vault/egp_policy.py +71 -70
pulumi_vault/gcp/__init__.py +1 -0
pulumi_vault/gcp/_inputs.py +82 -81
pulumi_vault/gcp/auth_backend.py +426 -205
pulumi_vault/gcp/auth_backend_role.py +281 -280
pulumi_vault/gcp/get_auth_backend_role.py +70 -69
pulumi_vault/gcp/outputs.py +50 -49
pulumi_vault/gcp/secret_backend.py +420 -179
pulumi_vault/gcp/secret_impersonated_account.py +92 -91
pulumi_vault/gcp/secret_roleset.py +92 -91
pulumi_vault/gcp/secret_static_account.py +92 -91
pulumi_vault/generic/__init__.py +1 -0
pulumi_vault/generic/endpoint.py +113 -112
pulumi_vault/generic/get_secret.py +28 -27
pulumi_vault/generic/secret.py +78 -77
pulumi_vault/get_auth_backend.py +19 -18
pulumi_vault/get_auth_backends.py +14 -13
pulumi_vault/get_namespace.py +15 -14
pulumi_vault/get_namespaces.py +68 -18
pulumi_vault/get_nomad_access_token.py +19 -18
pulumi_vault/get_policy_document.py +6 -5
pulumi_vault/get_raft_autopilot_state.py +18 -17
pulumi_vault/github/__init__.py +1 -0
pulumi_vault/github/_inputs.py +42 -41
pulumi_vault/github/auth_backend.py +232 -231
pulumi_vault/github/outputs.py +26 -25
pulumi_vault/github/team.py +57 -56
pulumi_vault/github/user.py +57 -56
pulumi_vault/identity/__init__.py +1 -0
pulumi_vault/identity/entity.py +85 -84
pulumi_vault/identity/entity_alias.py +71 -70
pulumi_vault/identity/entity_policies.py +64 -63
pulumi_vault/identity/get_entity.py +43 -42
pulumi_vault/identity/get_group.py +50 -49
pulumi_vault/identity/get_oidc_client_creds.py +14 -13
pulumi_vault/identity/get_oidc_openid_config.py +24 -23
pulumi_vault/identity/get_oidc_public_keys.py +13 -12
pulumi_vault/identity/group.py +141 -140
pulumi_vault/identity/group_alias.py +57 -56
pulumi_vault/identity/group_member_entity_ids.py +57 -56
pulumi_vault/identity/group_member_group_ids.py +57 -56
pulumi_vault/identity/group_policies.py +64 -63
pulumi_vault/identity/mfa_duo.py +148 -147
pulumi_vault/identity/mfa_login_enforcement.py +120 -119
pulumi_vault/identity/mfa_okta.py +134 -133
pulumi_vault/identity/mfa_pingid.py +127 -126
pulumi_vault/identity/mfa_totp.py +176 -175
pulumi_vault/identity/oidc.py +29 -28
pulumi_vault/identity/oidc_assignment.py +57 -56
pulumi_vault/identity/oidc_client.py +127 -126
pulumi_vault/identity/oidc_key.py +85 -84
pulumi_vault/identity/oidc_key_allowed_client_id.py +43 -42
pulumi_vault/identity/oidc_provider.py +92 -91
pulumi_vault/identity/oidc_role.py +85 -84
pulumi_vault/identity/oidc_scope.py +57 -56
pulumi_vault/identity/outputs.py +32 -31
pulumi_vault/jwt/__init__.py +1 -0
pulumi_vault/jwt/_inputs.py +42 -41
pulumi_vault/jwt/auth_backend.py +288 -287
pulumi_vault/jwt/auth_backend_role.py +407 -406
pulumi_vault/jwt/outputs.py +26 -25
pulumi_vault/kmip/__init__.py +1 -0
pulumi_vault/kmip/secret_backend.py +183 -182
pulumi_vault/kmip/secret_role.py +295 -294
pulumi_vault/kmip/secret_scope.py +57 -56
pulumi_vault/kubernetes/__init__.py +1 -0
pulumi_vault/kubernetes/auth_backend_config.py +141 -140
pulumi_vault/kubernetes/auth_backend_role.py +225 -224
pulumi_vault/kubernetes/get_auth_backend_config.py +47 -46
pulumi_vault/kubernetes/get_auth_backend_role.py +70 -69
pulumi_vault/kubernetes/get_service_account_token.py +38 -37
pulumi_vault/kubernetes/secret_backend.py +316 -315
pulumi_vault/kubernetes/secret_backend_role.py +197 -196
pulumi_vault/kv/__init__.py +1 -0
pulumi_vault/kv/_inputs.py +21 -20
pulumi_vault/kv/get_secret.py +17 -16
pulumi_vault/kv/get_secret_subkeys_v2.py +30 -29
pulumi_vault/kv/get_secret_v2.py +29 -28
pulumi_vault/kv/get_secrets_list.py +13 -12
pulumi_vault/kv/get_secrets_list_v2.py +19 -18
pulumi_vault/kv/outputs.py +13 -12
pulumi_vault/kv/secret.py +50 -49
pulumi_vault/kv/secret_backend_v2.py +71 -70
pulumi_vault/kv/secret_v2.py +134 -133
pulumi_vault/ldap/__init__.py +1 -0
pulumi_vault/ldap/auth_backend.py +754 -533
pulumi_vault/ldap/auth_backend_group.py +57 -56
pulumi_vault/ldap/auth_backend_user.py +71 -70
pulumi_vault/ldap/get_dynamic_credentials.py +17 -16
pulumi_vault/ldap/get_static_credentials.py +18 -17
pulumi_vault/ldap/secret_backend.py +720 -499
pulumi_vault/ldap/secret_backend_dynamic_role.py +127 -126
pulumi_vault/ldap/secret_backend_library_set.py +99 -98
pulumi_vault/ldap/secret_backend_static_role.py +99 -98
pulumi_vault/managed/__init__.py +1 -0
pulumi_vault/managed/_inputs.py +229 -228
pulumi_vault/managed/keys.py +15 -14
pulumi_vault/managed/outputs.py +139 -138
pulumi_vault/mfa_duo.py +113 -112
pulumi_vault/mfa_okta.py +113 -112
pulumi_vault/mfa_pingid.py +120 -119
pulumi_vault/mfa_totp.py +127 -126
pulumi_vault/mongodbatlas/__init__.py +1 -0
pulumi_vault/mongodbatlas/secret_backend.py +64 -63
pulumi_vault/mongodbatlas/secret_role.py +155 -154
pulumi_vault/mount.py +274 -273
pulumi_vault/namespace.py +64 -63
pulumi_vault/nomad_secret_backend.py +211 -210
pulumi_vault/nomad_secret_role.py +85 -84
pulumi_vault/okta/__init__.py +1 -0
pulumi_vault/okta/_inputs.py +26 -25
pulumi_vault/okta/auth_backend.py +274 -273
pulumi_vault/okta/auth_backend_group.py +57 -56
pulumi_vault/okta/auth_backend_user.py +71 -70
pulumi_vault/okta/outputs.py +16 -15
pulumi_vault/outputs.py +73 -60
pulumi_vault/password_policy.py +43 -42
pulumi_vault/pkisecret/__init__.py +3 -0
pulumi_vault/pkisecret/_inputs.py +31 -36
pulumi_vault/pkisecret/backend_acme_eab.py +92 -91
pulumi_vault/pkisecret/backend_config_acme.py +174 -126
pulumi_vault/pkisecret/backend_config_auto_tidy.py +1377 -0
pulumi_vault/pkisecret/backend_config_cluster.py +57 -56
pulumi_vault/pkisecret/backend_config_cmpv2.py +152 -104
pulumi_vault/pkisecret/backend_config_est.py +120 -119
pulumi_vault/pkisecret/get_backend_cert_metadata.py +278 -0
pulumi_vault/pkisecret/get_backend_config_cmpv2.py +35 -17
pulumi_vault/pkisecret/get_backend_config_est.py +19 -18
pulumi_vault/pkisecret/get_backend_issuer.py +139 -25
pulumi_vault/pkisecret/get_backend_issuers.py +15 -14
pulumi_vault/pkisecret/get_backend_key.py +20 -19
pulumi_vault/pkisecret/get_backend_keys.py +15 -14
pulumi_vault/pkisecret/outputs.py +28 -31
pulumi_vault/pkisecret/secret_backend_cert.py +439 -297
pulumi_vault/pkisecret/secret_backend_config_ca.py +43 -42
pulumi_vault/pkisecret/secret_backend_config_issuers.py +57 -56
pulumi_vault/pkisecret/secret_backend_config_urls.py +85 -84
pulumi_vault/pkisecret/secret_backend_crl_config.py +237 -182
pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +520 -378
pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +57 -56
pulumi_vault/pkisecret/secret_backend_issuer.py +441 -175
pulumi_vault/pkisecret/secret_backend_key.py +120 -119
pulumi_vault/pkisecret/secret_backend_role.py +894 -644
pulumi_vault/pkisecret/secret_backend_root_cert.py +851 -427
pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +936 -357
pulumi_vault/pkisecret/secret_backend_sign.py +347 -252
pulumi_vault/plugin.py +127 -126
pulumi_vault/plugin_pinned_version.py +43 -42
pulumi_vault/policy.py +43 -42
pulumi_vault/provider.py +120 -119
pulumi_vault/pulumi-plugin.json +1 -1
pulumi_vault/quota_lease_count.py +85 -84
pulumi_vault/quota_rate_limit.py +113 -112
pulumi_vault/rabbitmq/__init__.py +1 -0
pulumi_vault/rabbitmq/_inputs.py +41 -40
pulumi_vault/rabbitmq/outputs.py +25 -24
pulumi_vault/rabbitmq/secret_backend.py +169 -168
pulumi_vault/rabbitmq/secret_backend_role.py +57 -56
pulumi_vault/raft_autopilot.py +113 -112
pulumi_vault/raft_snapshot_agent_config.py +393 -392
pulumi_vault/rgp_policy.py +57 -56
pulumi_vault/saml/__init__.py +1 -0
pulumi_vault/saml/auth_backend.py +155 -154
pulumi_vault/saml/auth_backend_role.py +239 -238
pulumi_vault/secrets/__init__.py +1 -0
pulumi_vault/secrets/_inputs.py +16 -15
pulumi_vault/secrets/outputs.py +10 -9
pulumi_vault/secrets/sync_association.py +71 -70
pulumi_vault/secrets/sync_aws_destination.py +148 -147
pulumi_vault/secrets/sync_azure_destination.py +148 -147
pulumi_vault/secrets/sync_config.py +43 -42
pulumi_vault/secrets/sync_gcp_destination.py +106 -105
pulumi_vault/secrets/sync_gh_destination.py +134 -133
pulumi_vault/secrets/sync_github_apps.py +64 -63
pulumi_vault/secrets/sync_vercel_destination.py +120 -119
pulumi_vault/ssh/__init__.py +2 -0
pulumi_vault/ssh/_inputs.py +11 -10
pulumi_vault/ssh/get_secret_backend_sign.py +295 -0
pulumi_vault/ssh/outputs.py +7 -6
pulumi_vault/ssh/secret_backend_ca.py +99 -98
pulumi_vault/ssh/secret_backend_role.py +365 -364
pulumi_vault/terraformcloud/__init__.py +1 -0
pulumi_vault/terraformcloud/secret_backend.py +111 -110
pulumi_vault/terraformcloud/secret_creds.py +74 -73
pulumi_vault/terraformcloud/secret_role.py +96 -95
pulumi_vault/token.py +246 -245
pulumi_vault/tokenauth/__init__.py +1 -0
pulumi_vault/tokenauth/auth_backend_role.py +267 -266
pulumi_vault/transform/__init__.py +1 -0
pulumi_vault/transform/alphabet.py +57 -56
pulumi_vault/transform/get_decode.py +47 -46
pulumi_vault/transform/get_encode.py +47 -46
pulumi_vault/transform/role.py +57 -56
pulumi_vault/transform/template.py +113 -112
pulumi_vault/transform/transformation.py +141 -140
pulumi_vault/transit/__init__.py +3 -0
pulumi_vault/transit/get_decrypt.py +18 -17
pulumi_vault/transit/get_encrypt.py +21 -20
pulumi_vault/transit/get_sign.py +325 -0
pulumi_vault/transit/get_verify.py +355 -0
pulumi_vault/transit/secret_backend_key.py +394 -231
pulumi_vault/transit/secret_cache_config.py +43 -42
{pulumi_vault-6.6.0a1741415971.dist-info → pulumi_vault-6.7.0.dist-info}/METADATA +2 -2
pulumi_vault-6.7.0.dist-info/RECORD +265 -0
{pulumi_vault-6.6.0a1741415971.dist-info → pulumi_vault-6.7.0.dist-info}/WHEEL +1 -1
pulumi_vault-6.6.0a1741415971.dist-info/RECORD +0 -260
{pulumi_vault-6.6.0a1741415971.dist-info → pulumi_vault-6.7.0.dist-info}/top_level.txt +0 -0

pulumi_vault/pkisecret/secret_backend_role.py CHANGED Viewed

@@ -2,6 +2,7 @@
 # *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
 # *** Do not edit by hand unless you're certain you know what you are doing! ***
+import builtins
 import copy
 import warnings
 import sys
@@ -21,111 +22,123 @@ __all__ = ['SecretBackendRoleArgs', 'SecretBackendRole']
 @pulumi.input_type
 class SecretBackendRoleArgs:
     def __init__(__self__, *,
-                 backend: pulumi.Input[str],
-                 allow_any_name: Optional[pulumi.Input[bool]] = None,
-                 allow_bare_domains: Optional[pulumi.Input[bool]] = None,
-                 allow_glob_domains: Optional[pulumi.Input[bool]] = None,
-                 allow_ip_sans: Optional[pulumi.Input[bool]] = None,
-                 allow_localhost: Optional[pulumi.Input[bool]] = None,
-                 allow_subdomains: Optional[pulumi.Input[bool]] = None,
-                 allow_wildcard_certificates: Optional[pulumi.Input[bool]] = None,
-                 allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_domains_template: Optional[pulumi.Input[bool]] = None,
-                 allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_uri_sans_template: Optional[pulumi.Input[bool]] = None,
-                 allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 basic_constraints_valid_for_non_ca: Optional[pulumi.Input[bool]] = None,
-                 client_flag: Optional[pulumi.Input[bool]] = None,
-                 cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 code_signing_flag: Optional[pulumi.Input[bool]] = None,
-                 countries: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 email_protection_flag: Optional[pulumi.Input[bool]] = None,
-                 enforce_hostnames: Optional[pulumi.Input[bool]] = None,
-                 ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 generate_lease: Optional[pulumi.Input[bool]] = None,
-                 issuer_ref: Optional[pulumi.Input[str]] = None,
-                 key_bits: Optional[pulumi.Input[int]] = None,
-                 key_type: Optional[pulumi.Input[str]] = None,
-                 key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 localities: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 max_ttl: Optional[pulumi.Input[str]] = None,
-                 name: Optional[pulumi.Input[str]] = None,
-                 namespace: Optional[pulumi.Input[str]] = None,
-                 no_store: Optional[pulumi.Input[bool]] = None,
-                 not_before_duration: Optional[pulumi.Input[str]] = None,
-                 organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 organizations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
+                 backend: pulumi.Input[builtins.str],
+                 allow_any_name: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_bare_domains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_glob_domains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_ip_sans: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_localhost: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_subdomains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_wildcard_certificates: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_domains_template: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_uri_sans_template: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 basic_constraints_valid_for_non_ca: Optional[pulumi.Input[builtins.bool]] = None,
+                 client_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 code_signing_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 countries: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 email_protection_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 enforce_hostnames: Optional[pulumi.Input[builtins.bool]] = None,
+                 ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 generate_lease: Optional[pulumi.Input[builtins.bool]] = None,
+                 issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
+                 key_bits: Optional[pulumi.Input[builtins.int]] = None,
+                 key_type: Optional[pulumi.Input[builtins.str]] = None,
+                 key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 localities: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 max_ttl: Optional[pulumi.Input[builtins.str]] = None,
+                 name: Optional[pulumi.Input[builtins.str]] = None,
+                 namespace: Optional[pulumi.Input[builtins.str]] = None,
+                 no_store: Optional[pulumi.Input[builtins.bool]] = None,
+                 no_store_metadata: Optional[pulumi.Input[builtins.bool]] = None,
+                 not_after: Optional[pulumi.Input[builtins.str]] = None,
+                 not_before_duration: Optional[pulumi.Input[builtins.str]] = None,
+                 organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 organizations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
                  policy_identifier: Optional[pulumi.Input[Sequence[pulumi.Input['SecretBackendRolePolicyIdentifierArgs']]]] = None,
-                 policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 provinces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 require_cn: Optional[pulumi.Input[bool]] = None,
-                 server_flag: Optional[pulumi.Input[bool]] = None,
-                 street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 ttl: Optional[pulumi.Input[str]] = None,
-                 use_csr_common_name: Optional[pulumi.Input[bool]] = None,
-                 use_csr_sans: Optional[pulumi.Input[bool]] = None):
+                 policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 provinces: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 require_cn: Optional[pulumi.Input[builtins.bool]] = None,
+                 serial_number_source: Optional[pulumi.Input[builtins.str]] = None,
+                 server_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 signature_bits: Optional[pulumi.Input[builtins.int]] = None,
+                 street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 ttl: Optional[pulumi.Input[builtins.str]] = None,
+                 use_csr_common_name: Optional[pulumi.Input[builtins.bool]] = None,
+                 use_csr_sans: Optional[pulumi.Input[builtins.bool]] = None,
+                 use_pss: Optional[pulumi.Input[builtins.bool]] = None):
         """
         The set of arguments for constructing a SecretBackendRole resource.
-        :param pulumi.Input[str] backend: The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
-        :param pulumi.Input[bool] allow_any_name: Flag to allow any name
-        :param pulumi.Input[bool] allow_bare_domains: Flag to allow certificates matching the actual domain
-        :param pulumi.Input[bool] allow_glob_domains: Flag to allow names containing glob patterns.
-        :param pulumi.Input[bool] allow_ip_sans: Flag to allow IP SANs
-        :param pulumi.Input[bool] allow_localhost: Flag to allow certificates for localhost
-        :param pulumi.Input[bool] allow_subdomains: Flag to allow certificates matching subdomains
-        :param pulumi.Input[bool] allow_wildcard_certificates: Flag to allow wildcard certificates.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_domains: List of allowed domains for certificates
-        :param pulumi.Input[bool] allowed_domains_template: Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_other_sans: Defines allowed custom SANs
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_serial_numbers: An array of allowed serial numbers to put in Subject
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_uri_sans: Defines allowed URI SANs
-        :param pulumi.Input[bool] allowed_uri_sans_template: Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_user_ids: Defines allowed User IDs
-        :param pulumi.Input[bool] basic_constraints_valid_for_non_ca: Flag to mark basic constraints valid when issuing non-CA certificates
-        :param pulumi.Input[bool] client_flag: Flag to specify certificates for client use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] cn_validations: Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
-        :param pulumi.Input[bool] code_signing_flag: Flag to specify certificates for code signing use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] countries: The country of generated certificates
-        :param pulumi.Input[bool] email_protection_flag: Flag to specify certificates for email protection use
-        :param pulumi.Input[bool] enforce_hostnames: Flag to allow only valid host names
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] ext_key_usage_oids: Specify the allowed extended key usage OIDs constraint on issued certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] ext_key_usages: Specify the allowed extended key usage constraint on issued certificates
-        :param pulumi.Input[bool] generate_lease: Flag to generate leases with certificates
-        :param pulumi.Input[str] issuer_ref: Specifies the default issuer of this request. May
+        :param pulumi.Input[builtins.str] backend: The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
+        :param pulumi.Input[builtins.bool] allow_any_name: Flag to allow any name
+        :param pulumi.Input[builtins.bool] allow_bare_domains: Flag to allow certificates matching the actual domain
+        :param pulumi.Input[builtins.bool] allow_glob_domains: Flag to allow names containing glob patterns.
+        :param pulumi.Input[builtins.bool] allow_ip_sans: Flag to allow IP SANs
+        :param pulumi.Input[builtins.bool] allow_localhost: Flag to allow certificates for localhost
+        :param pulumi.Input[builtins.bool] allow_subdomains: Flag to allow certificates matching subdomains
+        :param pulumi.Input[builtins.bool] allow_wildcard_certificates: Flag to allow wildcard certificates.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_domains: List of allowed domains for certificates
+        :param pulumi.Input[builtins.bool] allowed_domains_template: Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_other_sans: Defines allowed custom SANs
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_serial_numbers: An array of allowed serial numbers to put in Subject
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_uri_sans: Defines allowed URI SANs
+        :param pulumi.Input[builtins.bool] allowed_uri_sans_template: Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_user_ids: Defines allowed User IDs
+        :param pulumi.Input[builtins.bool] basic_constraints_valid_for_non_ca: Flag to mark basic constraints valid when issuing non-CA certificates
+        :param pulumi.Input[builtins.bool] client_flag: Flag to specify certificates for client use
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] cn_validations: Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
+        :param pulumi.Input[builtins.bool] code_signing_flag: Flag to specify certificates for code signing use
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] countries: The country of generated certificates
+        :param pulumi.Input[builtins.bool] email_protection_flag: Flag to specify certificates for email protection use
+        :param pulumi.Input[builtins.bool] enforce_hostnames: Flag to allow only valid host names
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] ext_key_usage_oids: Specify the allowed extended key usage OIDs constraint on issued certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] ext_key_usages: Specify the allowed extended key usage constraint on issued certificates
+        :param pulumi.Input[builtins.bool] generate_lease: Flag to generate leases with certificates
+        :param pulumi.Input[builtins.str] issuer_ref: Specifies the default issuer of this request. May
                be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
                the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users
                overriding the role's `issuer_ref` value.
-        :param pulumi.Input[int] key_bits: The number of bits of generated keys
-        :param pulumi.Input[str] key_type: The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
+        :param pulumi.Input[builtins.int] key_bits: The number of bits of generated keys
+        :param pulumi.Input[builtins.str] key_type: The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
                Defaults to `rsa`
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] key_usages: Specify the allowed key usage constraint on issued
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] key_usages: Specify the allowed key usage constraint on issued
                certificates. Defaults to `["DigitalSignature", "KeyAgreement", "KeyEncipherment"])`.
                To specify no default key usage constraints, set this to an empty list `[]`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] localities: The locality of generated certificates
-        :param pulumi.Input[str] max_ttl: The maximum lease TTL, in seconds, for the role.
-        :param pulumi.Input[str] name: The name to identify this role within the backend. Must be unique within the backend.
-        :param pulumi.Input[str] namespace: The namespace to provision the resource in.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] localities: The locality of generated certificates
+        :param pulumi.Input[builtins.str] max_ttl: The maximum lease TTL, in seconds, for the role.
+        :param pulumi.Input[builtins.str] name: The name to identify this role within the backend. Must be unique within the backend.
+        :param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[bool] no_store: Flag to not store certificates in the storage backend
-        :param pulumi.Input[str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] organization_unit: The organization unit of generated certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] organizations: The organization of generated certificates
+        :param pulumi.Input[builtins.bool] no_store: Flag to not store certificates in the storage backend
+        :param pulumi.Input[builtins.bool] no_store_metadata: Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs
+        :param pulumi.Input[builtins.str] not_after: Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
+        :param pulumi.Input[builtins.str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] organization_unit: The organization unit of generated certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] organizations: The organization of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input['SecretBackendRolePolicyIdentifierArgs']]] policy_identifier: (Vault 1.11+ only) A block for specifying policy identifers. The `policy_identifier` block can be repeated, and supports the following arguments:
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] postal_codes: The postal code of generated certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] provinces: The province of generated certificates
-        :param pulumi.Input[bool] require_cn: Flag to force CN usage
-        :param pulumi.Input[bool] server_flag: Flag to specify certificates for server use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] street_addresses: The street address of generated certificates
-        :param pulumi.Input[str] ttl: The TTL, in seconds, for any certificate issued against this role.
-        :param pulumi.Input[bool] use_csr_common_name: Flag to use the CN in the CSR
-        :param pulumi.Input[bool] use_csr_sans: Flag to use the SANs in the CSR
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] postal_codes: The postal code of generated certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] provinces: The province of generated certificates
+        :param pulumi.Input[builtins.bool] require_cn: Flag to force CN usage
+        :param pulumi.Input[builtins.str] serial_number_source: Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the serial_number parameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the serial_number parameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.
+               Example usage:
+        :param pulumi.Input[builtins.bool] server_flag: Flag to specify certificates for server use
+        :param pulumi.Input[builtins.int] signature_bits: The number of bits to use in the signature algorithm
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] street_addresses: The street address of generated certificates
+        :param pulumi.Input[builtins.str] ttl: The TTL, in seconds, for any certificate issued against this role.
+        :param pulumi.Input[builtins.bool] use_csr_common_name: Flag to use the CN in the CSR
+        :param pulumi.Input[builtins.bool] use_csr_sans: Flag to use the SANs in the CSR
+        :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
         """
         pulumi.set(__self__, "backend", backend)
         if allow_any_name is not None:
@@ -194,6 +207,10 @@ class SecretBackendRoleArgs:
             pulumi.set(__self__, "namespace", namespace)
         if no_store is not None:
             pulumi.set(__self__, "no_store", no_store)
+        if no_store_metadata is not None:
+            pulumi.set(__self__, "no_store_metadata", no_store_metadata)
+        if not_after is not None:
+            pulumi.set(__self__, "not_after", not_after)
         if not_before_duration is not None:
             pulumi.set(__self__, "not_before_duration", not_before_duration)
         if organization_unit is not None:
@@ -210,8 +227,12 @@ class SecretBackendRoleArgs:
             pulumi.set(__self__, "provinces", provinces)
         if require_cn is not None:
             pulumi.set(__self__, "require_cn", require_cn)
+        if serial_number_source is not None:
+            pulumi.set(__self__, "serial_number_source", serial_number_source)
         if server_flag is not None:
             pulumi.set(__self__, "server_flag", server_flag)
+        if signature_bits is not None:
+            pulumi.set(__self__, "signature_bits", signature_bits)
         if street_addresses is not None:
             pulumi.set(__self__, "street_addresses", street_addresses)
         if ttl is not None:
@@ -220,310 +241,312 @@ class SecretBackendRoleArgs:
             pulumi.set(__self__, "use_csr_common_name", use_csr_common_name)
         if use_csr_sans is not None:
             pulumi.set(__self__, "use_csr_sans", use_csr_sans)
+        if use_pss is not None:
+            pulumi.set(__self__, "use_pss", use_pss)
     @property
     @pulumi.getter
-    def backend(self) -> pulumi.Input[str]:
+    def backend(self) -> pulumi.Input[builtins.str]:
         """
         The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
         """
         return pulumi.get(self, "backend")
     @backend.setter
-    def backend(self, value: pulumi.Input[str]):
+    def backend(self, value: pulumi.Input[builtins.str]):
         pulumi.set(self, "backend", value)
     @property
     @pulumi.getter(name="allowAnyName")
-    def allow_any_name(self) -> Optional[pulumi.Input[bool]]:
+    def allow_any_name(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow any name
         """
         return pulumi.get(self, "allow_any_name")
     @allow_any_name.setter
-    def allow_any_name(self, value: Optional[pulumi.Input[bool]]):
+    def allow_any_name(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_any_name", value)
     @property
     @pulumi.getter(name="allowBareDomains")
-    def allow_bare_domains(self) -> Optional[pulumi.Input[bool]]:
+    def allow_bare_domains(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow certificates matching the actual domain
         """
         return pulumi.get(self, "allow_bare_domains")
     @allow_bare_domains.setter
-    def allow_bare_domains(self, value: Optional[pulumi.Input[bool]]):
+    def allow_bare_domains(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_bare_domains", value)
     @property
     @pulumi.getter(name="allowGlobDomains")
-    def allow_glob_domains(self) -> Optional[pulumi.Input[bool]]:
+    def allow_glob_domains(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow names containing glob patterns.
         """
         return pulumi.get(self, "allow_glob_domains")
     @allow_glob_domains.setter
-    def allow_glob_domains(self, value: Optional[pulumi.Input[bool]]):
+    def allow_glob_domains(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_glob_domains", value)
     @property
     @pulumi.getter(name="allowIpSans")
-    def allow_ip_sans(self) -> Optional[pulumi.Input[bool]]:
+    def allow_ip_sans(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow IP SANs
         """
         return pulumi.get(self, "allow_ip_sans")
     @allow_ip_sans.setter
-    def allow_ip_sans(self, value: Optional[pulumi.Input[bool]]):
+    def allow_ip_sans(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_ip_sans", value)
     @property
     @pulumi.getter(name="allowLocalhost")
-    def allow_localhost(self) -> Optional[pulumi.Input[bool]]:
+    def allow_localhost(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow certificates for localhost
         """
         return pulumi.get(self, "allow_localhost")
     @allow_localhost.setter
-    def allow_localhost(self, value: Optional[pulumi.Input[bool]]):
+    def allow_localhost(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_localhost", value)
     @property
     @pulumi.getter(name="allowSubdomains")
-    def allow_subdomains(self) -> Optional[pulumi.Input[bool]]:
+    def allow_subdomains(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow certificates matching subdomains
         """
         return pulumi.get(self, "allow_subdomains")
     @allow_subdomains.setter
-    def allow_subdomains(self, value: Optional[pulumi.Input[bool]]):
+    def allow_subdomains(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_subdomains", value)
     @property
     @pulumi.getter(name="allowWildcardCertificates")
-    def allow_wildcard_certificates(self) -> Optional[pulumi.Input[bool]]:
+    def allow_wildcard_certificates(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow wildcard certificates.
         """
         return pulumi.get(self, "allow_wildcard_certificates")
     @allow_wildcard_certificates.setter
-    def allow_wildcard_certificates(self, value: Optional[pulumi.Input[bool]]):
+    def allow_wildcard_certificates(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_wildcard_certificates", value)
     @property
     @pulumi.getter(name="allowedDomains")
-    def allowed_domains(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_domains(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         List of allowed domains for certificates
         """
         return pulumi.get(self, "allowed_domains")
     @allowed_domains.setter
-    def allowed_domains(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_domains(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_domains", value)
     @property
     @pulumi.getter(name="allowedDomainsTemplate")
-    def allowed_domains_template(self) -> Optional[pulumi.Input[bool]]:
+    def allowed_domains_template(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
         """
         return pulumi.get(self, "allowed_domains_template")
     @allowed_domains_template.setter
-    def allowed_domains_template(self, value: Optional[pulumi.Input[bool]]):
+    def allowed_domains_template(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allowed_domains_template", value)
     @property
     @pulumi.getter(name="allowedOtherSans")
-    def allowed_other_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_other_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Defines allowed custom SANs
         """
         return pulumi.get(self, "allowed_other_sans")
     @allowed_other_sans.setter
-    def allowed_other_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_other_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_other_sans", value)
     @property
     @pulumi.getter(name="allowedSerialNumbers")
-    def allowed_serial_numbers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_serial_numbers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         An array of allowed serial numbers to put in Subject
         """
         return pulumi.get(self, "allowed_serial_numbers")
     @allowed_serial_numbers.setter
-    def allowed_serial_numbers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_serial_numbers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_serial_numbers", value)
     @property
     @pulumi.getter(name="allowedUriSans")
-    def allowed_uri_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_uri_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Defines allowed URI SANs
         """
         return pulumi.get(self, "allowed_uri_sans")
     @allowed_uri_sans.setter
-    def allowed_uri_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_uri_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_uri_sans", value)
     @property
     @pulumi.getter(name="allowedUriSansTemplate")
-    def allowed_uri_sans_template(self) -> Optional[pulumi.Input[bool]]:
+    def allowed_uri_sans_template(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
         """
         return pulumi.get(self, "allowed_uri_sans_template")
     @allowed_uri_sans_template.setter
-    def allowed_uri_sans_template(self, value: Optional[pulumi.Input[bool]]):
+    def allowed_uri_sans_template(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allowed_uri_sans_template", value)
     @property
     @pulumi.getter(name="allowedUserIds")
-    def allowed_user_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_user_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Defines allowed User IDs
         """
         return pulumi.get(self, "allowed_user_ids")
     @allowed_user_ids.setter
-    def allowed_user_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_user_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_user_ids", value)
     @property
     @pulumi.getter(name="basicConstraintsValidForNonCa")
-    def basic_constraints_valid_for_non_ca(self) -> Optional[pulumi.Input[bool]]:
+    def basic_constraints_valid_for_non_ca(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to mark basic constraints valid when issuing non-CA certificates
         """
         return pulumi.get(self, "basic_constraints_valid_for_non_ca")
     @basic_constraints_valid_for_non_ca.setter
-    def basic_constraints_valid_for_non_ca(self, value: Optional[pulumi.Input[bool]]):
+    def basic_constraints_valid_for_non_ca(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "basic_constraints_valid_for_non_ca", value)
     @property
     @pulumi.getter(name="clientFlag")
-    def client_flag(self) -> Optional[pulumi.Input[bool]]:
+    def client_flag(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to specify certificates for client use
         """
         return pulumi.get(self, "client_flag")
     @client_flag.setter
-    def client_flag(self, value: Optional[pulumi.Input[bool]]):
+    def client_flag(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "client_flag", value)
     @property
     @pulumi.getter(name="cnValidations")
-    def cn_validations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def cn_validations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
         """
         return pulumi.get(self, "cn_validations")
     @cn_validations.setter
-    def cn_validations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def cn_validations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "cn_validations", value)
     @property
     @pulumi.getter(name="codeSigningFlag")
-    def code_signing_flag(self) -> Optional[pulumi.Input[bool]]:
+    def code_signing_flag(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to specify certificates for code signing use
         """
         return pulumi.get(self, "code_signing_flag")
     @code_signing_flag.setter
-    def code_signing_flag(self, value: Optional[pulumi.Input[bool]]):
+    def code_signing_flag(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "code_signing_flag", value)
     @property
     @pulumi.getter
-    def countries(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def countries(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The country of generated certificates
         """
         return pulumi.get(self, "countries")
     @countries.setter
-    def countries(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def countries(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "countries", value)
     @property
     @pulumi.getter(name="emailProtectionFlag")
-    def email_protection_flag(self) -> Optional[pulumi.Input[bool]]:
+    def email_protection_flag(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to specify certificates for email protection use
         """
         return pulumi.get(self, "email_protection_flag")
     @email_protection_flag.setter
-    def email_protection_flag(self, value: Optional[pulumi.Input[bool]]):
+    def email_protection_flag(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "email_protection_flag", value)
     @property
     @pulumi.getter(name="enforceHostnames")
-    def enforce_hostnames(self) -> Optional[pulumi.Input[bool]]:
+    def enforce_hostnames(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow only valid host names
         """
         return pulumi.get(self, "enforce_hostnames")
     @enforce_hostnames.setter
-    def enforce_hostnames(self, value: Optional[pulumi.Input[bool]]):
+    def enforce_hostnames(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "enforce_hostnames", value)
     @property
     @pulumi.getter(name="extKeyUsageOids")
-    def ext_key_usage_oids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def ext_key_usage_oids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Specify the allowed extended key usage OIDs constraint on issued certificates
         """
         return pulumi.get(self, "ext_key_usage_oids")
     @ext_key_usage_oids.setter
-    def ext_key_usage_oids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def ext_key_usage_oids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "ext_key_usage_oids", value)
     @property
     @pulumi.getter(name="extKeyUsages")
-    def ext_key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def ext_key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Specify the allowed extended key usage constraint on issued certificates
         """
         return pulumi.get(self, "ext_key_usages")
     @ext_key_usages.setter
-    def ext_key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def ext_key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "ext_key_usages", value)
     @property
     @pulumi.getter(name="generateLease")
-    def generate_lease(self) -> Optional[pulumi.Input[bool]]:
+    def generate_lease(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to generate leases with certificates
         """
         return pulumi.get(self, "generate_lease")
     @generate_lease.setter
-    def generate_lease(self, value: Optional[pulumi.Input[bool]]):
+    def generate_lease(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "generate_lease", value)
     @property
     @pulumi.getter(name="issuerRef")
-    def issuer_ref(self) -> Optional[pulumi.Input[str]]:
+    def issuer_ref(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         Specifies the default issuer of this request. May
         be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
@@ -533,24 +556,24 @@ class SecretBackendRoleArgs:
         return pulumi.get(self, "issuer_ref")
     @issuer_ref.setter
-    def issuer_ref(self, value: Optional[pulumi.Input[str]]):
+    def issuer_ref(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "issuer_ref", value)
     @property
     @pulumi.getter(name="keyBits")
-    def key_bits(self) -> Optional[pulumi.Input[int]]:
+    def key_bits(self) -> Optional[pulumi.Input[builtins.int]]:
         """
         The number of bits of generated keys
         """
         return pulumi.get(self, "key_bits")
     @key_bits.setter
-    def key_bits(self, value: Optional[pulumi.Input[int]]):
+    def key_bits(self, value: Optional[pulumi.Input[builtins.int]]):
         pulumi.set(self, "key_bits", value)
     @property
     @pulumi.getter(name="keyType")
-    def key_type(self) -> Optional[pulumi.Input[str]]:
+    def key_type(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
         Defaults to `rsa`
@@ -558,12 +581,12 @@ class SecretBackendRoleArgs:
         return pulumi.get(self, "key_type")
     @key_type.setter
-    def key_type(self, value: Optional[pulumi.Input[str]]):
+    def key_type(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "key_type", value)
     @property
     @pulumi.getter(name="keyUsages")
-    def key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Specify the allowed key usage constraint on issued
         certificates. Defaults to `["DigitalSignature", "KeyAgreement", "KeyEncipherment"])`.
@@ -572,48 +595,48 @@ class SecretBackendRoleArgs:
         return pulumi.get(self, "key_usages")
     @key_usages.setter
-    def key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "key_usages", value)
     @property
     @pulumi.getter
-    def localities(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def localities(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The locality of generated certificates
         """
         return pulumi.get(self, "localities")
     @localities.setter
-    def localities(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def localities(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "localities", value)
     @property
     @pulumi.getter(name="maxTtl")
-    def max_ttl(self) -> Optional[pulumi.Input[str]]:
+    def max_ttl(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The maximum lease TTL, in seconds, for the role.
         """
         return pulumi.get(self, "max_ttl")
     @max_ttl.setter
-    def max_ttl(self, value: Optional[pulumi.Input[str]]):
+    def max_ttl(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "max_ttl", value)
     @property
     @pulumi.getter
-    def name(self) -> Optional[pulumi.Input[str]]:
+    def name(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The name to identify this role within the backend. Must be unique within the backend.
         """
         return pulumi.get(self, "name")
     @name.setter
-    def name(self, value: Optional[pulumi.Input[str]]):
+    def name(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "name", value)
     @property
     @pulumi.getter
-    def namespace(self) -> Optional[pulumi.Input[str]]:
+    def namespace(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The namespace to provision the resource in.
         The value should not contain leading or trailing forward slashes.
@@ -623,55 +646,79 @@ class SecretBackendRoleArgs:
         return pulumi.get(self, "namespace")
     @namespace.setter
-    def namespace(self, value: Optional[pulumi.Input[str]]):
+    def namespace(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "namespace", value)
     @property
     @pulumi.getter(name="noStore")
-    def no_store(self) -> Optional[pulumi.Input[bool]]:
+    def no_store(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to not store certificates in the storage backend
         """
         return pulumi.get(self, "no_store")
     @no_store.setter
-    def no_store(self, value: Optional[pulumi.Input[bool]]):
+    def no_store(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "no_store", value)
+    @property
+    @pulumi.getter(name="noStoreMetadata")
+    def no_store_metadata(self) -> Optional[pulumi.Input[builtins.bool]]:
+        """
+        Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs
+        """
+        return pulumi.get(self, "no_store_metadata")
+    @no_store_metadata.setter
+    def no_store_metadata(self, value: Optional[pulumi.Input[builtins.bool]]):
+        pulumi.set(self, "no_store_metadata", value)
+    @property
+    @pulumi.getter(name="notAfter")
+    def not_after(self) -> Optional[pulumi.Input[builtins.str]]:
+        """
+        Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
+        """
+        return pulumi.get(self, "not_after")
+    @not_after.setter
+    def not_after(self, value: Optional[pulumi.Input[builtins.str]]):
+        pulumi.set(self, "not_after", value)
     @property
     @pulumi.getter(name="notBeforeDuration")
-    def not_before_duration(self) -> Optional[pulumi.Input[str]]:
+    def not_before_duration(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         Specifies the duration by which to backdate the NotBefore property.
         """
         return pulumi.get(self, "not_before_duration")
     @not_before_duration.setter
-    def not_before_duration(self, value: Optional[pulumi.Input[str]]):
+    def not_before_duration(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "not_before_duration", value)
     @property
     @pulumi.getter(name="organizationUnit")
-    def organization_unit(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def organization_unit(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The organization unit of generated certificates
         """
         return pulumi.get(self, "organization_unit")
     @organization_unit.setter
-    def organization_unit(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def organization_unit(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "organization_unit", value)
     @property
     @pulumi.getter
-    def organizations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def organizations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The organization of generated certificates
         """
         return pulumi.get(self, "organizations")
     @organizations.setter
-    def organizations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def organizations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "organizations", value)
     @property
@@ -688,221 +735,271 @@ class SecretBackendRoleArgs:
     @property
     @pulumi.getter(name="policyIdentifiers")
-    def policy_identifiers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def policy_identifiers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
         """
         return pulumi.get(self, "policy_identifiers")
     @policy_identifiers.setter
-    def policy_identifiers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def policy_identifiers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "policy_identifiers", value)
     @property
     @pulumi.getter(name="postalCodes")
-    def postal_codes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def postal_codes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The postal code of generated certificates
         """
         return pulumi.get(self, "postal_codes")
     @postal_codes.setter
-    def postal_codes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def postal_codes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "postal_codes", value)
     @property
     @pulumi.getter
-    def provinces(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def provinces(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The province of generated certificates
         """
         return pulumi.get(self, "provinces")
     @provinces.setter
-    def provinces(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def provinces(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "provinces", value)
     @property
     @pulumi.getter(name="requireCn")
-    def require_cn(self) -> Optional[pulumi.Input[bool]]:
+    def require_cn(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to force CN usage
         """
         return pulumi.get(self, "require_cn")
     @require_cn.setter
-    def require_cn(self, value: Optional[pulumi.Input[bool]]):
+    def require_cn(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "require_cn", value)
+    @property
+    @pulumi.getter(name="serialNumberSource")
+    def serial_number_source(self) -> Optional[pulumi.Input[builtins.str]]:
+        """
+        Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the serial_number parameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the serial_number parameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.
+        Example usage:
+        """
+        return pulumi.get(self, "serial_number_source")
+    @serial_number_source.setter
+    def serial_number_source(self, value: Optional[pulumi.Input[builtins.str]]):
+        pulumi.set(self, "serial_number_source", value)
     @property
     @pulumi.getter(name="serverFlag")
-    def server_flag(self) -> Optional[pulumi.Input[bool]]:
+    def server_flag(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to specify certificates for server use
         """
         return pulumi.get(self, "server_flag")
     @server_flag.setter
-    def server_flag(self, value: Optional[pulumi.Input[bool]]):
+    def server_flag(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "server_flag", value)
+    @property
+    @pulumi.getter(name="signatureBits")
+    def signature_bits(self) -> Optional[pulumi.Input[builtins.int]]:
+        """
+        The number of bits to use in the signature algorithm
+        """
+        return pulumi.get(self, "signature_bits")
+    @signature_bits.setter
+    def signature_bits(self, value: Optional[pulumi.Input[builtins.int]]):
+        pulumi.set(self, "signature_bits", value)
     @property
     @pulumi.getter(name="streetAddresses")
-    def street_addresses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def street_addresses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The street address of generated certificates
         """
         return pulumi.get(self, "street_addresses")
     @street_addresses.setter
-    def street_addresses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def street_addresses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "street_addresses", value)
     @property
     @pulumi.getter
-    def ttl(self) -> Optional[pulumi.Input[str]]:
+    def ttl(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The TTL, in seconds, for any certificate issued against this role.
         """
         return pulumi.get(self, "ttl")
     @ttl.setter
-    def ttl(self, value: Optional[pulumi.Input[str]]):
+    def ttl(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "ttl", value)
     @property
     @pulumi.getter(name="useCsrCommonName")
-    def use_csr_common_name(self) -> Optional[pulumi.Input[bool]]:
+    def use_csr_common_name(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to use the CN in the CSR
         """
         return pulumi.get(self, "use_csr_common_name")
     @use_csr_common_name.setter
-    def use_csr_common_name(self, value: Optional[pulumi.Input[bool]]):
+    def use_csr_common_name(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "use_csr_common_name", value)
     @property
     @pulumi.getter(name="useCsrSans")
-    def use_csr_sans(self) -> Optional[pulumi.Input[bool]]:
+    def use_csr_sans(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to use the SANs in the CSR
         """
         return pulumi.get(self, "use_csr_sans")
     @use_csr_sans.setter
-    def use_csr_sans(self, value: Optional[pulumi.Input[bool]]):
+    def use_csr_sans(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "use_csr_sans", value)
+    @property
+    @pulumi.getter(name="usePss")
+    def use_pss(self) -> Optional[pulumi.Input[builtins.bool]]:
+        """
+        Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
+        """
+        return pulumi.get(self, "use_pss")
+    @use_pss.setter
+    def use_pss(self, value: Optional[pulumi.Input[builtins.bool]]):
+        pulumi.set(self, "use_pss", value)
 @pulumi.input_type
 class _SecretBackendRoleState:
     def __init__(__self__, *,
-                 allow_any_name: Optional[pulumi.Input[bool]] = None,
-                 allow_bare_domains: Optional[pulumi.Input[bool]] = None,
-                 allow_glob_domains: Optional[pulumi.Input[bool]] = None,
-                 allow_ip_sans: Optional[pulumi.Input[bool]] = None,
-                 allow_localhost: Optional[pulumi.Input[bool]] = None,
-                 allow_subdomains: Optional[pulumi.Input[bool]] = None,
-                 allow_wildcard_certificates: Optional[pulumi.Input[bool]] = None,
-                 allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_domains_template: Optional[pulumi.Input[bool]] = None,
-                 allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_uri_sans_template: Optional[pulumi.Input[bool]] = None,
-                 allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 backend: Optional[pulumi.Input[str]] = None,
-                 basic_constraints_valid_for_non_ca: Optional[pulumi.Input[bool]] = None,
-                 client_flag: Optional[pulumi.Input[bool]] = None,
-                 cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 code_signing_flag: Optional[pulumi.Input[bool]] = None,
-                 countries: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 email_protection_flag: Optional[pulumi.Input[bool]] = None,
-                 enforce_hostnames: Optional[pulumi.Input[bool]] = None,
-                 ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 generate_lease: Optional[pulumi.Input[bool]] = None,
-                 issuer_ref: Optional[pulumi.Input[str]] = None,
-                 key_bits: Optional[pulumi.Input[int]] = None,
-                 key_type: Optional[pulumi.Input[str]] = None,
-                 key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 localities: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 max_ttl: Optional[pulumi.Input[str]] = None,
-                 name: Optional[pulumi.Input[str]] = None,
-                 namespace: Optional[pulumi.Input[str]] = None,
-                 no_store: Optional[pulumi.Input[bool]] = None,
-                 not_before_duration: Optional[pulumi.Input[str]] = None,
-                 organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 organizations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
+                 allow_any_name: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_bare_domains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_glob_domains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_ip_sans: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_localhost: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_subdomains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_wildcard_certificates: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_domains_template: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_uri_sans_template: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 backend: Optional[pulumi.Input[builtins.str]] = None,
+                 basic_constraints_valid_for_non_ca: Optional[pulumi.Input[builtins.bool]] = None,
+                 client_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 code_signing_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 countries: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 email_protection_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 enforce_hostnames: Optional[pulumi.Input[builtins.bool]] = None,
+                 ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 generate_lease: Optional[pulumi.Input[builtins.bool]] = None,
+                 issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
+                 key_bits: Optional[pulumi.Input[builtins.int]] = None,
+                 key_type: Optional[pulumi.Input[builtins.str]] = None,
+                 key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 localities: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 max_ttl: Optional[pulumi.Input[builtins.str]] = None,
+                 name: Optional[pulumi.Input[builtins.str]] = None,
+                 namespace: Optional[pulumi.Input[builtins.str]] = None,
+                 no_store: Optional[pulumi.Input[builtins.bool]] = None,
+                 no_store_metadata: Optional[pulumi.Input[builtins.bool]] = None,
+                 not_after: Optional[pulumi.Input[builtins.str]] = None,
+                 not_before_duration: Optional[pulumi.Input[builtins.str]] = None,
+                 organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 organizations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
                  policy_identifier: Optional[pulumi.Input[Sequence[pulumi.Input['SecretBackendRolePolicyIdentifierArgs']]]] = None,
-                 policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 provinces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 require_cn: Optional[pulumi.Input[bool]] = None,
-                 server_flag: Optional[pulumi.Input[bool]] = None,
-                 street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 ttl: Optional[pulumi.Input[str]] = None,
-                 use_csr_common_name: Optional[pulumi.Input[bool]] = None,
-                 use_csr_sans: Optional[pulumi.Input[bool]] = None):
+                 policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 provinces: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 require_cn: Optional[pulumi.Input[builtins.bool]] = None,
+                 serial_number_source: Optional[pulumi.Input[builtins.str]] = None,
+                 server_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 signature_bits: Optional[pulumi.Input[builtins.int]] = None,
+                 street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 ttl: Optional[pulumi.Input[builtins.str]] = None,
+                 use_csr_common_name: Optional[pulumi.Input[builtins.bool]] = None,
+                 use_csr_sans: Optional[pulumi.Input[builtins.bool]] = None,
+                 use_pss: Optional[pulumi.Input[builtins.bool]] = None):
         """
         Input properties used for looking up and filtering SecretBackendRole resources.
-        :param pulumi.Input[bool] allow_any_name: Flag to allow any name
-        :param pulumi.Input[bool] allow_bare_domains: Flag to allow certificates matching the actual domain
-        :param pulumi.Input[bool] allow_glob_domains: Flag to allow names containing glob patterns.
-        :param pulumi.Input[bool] allow_ip_sans: Flag to allow IP SANs
-        :param pulumi.Input[bool] allow_localhost: Flag to allow certificates for localhost
-        :param pulumi.Input[bool] allow_subdomains: Flag to allow certificates matching subdomains
-        :param pulumi.Input[bool] allow_wildcard_certificates: Flag to allow wildcard certificates.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_domains: List of allowed domains for certificates
-        :param pulumi.Input[bool] allowed_domains_template: Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_other_sans: Defines allowed custom SANs
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_serial_numbers: An array of allowed serial numbers to put in Subject
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_uri_sans: Defines allowed URI SANs
-        :param pulumi.Input[bool] allowed_uri_sans_template: Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_user_ids: Defines allowed User IDs
-        :param pulumi.Input[str] backend: The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
-        :param pulumi.Input[bool] basic_constraints_valid_for_non_ca: Flag to mark basic constraints valid when issuing non-CA certificates
-        :param pulumi.Input[bool] client_flag: Flag to specify certificates for client use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] cn_validations: Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
-        :param pulumi.Input[bool] code_signing_flag: Flag to specify certificates for code signing use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] countries: The country of generated certificates
-        :param pulumi.Input[bool] email_protection_flag: Flag to specify certificates for email protection use
-        :param pulumi.Input[bool] enforce_hostnames: Flag to allow only valid host names
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] ext_key_usage_oids: Specify the allowed extended key usage OIDs constraint on issued certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] ext_key_usages: Specify the allowed extended key usage constraint on issued certificates
-        :param pulumi.Input[bool] generate_lease: Flag to generate leases with certificates
-        :param pulumi.Input[str] issuer_ref: Specifies the default issuer of this request. May
+        :param pulumi.Input[builtins.bool] allow_any_name: Flag to allow any name
+        :param pulumi.Input[builtins.bool] allow_bare_domains: Flag to allow certificates matching the actual domain
+        :param pulumi.Input[builtins.bool] allow_glob_domains: Flag to allow names containing glob patterns.
+        :param pulumi.Input[builtins.bool] allow_ip_sans: Flag to allow IP SANs
+        :param pulumi.Input[builtins.bool] allow_localhost: Flag to allow certificates for localhost
+        :param pulumi.Input[builtins.bool] allow_subdomains: Flag to allow certificates matching subdomains
+        :param pulumi.Input[builtins.bool] allow_wildcard_certificates: Flag to allow wildcard certificates.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_domains: List of allowed domains for certificates
+        :param pulumi.Input[builtins.bool] allowed_domains_template: Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_other_sans: Defines allowed custom SANs
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_serial_numbers: An array of allowed serial numbers to put in Subject
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_uri_sans: Defines allowed URI SANs
+        :param pulumi.Input[builtins.bool] allowed_uri_sans_template: Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_user_ids: Defines allowed User IDs
+        :param pulumi.Input[builtins.str] backend: The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
+        :param pulumi.Input[builtins.bool] basic_constraints_valid_for_non_ca: Flag to mark basic constraints valid when issuing non-CA certificates
+        :param pulumi.Input[builtins.bool] client_flag: Flag to specify certificates for client use
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] cn_validations: Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
+        :param pulumi.Input[builtins.bool] code_signing_flag: Flag to specify certificates for code signing use
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] countries: The country of generated certificates
+        :param pulumi.Input[builtins.bool] email_protection_flag: Flag to specify certificates for email protection use
+        :param pulumi.Input[builtins.bool] enforce_hostnames: Flag to allow only valid host names
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] ext_key_usage_oids: Specify the allowed extended key usage OIDs constraint on issued certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] ext_key_usages: Specify the allowed extended key usage constraint on issued certificates
+        :param pulumi.Input[builtins.bool] generate_lease: Flag to generate leases with certificates
+        :param pulumi.Input[builtins.str] issuer_ref: Specifies the default issuer of this request. May
                be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
                the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users
                overriding the role's `issuer_ref` value.
-        :param pulumi.Input[int] key_bits: The number of bits of generated keys
-        :param pulumi.Input[str] key_type: The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
+        :param pulumi.Input[builtins.int] key_bits: The number of bits of generated keys
+        :param pulumi.Input[builtins.str] key_type: The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
                Defaults to `rsa`
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] key_usages: Specify the allowed key usage constraint on issued
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] key_usages: Specify the allowed key usage constraint on issued
                certificates. Defaults to `["DigitalSignature", "KeyAgreement", "KeyEncipherment"])`.
                To specify no default key usage constraints, set this to an empty list `[]`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] localities: The locality of generated certificates
-        :param pulumi.Input[str] max_ttl: The maximum lease TTL, in seconds, for the role.
-        :param pulumi.Input[str] name: The name to identify this role within the backend. Must be unique within the backend.
-        :param pulumi.Input[str] namespace: The namespace to provision the resource in.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] localities: The locality of generated certificates
+        :param pulumi.Input[builtins.str] max_ttl: The maximum lease TTL, in seconds, for the role.
+        :param pulumi.Input[builtins.str] name: The name to identify this role within the backend. Must be unique within the backend.
+        :param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[bool] no_store: Flag to not store certificates in the storage backend
-        :param pulumi.Input[str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] organization_unit: The organization unit of generated certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] organizations: The organization of generated certificates
+        :param pulumi.Input[builtins.bool] no_store: Flag to not store certificates in the storage backend
+        :param pulumi.Input[builtins.bool] no_store_metadata: Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs
+        :param pulumi.Input[builtins.str] not_after: Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
+        :param pulumi.Input[builtins.str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] organization_unit: The organization unit of generated certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] organizations: The organization of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input['SecretBackendRolePolicyIdentifierArgs']]] policy_identifier: (Vault 1.11+ only) A block for specifying policy identifers. The `policy_identifier` block can be repeated, and supports the following arguments:
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] postal_codes: The postal code of generated certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] provinces: The province of generated certificates
-        :param pulumi.Input[bool] require_cn: Flag to force CN usage
-        :param pulumi.Input[bool] server_flag: Flag to specify certificates for server use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] street_addresses: The street address of generated certificates
-        :param pulumi.Input[str] ttl: The TTL, in seconds, for any certificate issued against this role.
-        :param pulumi.Input[bool] use_csr_common_name: Flag to use the CN in the CSR
-        :param pulumi.Input[bool] use_csr_sans: Flag to use the SANs in the CSR
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] postal_codes: The postal code of generated certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] provinces: The province of generated certificates
+        :param pulumi.Input[builtins.bool] require_cn: Flag to force CN usage
+        :param pulumi.Input[builtins.str] serial_number_source: Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the serial_number parameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the serial_number parameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.
+               Example usage:
+        :param pulumi.Input[builtins.bool] server_flag: Flag to specify certificates for server use
+        :param pulumi.Input[builtins.int] signature_bits: The number of bits to use in the signature algorithm
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] street_addresses: The street address of generated certificates
+        :param pulumi.Input[builtins.str] ttl: The TTL, in seconds, for any certificate issued against this role.
+        :param pulumi.Input[builtins.bool] use_csr_common_name: Flag to use the CN in the CSR
+        :param pulumi.Input[builtins.bool] use_csr_sans: Flag to use the SANs in the CSR
+        :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
         """
         if allow_any_name is not None:
             pulumi.set(__self__, "allow_any_name", allow_any_name)
@@ -972,6 +1069,10 @@ class _SecretBackendRoleState:
             pulumi.set(__self__, "namespace", namespace)
         if no_store is not None:
             pulumi.set(__self__, "no_store", no_store)
+        if no_store_metadata is not None:
+            pulumi.set(__self__, "no_store_metadata", no_store_metadata)
+        if not_after is not None:
+            pulumi.set(__self__, "not_after", not_after)
         if not_before_duration is not None:
             pulumi.set(__self__, "not_before_duration", not_before_duration)
         if organization_unit is not None:
@@ -988,8 +1089,12 @@ class _SecretBackendRoleState:
             pulumi.set(__self__, "provinces", provinces)
         if require_cn is not None:
             pulumi.set(__self__, "require_cn", require_cn)
+        if serial_number_source is not None:
+            pulumi.set(__self__, "serial_number_source", serial_number_source)
         if server_flag is not None:
             pulumi.set(__self__, "server_flag", server_flag)
+        if signature_bits is not None:
+            pulumi.set(__self__, "signature_bits", signature_bits)
         if street_addresses is not None:
             pulumi.set(__self__, "street_addresses", street_addresses)
         if ttl is not None:
@@ -998,310 +1103,312 @@ class _SecretBackendRoleState:
             pulumi.set(__self__, "use_csr_common_name", use_csr_common_name)
         if use_csr_sans is not None:
             pulumi.set(__self__, "use_csr_sans", use_csr_sans)
+        if use_pss is not None:
+            pulumi.set(__self__, "use_pss", use_pss)
     @property
     @pulumi.getter(name="allowAnyName")
-    def allow_any_name(self) -> Optional[pulumi.Input[bool]]:
+    def allow_any_name(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow any name
         """
         return pulumi.get(self, "allow_any_name")
     @allow_any_name.setter
-    def allow_any_name(self, value: Optional[pulumi.Input[bool]]):
+    def allow_any_name(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_any_name", value)
     @property
     @pulumi.getter(name="allowBareDomains")
-    def allow_bare_domains(self) -> Optional[pulumi.Input[bool]]:
+    def allow_bare_domains(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow certificates matching the actual domain
         """
         return pulumi.get(self, "allow_bare_domains")
     @allow_bare_domains.setter
-    def allow_bare_domains(self, value: Optional[pulumi.Input[bool]]):
+    def allow_bare_domains(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_bare_domains", value)
     @property
     @pulumi.getter(name="allowGlobDomains")
-    def allow_glob_domains(self) -> Optional[pulumi.Input[bool]]:
+    def allow_glob_domains(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow names containing glob patterns.
         """
         return pulumi.get(self, "allow_glob_domains")
     @allow_glob_domains.setter
-    def allow_glob_domains(self, value: Optional[pulumi.Input[bool]]):
+    def allow_glob_domains(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_glob_domains", value)
     @property
     @pulumi.getter(name="allowIpSans")
-    def allow_ip_sans(self) -> Optional[pulumi.Input[bool]]:
+    def allow_ip_sans(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow IP SANs
         """
         return pulumi.get(self, "allow_ip_sans")
     @allow_ip_sans.setter
-    def allow_ip_sans(self, value: Optional[pulumi.Input[bool]]):
+    def allow_ip_sans(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_ip_sans", value)
     @property
     @pulumi.getter(name="allowLocalhost")
-    def allow_localhost(self) -> Optional[pulumi.Input[bool]]:
+    def allow_localhost(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow certificates for localhost
         """
         return pulumi.get(self, "allow_localhost")
     @allow_localhost.setter
-    def allow_localhost(self, value: Optional[pulumi.Input[bool]]):
+    def allow_localhost(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_localhost", value)
     @property
     @pulumi.getter(name="allowSubdomains")
-    def allow_subdomains(self) -> Optional[pulumi.Input[bool]]:
+    def allow_subdomains(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow certificates matching subdomains
         """
         return pulumi.get(self, "allow_subdomains")
     @allow_subdomains.setter
-    def allow_subdomains(self, value: Optional[pulumi.Input[bool]]):
+    def allow_subdomains(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_subdomains", value)
     @property
     @pulumi.getter(name="allowWildcardCertificates")
-    def allow_wildcard_certificates(self) -> Optional[pulumi.Input[bool]]:
+    def allow_wildcard_certificates(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow wildcard certificates.
         """
         return pulumi.get(self, "allow_wildcard_certificates")
     @allow_wildcard_certificates.setter
-    def allow_wildcard_certificates(self, value: Optional[pulumi.Input[bool]]):
+    def allow_wildcard_certificates(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allow_wildcard_certificates", value)
     @property
     @pulumi.getter(name="allowedDomains")
-    def allowed_domains(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_domains(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         List of allowed domains for certificates
         """
         return pulumi.get(self, "allowed_domains")
     @allowed_domains.setter
-    def allowed_domains(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_domains(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_domains", value)
     @property
     @pulumi.getter(name="allowedDomainsTemplate")
-    def allowed_domains_template(self) -> Optional[pulumi.Input[bool]]:
+    def allowed_domains_template(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
         """
         return pulumi.get(self, "allowed_domains_template")
     @allowed_domains_template.setter
-    def allowed_domains_template(self, value: Optional[pulumi.Input[bool]]):
+    def allowed_domains_template(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allowed_domains_template", value)
     @property
     @pulumi.getter(name="allowedOtherSans")
-    def allowed_other_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_other_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Defines allowed custom SANs
         """
         return pulumi.get(self, "allowed_other_sans")
     @allowed_other_sans.setter
-    def allowed_other_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_other_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_other_sans", value)
     @property
     @pulumi.getter(name="allowedSerialNumbers")
-    def allowed_serial_numbers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_serial_numbers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         An array of allowed serial numbers to put in Subject
         """
         return pulumi.get(self, "allowed_serial_numbers")
     @allowed_serial_numbers.setter
-    def allowed_serial_numbers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_serial_numbers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_serial_numbers", value)
     @property
     @pulumi.getter(name="allowedUriSans")
-    def allowed_uri_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_uri_sans(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Defines allowed URI SANs
         """
         return pulumi.get(self, "allowed_uri_sans")
     @allowed_uri_sans.setter
-    def allowed_uri_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_uri_sans(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_uri_sans", value)
     @property
     @pulumi.getter(name="allowedUriSansTemplate")
-    def allowed_uri_sans_template(self) -> Optional[pulumi.Input[bool]]:
+    def allowed_uri_sans_template(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
         """
         return pulumi.get(self, "allowed_uri_sans_template")
     @allowed_uri_sans_template.setter
-    def allowed_uri_sans_template(self, value: Optional[pulumi.Input[bool]]):
+    def allowed_uri_sans_template(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "allowed_uri_sans_template", value)
     @property
     @pulumi.getter(name="allowedUserIds")
-    def allowed_user_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def allowed_user_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Defines allowed User IDs
         """
         return pulumi.get(self, "allowed_user_ids")
     @allowed_user_ids.setter
-    def allowed_user_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def allowed_user_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "allowed_user_ids", value)
     @property
     @pulumi.getter
-    def backend(self) -> Optional[pulumi.Input[str]]:
+    def backend(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
         """
         return pulumi.get(self, "backend")
     @backend.setter
-    def backend(self, value: Optional[pulumi.Input[str]]):
+    def backend(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "backend", value)
     @property
     @pulumi.getter(name="basicConstraintsValidForNonCa")
-    def basic_constraints_valid_for_non_ca(self) -> Optional[pulumi.Input[bool]]:
+    def basic_constraints_valid_for_non_ca(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to mark basic constraints valid when issuing non-CA certificates
         """
         return pulumi.get(self, "basic_constraints_valid_for_non_ca")
     @basic_constraints_valid_for_non_ca.setter
-    def basic_constraints_valid_for_non_ca(self, value: Optional[pulumi.Input[bool]]):
+    def basic_constraints_valid_for_non_ca(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "basic_constraints_valid_for_non_ca", value)
     @property
     @pulumi.getter(name="clientFlag")
-    def client_flag(self) -> Optional[pulumi.Input[bool]]:
+    def client_flag(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to specify certificates for client use
         """
         return pulumi.get(self, "client_flag")
     @client_flag.setter
-    def client_flag(self, value: Optional[pulumi.Input[bool]]):
+    def client_flag(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "client_flag", value)
     @property
     @pulumi.getter(name="cnValidations")
-    def cn_validations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def cn_validations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
         """
         return pulumi.get(self, "cn_validations")
     @cn_validations.setter
-    def cn_validations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def cn_validations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "cn_validations", value)
     @property
     @pulumi.getter(name="codeSigningFlag")
-    def code_signing_flag(self) -> Optional[pulumi.Input[bool]]:
+    def code_signing_flag(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to specify certificates for code signing use
         """
         return pulumi.get(self, "code_signing_flag")
     @code_signing_flag.setter
-    def code_signing_flag(self, value: Optional[pulumi.Input[bool]]):
+    def code_signing_flag(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "code_signing_flag", value)
     @property
     @pulumi.getter
-    def countries(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def countries(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The country of generated certificates
         """
         return pulumi.get(self, "countries")
     @countries.setter
-    def countries(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def countries(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "countries", value)
     @property
     @pulumi.getter(name="emailProtectionFlag")
-    def email_protection_flag(self) -> Optional[pulumi.Input[bool]]:
+    def email_protection_flag(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to specify certificates for email protection use
         """
         return pulumi.get(self, "email_protection_flag")
     @email_protection_flag.setter
-    def email_protection_flag(self, value: Optional[pulumi.Input[bool]]):
+    def email_protection_flag(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "email_protection_flag", value)
     @property
     @pulumi.getter(name="enforceHostnames")
-    def enforce_hostnames(self) -> Optional[pulumi.Input[bool]]:
+    def enforce_hostnames(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to allow only valid host names
         """
         return pulumi.get(self, "enforce_hostnames")
     @enforce_hostnames.setter
-    def enforce_hostnames(self, value: Optional[pulumi.Input[bool]]):
+    def enforce_hostnames(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "enforce_hostnames", value)
     @property
     @pulumi.getter(name="extKeyUsageOids")
-    def ext_key_usage_oids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def ext_key_usage_oids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Specify the allowed extended key usage OIDs constraint on issued certificates
         """
         return pulumi.get(self, "ext_key_usage_oids")
     @ext_key_usage_oids.setter
-    def ext_key_usage_oids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def ext_key_usage_oids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "ext_key_usage_oids", value)
     @property
     @pulumi.getter(name="extKeyUsages")
-    def ext_key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def ext_key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Specify the allowed extended key usage constraint on issued certificates
         """
         return pulumi.get(self, "ext_key_usages")
     @ext_key_usages.setter
-    def ext_key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def ext_key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "ext_key_usages", value)
     @property
     @pulumi.getter(name="generateLease")
-    def generate_lease(self) -> Optional[pulumi.Input[bool]]:
+    def generate_lease(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to generate leases with certificates
         """
         return pulumi.get(self, "generate_lease")
     @generate_lease.setter
-    def generate_lease(self, value: Optional[pulumi.Input[bool]]):
+    def generate_lease(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "generate_lease", value)
     @property
     @pulumi.getter(name="issuerRef")
-    def issuer_ref(self) -> Optional[pulumi.Input[str]]:
+    def issuer_ref(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         Specifies the default issuer of this request. May
         be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
@@ -1311,24 +1418,24 @@ class _SecretBackendRoleState:
         return pulumi.get(self, "issuer_ref")
     @issuer_ref.setter
-    def issuer_ref(self, value: Optional[pulumi.Input[str]]):
+    def issuer_ref(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "issuer_ref", value)
     @property
     @pulumi.getter(name="keyBits")
-    def key_bits(self) -> Optional[pulumi.Input[int]]:
+    def key_bits(self) -> Optional[pulumi.Input[builtins.int]]:
         """
         The number of bits of generated keys
         """
         return pulumi.get(self, "key_bits")
     @key_bits.setter
-    def key_bits(self, value: Optional[pulumi.Input[int]]):
+    def key_bits(self, value: Optional[pulumi.Input[builtins.int]]):
         pulumi.set(self, "key_bits", value)
     @property
     @pulumi.getter(name="keyType")
-    def key_type(self) -> Optional[pulumi.Input[str]]:
+    def key_type(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
         Defaults to `rsa`
@@ -1336,12 +1443,12 @@ class _SecretBackendRoleState:
         return pulumi.get(self, "key_type")
     @key_type.setter
-    def key_type(self, value: Optional[pulumi.Input[str]]):
+    def key_type(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "key_type", value)
     @property
     @pulumi.getter(name="keyUsages")
-    def key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Specify the allowed key usage constraint on issued
         certificates. Defaults to `["DigitalSignature", "KeyAgreement", "KeyEncipherment"])`.
@@ -1350,48 +1457,48 @@ class _SecretBackendRoleState:
         return pulumi.get(self, "key_usages")
     @key_usages.setter
-    def key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "key_usages", value)
     @property
     @pulumi.getter
-    def localities(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def localities(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The locality of generated certificates
         """
         return pulumi.get(self, "localities")
     @localities.setter
-    def localities(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def localities(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "localities", value)
     @property
     @pulumi.getter(name="maxTtl")
-    def max_ttl(self) -> Optional[pulumi.Input[str]]:
+    def max_ttl(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The maximum lease TTL, in seconds, for the role.
         """
         return pulumi.get(self, "max_ttl")
     @max_ttl.setter
-    def max_ttl(self, value: Optional[pulumi.Input[str]]):
+    def max_ttl(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "max_ttl", value)
     @property
     @pulumi.getter
-    def name(self) -> Optional[pulumi.Input[str]]:
+    def name(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The name to identify this role within the backend. Must be unique within the backend.
         """
         return pulumi.get(self, "name")
     @name.setter
-    def name(self, value: Optional[pulumi.Input[str]]):
+    def name(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "name", value)
     @property
     @pulumi.getter
-    def namespace(self) -> Optional[pulumi.Input[str]]:
+    def namespace(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The namespace to provision the resource in.
         The value should not contain leading or trailing forward slashes.
@@ -1401,55 +1508,79 @@ class _SecretBackendRoleState:
         return pulumi.get(self, "namespace")
     @namespace.setter
-    def namespace(self, value: Optional[pulumi.Input[str]]):
+    def namespace(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "namespace", value)
     @property
     @pulumi.getter(name="noStore")
-    def no_store(self) -> Optional[pulumi.Input[bool]]:
+    def no_store(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to not store certificates in the storage backend
         """
         return pulumi.get(self, "no_store")
     @no_store.setter
-    def no_store(self, value: Optional[pulumi.Input[bool]]):
+    def no_store(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "no_store", value)
+    @property
+    @pulumi.getter(name="noStoreMetadata")
+    def no_store_metadata(self) -> Optional[pulumi.Input[builtins.bool]]:
+        """
+        Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs
+        """
+        return pulumi.get(self, "no_store_metadata")
+    @no_store_metadata.setter
+    def no_store_metadata(self, value: Optional[pulumi.Input[builtins.bool]]):
+        pulumi.set(self, "no_store_metadata", value)
+    @property
+    @pulumi.getter(name="notAfter")
+    def not_after(self) -> Optional[pulumi.Input[builtins.str]]:
+        """
+        Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
+        """
+        return pulumi.get(self, "not_after")
+    @not_after.setter
+    def not_after(self, value: Optional[pulumi.Input[builtins.str]]):
+        pulumi.set(self, "not_after", value)
     @property
     @pulumi.getter(name="notBeforeDuration")
-    def not_before_duration(self) -> Optional[pulumi.Input[str]]:
+    def not_before_duration(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         Specifies the duration by which to backdate the NotBefore property.
         """
         return pulumi.get(self, "not_before_duration")
     @not_before_duration.setter
-    def not_before_duration(self, value: Optional[pulumi.Input[str]]):
+    def not_before_duration(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "not_before_duration", value)
     @property
     @pulumi.getter(name="organizationUnit")
-    def organization_unit(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def organization_unit(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The organization unit of generated certificates
         """
         return pulumi.get(self, "organization_unit")
     @organization_unit.setter
-    def organization_unit(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def organization_unit(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "organization_unit", value)
     @property
     @pulumi.getter
-    def organizations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def organizations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The organization of generated certificates
         """
         return pulumi.get(self, "organizations")
     @organizations.setter
-    def organizations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def organizations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "organizations", value)
     @property
@@ -1466,165 +1597,208 @@ class _SecretBackendRoleState:
     @property
     @pulumi.getter(name="policyIdentifiers")
-    def policy_identifiers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def policy_identifiers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
         """
         return pulumi.get(self, "policy_identifiers")
     @policy_identifiers.setter
-    def policy_identifiers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def policy_identifiers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "policy_identifiers", value)
     @property
     @pulumi.getter(name="postalCodes")
-    def postal_codes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def postal_codes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The postal code of generated certificates
         """
         return pulumi.get(self, "postal_codes")
     @postal_codes.setter
-    def postal_codes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def postal_codes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "postal_codes", value)
     @property
     @pulumi.getter
-    def provinces(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def provinces(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The province of generated certificates
         """
         return pulumi.get(self, "provinces")
     @provinces.setter
-    def provinces(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def provinces(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "provinces", value)
     @property
     @pulumi.getter(name="requireCn")
-    def require_cn(self) -> Optional[pulumi.Input[bool]]:
+    def require_cn(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to force CN usage
         """
         return pulumi.get(self, "require_cn")
     @require_cn.setter
-    def require_cn(self, value: Optional[pulumi.Input[bool]]):
+    def require_cn(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "require_cn", value)
+    @property
+    @pulumi.getter(name="serialNumberSource")
+    def serial_number_source(self) -> Optional[pulumi.Input[builtins.str]]:
+        """
+        Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the serial_number parameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the serial_number parameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.
+        Example usage:
+        """
+        return pulumi.get(self, "serial_number_source")
+    @serial_number_source.setter
+    def serial_number_source(self, value: Optional[pulumi.Input[builtins.str]]):
+        pulumi.set(self, "serial_number_source", value)
     @property
     @pulumi.getter(name="serverFlag")
-    def server_flag(self) -> Optional[pulumi.Input[bool]]:
+    def server_flag(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to specify certificates for server use
         """
         return pulumi.get(self, "server_flag")
     @server_flag.setter
-    def server_flag(self, value: Optional[pulumi.Input[bool]]):
+    def server_flag(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "server_flag", value)
+    @property
+    @pulumi.getter(name="signatureBits")
+    def signature_bits(self) -> Optional[pulumi.Input[builtins.int]]:
+        """
+        The number of bits to use in the signature algorithm
+        """
+        return pulumi.get(self, "signature_bits")
+    @signature_bits.setter
+    def signature_bits(self, value: Optional[pulumi.Input[builtins.int]]):
+        pulumi.set(self, "signature_bits", value)
     @property
     @pulumi.getter(name="streetAddresses")
-    def street_addresses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
+    def street_addresses(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
         """
         The street address of generated certificates
         """
         return pulumi.get(self, "street_addresses")
     @street_addresses.setter
-    def street_addresses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
+    def street_addresses(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
         pulumi.set(self, "street_addresses", value)
     @property
     @pulumi.getter
-    def ttl(self) -> Optional[pulumi.Input[str]]:
+    def ttl(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The TTL, in seconds, for any certificate issued against this role.
         """
         return pulumi.get(self, "ttl")
     @ttl.setter
-    def ttl(self, value: Optional[pulumi.Input[str]]):
+    def ttl(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "ttl", value)
     @property
     @pulumi.getter(name="useCsrCommonName")
-    def use_csr_common_name(self) -> Optional[pulumi.Input[bool]]:
+    def use_csr_common_name(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to use the CN in the CSR
         """
         return pulumi.get(self, "use_csr_common_name")
     @use_csr_common_name.setter
-    def use_csr_common_name(self, value: Optional[pulumi.Input[bool]]):
+    def use_csr_common_name(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "use_csr_common_name", value)
     @property
     @pulumi.getter(name="useCsrSans")
-    def use_csr_sans(self) -> Optional[pulumi.Input[bool]]:
+    def use_csr_sans(self) -> Optional[pulumi.Input[builtins.bool]]:
         """
         Flag to use the SANs in the CSR
         """
         return pulumi.get(self, "use_csr_sans")
     @use_csr_sans.setter
-    def use_csr_sans(self, value: Optional[pulumi.Input[bool]]):
+    def use_csr_sans(self, value: Optional[pulumi.Input[builtins.bool]]):
         pulumi.set(self, "use_csr_sans", value)
+    @property
+    @pulumi.getter(name="usePss")
+    def use_pss(self) -> Optional[pulumi.Input[builtins.bool]]:
+        """
+        Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
+        """
+        return pulumi.get(self, "use_pss")
+    @use_pss.setter
+    def use_pss(self, value: Optional[pulumi.Input[builtins.bool]]):
+        pulumi.set(self, "use_pss", value)
 class SecretBackendRole(pulumi.CustomResource):
     @overload
     def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
-                 allow_any_name: Optional[pulumi.Input[bool]] = None,
-                 allow_bare_domains: Optional[pulumi.Input[bool]] = None,
-                 allow_glob_domains: Optional[pulumi.Input[bool]] = None,
-                 allow_ip_sans: Optional[pulumi.Input[bool]] = None,
-                 allow_localhost: Optional[pulumi.Input[bool]] = None,
-                 allow_subdomains: Optional[pulumi.Input[bool]] = None,
-                 allow_wildcard_certificates: Optional[pulumi.Input[bool]] = None,
-                 allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_domains_template: Optional[pulumi.Input[bool]] = None,
-                 allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_uri_sans_template: Optional[pulumi.Input[bool]] = None,
-                 allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 backend: Optional[pulumi.Input[str]] = None,
-                 basic_constraints_valid_for_non_ca: Optional[pulumi.Input[bool]] = None,
-                 client_flag: Optional[pulumi.Input[bool]] = None,
-                 cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 code_signing_flag: Optional[pulumi.Input[bool]] = None,
-                 countries: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 email_protection_flag: Optional[pulumi.Input[bool]] = None,
-                 enforce_hostnames: Optional[pulumi.Input[bool]] = None,
-                 ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 generate_lease: Optional[pulumi.Input[bool]] = None,
-                 issuer_ref: Optional[pulumi.Input[str]] = None,
-                 key_bits: Optional[pulumi.Input[int]] = None,
-                 key_type: Optional[pulumi.Input[str]] = None,
-                 key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 localities: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 max_ttl: Optional[pulumi.Input[str]] = None,
-                 name: Optional[pulumi.Input[str]] = None,
-                 namespace: Optional[pulumi.Input[str]] = None,
-                 no_store: Optional[pulumi.Input[bool]] = None,
-                 not_before_duration: Optional[pulumi.Input[str]] = None,
-                 organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 organizations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
+                 allow_any_name: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_bare_domains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_glob_domains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_ip_sans: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_localhost: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_subdomains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_wildcard_certificates: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_domains_template: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_uri_sans_template: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 backend: Optional[pulumi.Input[builtins.str]] = None,
+                 basic_constraints_valid_for_non_ca: Optional[pulumi.Input[builtins.bool]] = None,
+                 client_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 code_signing_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 countries: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 email_protection_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 enforce_hostnames: Optional[pulumi.Input[builtins.bool]] = None,
+                 ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 generate_lease: Optional[pulumi.Input[builtins.bool]] = None,
+                 issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
+                 key_bits: Optional[pulumi.Input[builtins.int]] = None,
+                 key_type: Optional[pulumi.Input[builtins.str]] = None,
+                 key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 localities: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 max_ttl: Optional[pulumi.Input[builtins.str]] = None,
+                 name: Optional[pulumi.Input[builtins.str]] = None,
+                 namespace: Optional[pulumi.Input[builtins.str]] = None,
+                 no_store: Optional[pulumi.Input[builtins.bool]] = None,
+                 no_store_metadata: Optional[pulumi.Input[builtins.bool]] = None,
+                 not_after: Optional[pulumi.Input[builtins.str]] = None,
+                 not_before_duration: Optional[pulumi.Input[builtins.str]] = None,
+                 organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 organizations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
                  policy_identifier: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretBackendRolePolicyIdentifierArgs', 'SecretBackendRolePolicyIdentifierArgsDict']]]]] = None,
-                 policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 provinces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 require_cn: Optional[pulumi.Input[bool]] = None,
-                 server_flag: Optional[pulumi.Input[bool]] = None,
-                 street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 ttl: Optional[pulumi.Input[str]] = None,
-                 use_csr_common_name: Optional[pulumi.Input[bool]] = None,
-                 use_csr_sans: Optional[pulumi.Input[bool]] = None,
+                 policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 provinces: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 require_cn: Optional[pulumi.Input[builtins.bool]] = None,
+                 serial_number_source: Optional[pulumi.Input[builtins.str]] = None,
+                 server_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 signature_bits: Optional[pulumi.Input[builtins.int]] = None,
+                 street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 ttl: Optional[pulumi.Input[builtins.str]] = None,
+                 use_csr_common_name: Optional[pulumi.Input[builtins.bool]] = None,
+                 use_csr_sans: Optional[pulumi.Input[builtins.bool]] = None,
+                 use_pss: Optional[pulumi.Input[builtins.bool]] = None,
                  __props__=None):
         """
         Creates a role on an PKI Secret Backend for Vault.
@@ -1664,62 +1838,69 @@ class SecretBackendRole(pulumi.CustomResource):
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[bool] allow_any_name: Flag to allow any name
-        :param pulumi.Input[bool] allow_bare_domains: Flag to allow certificates matching the actual domain
-        :param pulumi.Input[bool] allow_glob_domains: Flag to allow names containing glob patterns.
-        :param pulumi.Input[bool] allow_ip_sans: Flag to allow IP SANs
-        :param pulumi.Input[bool] allow_localhost: Flag to allow certificates for localhost
-        :param pulumi.Input[bool] allow_subdomains: Flag to allow certificates matching subdomains
-        :param pulumi.Input[bool] allow_wildcard_certificates: Flag to allow wildcard certificates.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_domains: List of allowed domains for certificates
-        :param pulumi.Input[bool] allowed_domains_template: Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_other_sans: Defines allowed custom SANs
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_serial_numbers: An array of allowed serial numbers to put in Subject
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_uri_sans: Defines allowed URI SANs
-        :param pulumi.Input[bool] allowed_uri_sans_template: Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_user_ids: Defines allowed User IDs
-        :param pulumi.Input[str] backend: The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
-        :param pulumi.Input[bool] basic_constraints_valid_for_non_ca: Flag to mark basic constraints valid when issuing non-CA certificates
-        :param pulumi.Input[bool] client_flag: Flag to specify certificates for client use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] cn_validations: Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
-        :param pulumi.Input[bool] code_signing_flag: Flag to specify certificates for code signing use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] countries: The country of generated certificates
-        :param pulumi.Input[bool] email_protection_flag: Flag to specify certificates for email protection use
-        :param pulumi.Input[bool] enforce_hostnames: Flag to allow only valid host names
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] ext_key_usage_oids: Specify the allowed extended key usage OIDs constraint on issued certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] ext_key_usages: Specify the allowed extended key usage constraint on issued certificates
-        :param pulumi.Input[bool] generate_lease: Flag to generate leases with certificates
-        :param pulumi.Input[str] issuer_ref: Specifies the default issuer of this request. May
+        :param pulumi.Input[builtins.bool] allow_any_name: Flag to allow any name
+        :param pulumi.Input[builtins.bool] allow_bare_domains: Flag to allow certificates matching the actual domain
+        :param pulumi.Input[builtins.bool] allow_glob_domains: Flag to allow names containing glob patterns.
+        :param pulumi.Input[builtins.bool] allow_ip_sans: Flag to allow IP SANs
+        :param pulumi.Input[builtins.bool] allow_localhost: Flag to allow certificates for localhost
+        :param pulumi.Input[builtins.bool] allow_subdomains: Flag to allow certificates matching subdomains
+        :param pulumi.Input[builtins.bool] allow_wildcard_certificates: Flag to allow wildcard certificates.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_domains: List of allowed domains for certificates
+        :param pulumi.Input[builtins.bool] allowed_domains_template: Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_other_sans: Defines allowed custom SANs
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_serial_numbers: An array of allowed serial numbers to put in Subject
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_uri_sans: Defines allowed URI SANs
+        :param pulumi.Input[builtins.bool] allowed_uri_sans_template: Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_user_ids: Defines allowed User IDs
+        :param pulumi.Input[builtins.str] backend: The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
+        :param pulumi.Input[builtins.bool] basic_constraints_valid_for_non_ca: Flag to mark basic constraints valid when issuing non-CA certificates
+        :param pulumi.Input[builtins.bool] client_flag: Flag to specify certificates for client use
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] cn_validations: Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
+        :param pulumi.Input[builtins.bool] code_signing_flag: Flag to specify certificates for code signing use
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] countries: The country of generated certificates
+        :param pulumi.Input[builtins.bool] email_protection_flag: Flag to specify certificates for email protection use
+        :param pulumi.Input[builtins.bool] enforce_hostnames: Flag to allow only valid host names
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] ext_key_usage_oids: Specify the allowed extended key usage OIDs constraint on issued certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] ext_key_usages: Specify the allowed extended key usage constraint on issued certificates
+        :param pulumi.Input[builtins.bool] generate_lease: Flag to generate leases with certificates
+        :param pulumi.Input[builtins.str] issuer_ref: Specifies the default issuer of this request. May
                be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
                the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users
                overriding the role's `issuer_ref` value.
-        :param pulumi.Input[int] key_bits: The number of bits of generated keys
-        :param pulumi.Input[str] key_type: The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
+        :param pulumi.Input[builtins.int] key_bits: The number of bits of generated keys
+        :param pulumi.Input[builtins.str] key_type: The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
                Defaults to `rsa`
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] key_usages: Specify the allowed key usage constraint on issued
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] key_usages: Specify the allowed key usage constraint on issued
                certificates. Defaults to `["DigitalSignature", "KeyAgreement", "KeyEncipherment"])`.
                To specify no default key usage constraints, set this to an empty list `[]`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] localities: The locality of generated certificates
-        :param pulumi.Input[str] max_ttl: The maximum lease TTL, in seconds, for the role.
-        :param pulumi.Input[str] name: The name to identify this role within the backend. Must be unique within the backend.
-        :param pulumi.Input[str] namespace: The namespace to provision the resource in.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] localities: The locality of generated certificates
+        :param pulumi.Input[builtins.str] max_ttl: The maximum lease TTL, in seconds, for the role.
+        :param pulumi.Input[builtins.str] name: The name to identify this role within the backend. Must be unique within the backend.
+        :param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[bool] no_store: Flag to not store certificates in the storage backend
-        :param pulumi.Input[str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] organization_unit: The organization unit of generated certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] organizations: The organization of generated certificates
+        :param pulumi.Input[builtins.bool] no_store: Flag to not store certificates in the storage backend
+        :param pulumi.Input[builtins.bool] no_store_metadata: Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs
+        :param pulumi.Input[builtins.str] not_after: Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
+        :param pulumi.Input[builtins.str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] organization_unit: The organization unit of generated certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] organizations: The organization of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[Union['SecretBackendRolePolicyIdentifierArgs', 'SecretBackendRolePolicyIdentifierArgsDict']]]] policy_identifier: (Vault 1.11+ only) A block for specifying policy identifers. The `policy_identifier` block can be repeated, and supports the following arguments:
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] postal_codes: The postal code of generated certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] provinces: The province of generated certificates
-        :param pulumi.Input[bool] require_cn: Flag to force CN usage
-        :param pulumi.Input[bool] server_flag: Flag to specify certificates for server use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] street_addresses: The street address of generated certificates
-        :param pulumi.Input[str] ttl: The TTL, in seconds, for any certificate issued against this role.
-        :param pulumi.Input[bool] use_csr_common_name: Flag to use the CN in the CSR
-        :param pulumi.Input[bool] use_csr_sans: Flag to use the SANs in the CSR
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] postal_codes: The postal code of generated certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] provinces: The province of generated certificates
+        :param pulumi.Input[builtins.bool] require_cn: Flag to force CN usage
+        :param pulumi.Input[builtins.str] serial_number_source: Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the serial_number parameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the serial_number parameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.
+               Example usage:
+        :param pulumi.Input[builtins.bool] server_flag: Flag to specify certificates for server use
+        :param pulumi.Input[builtins.int] signature_bits: The number of bits to use in the signature algorithm
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] street_addresses: The street address of generated certificates
+        :param pulumi.Input[builtins.str] ttl: The TTL, in seconds, for any certificate issued against this role.
+        :param pulumi.Input[builtins.bool] use_csr_common_name: Flag to use the CN in the CSR
+        :param pulumi.Input[builtins.bool] use_csr_sans: Flag to use the SANs in the CSR
+        :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
         """
         ...
     @overload
@@ -1778,53 +1959,58 @@ class SecretBackendRole(pulumi.CustomResource):
     def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
-                 allow_any_name: Optional[pulumi.Input[bool]] = None,
-                 allow_bare_domains: Optional[pulumi.Input[bool]] = None,
-                 allow_glob_domains: Optional[pulumi.Input[bool]] = None,
-                 allow_ip_sans: Optional[pulumi.Input[bool]] = None,
-                 allow_localhost: Optional[pulumi.Input[bool]] = None,
-                 allow_subdomains: Optional[pulumi.Input[bool]] = None,
-                 allow_wildcard_certificates: Optional[pulumi.Input[bool]] = None,
-                 allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_domains_template: Optional[pulumi.Input[bool]] = None,
-                 allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 allowed_uri_sans_template: Optional[pulumi.Input[bool]] = None,
-                 allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 backend: Optional[pulumi.Input[str]] = None,
-                 basic_constraints_valid_for_non_ca: Optional[pulumi.Input[bool]] = None,
-                 client_flag: Optional[pulumi.Input[bool]] = None,
-                 cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 code_signing_flag: Optional[pulumi.Input[bool]] = None,
-                 countries: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 email_protection_flag: Optional[pulumi.Input[bool]] = None,
-                 enforce_hostnames: Optional[pulumi.Input[bool]] = None,
-                 ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 generate_lease: Optional[pulumi.Input[bool]] = None,
-                 issuer_ref: Optional[pulumi.Input[str]] = None,
-                 key_bits: Optional[pulumi.Input[int]] = None,
-                 key_type: Optional[pulumi.Input[str]] = None,
-                 key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 localities: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 max_ttl: Optional[pulumi.Input[str]] = None,
-                 name: Optional[pulumi.Input[str]] = None,
-                 namespace: Optional[pulumi.Input[str]] = None,
-                 no_store: Optional[pulumi.Input[bool]] = None,
-                 not_before_duration: Optional[pulumi.Input[str]] = None,
-                 organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 organizations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
+                 allow_any_name: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_bare_domains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_glob_domains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_ip_sans: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_localhost: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_subdomains: Optional[pulumi.Input[builtins.bool]] = None,
+                 allow_wildcard_certificates: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_domains_template: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 allowed_uri_sans_template: Optional[pulumi.Input[builtins.bool]] = None,
+                 allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 backend: Optional[pulumi.Input[builtins.str]] = None,
+                 basic_constraints_valid_for_non_ca: Optional[pulumi.Input[builtins.bool]] = None,
+                 client_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 code_signing_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 countries: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 email_protection_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 enforce_hostnames: Optional[pulumi.Input[builtins.bool]] = None,
+                 ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 generate_lease: Optional[pulumi.Input[builtins.bool]] = None,
+                 issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
+                 key_bits: Optional[pulumi.Input[builtins.int]] = None,
+                 key_type: Optional[pulumi.Input[builtins.str]] = None,
+                 key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 localities: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 max_ttl: Optional[pulumi.Input[builtins.str]] = None,
+                 name: Optional[pulumi.Input[builtins.str]] = None,
+                 namespace: Optional[pulumi.Input[builtins.str]] = None,
+                 no_store: Optional[pulumi.Input[builtins.bool]] = None,
+                 no_store_metadata: Optional[pulumi.Input[builtins.bool]] = None,
+                 not_after: Optional[pulumi.Input[builtins.str]] = None,
+                 not_before_duration: Optional[pulumi.Input[builtins.str]] = None,
+                 organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 organizations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
                  policy_identifier: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretBackendRolePolicyIdentifierArgs', 'SecretBackendRolePolicyIdentifierArgsDict']]]]] = None,
-                 policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 provinces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 require_cn: Optional[pulumi.Input[bool]] = None,
-                 server_flag: Optional[pulumi.Input[bool]] = None,
-                 street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 ttl: Optional[pulumi.Input[str]] = None,
-                 use_csr_common_name: Optional[pulumi.Input[bool]] = None,
-                 use_csr_sans: Optional[pulumi.Input[bool]] = None,
+                 policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 provinces: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 require_cn: Optional[pulumi.Input[builtins.bool]] = None,
+                 serial_number_source: Optional[pulumi.Input[builtins.str]] = None,
+                 server_flag: Optional[pulumi.Input[builtins.bool]] = None,
+                 signature_bits: Optional[pulumi.Input[builtins.int]] = None,
+                 street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+                 ttl: Optional[pulumi.Input[builtins.str]] = None,
+                 use_csr_common_name: Optional[pulumi.Input[builtins.bool]] = None,
+                 use_csr_sans: Optional[pulumi.Input[builtins.bool]] = None,
+                 use_pss: Optional[pulumi.Input[builtins.bool]] = None,
                  __props__=None):
         opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
         if not isinstance(opts, pulumi.ResourceOptions):
@@ -1870,6 +2056,8 @@ class SecretBackendRole(pulumi.CustomResource):
             __props__.__dict__["name"] = name
             __props__.__dict__["namespace"] = namespace
             __props__.__dict__["no_store"] = no_store
+            __props__.__dict__["no_store_metadata"] = no_store_metadata
+            __props__.__dict__["not_after"] = not_after
             __props__.__dict__["not_before_duration"] = not_before_duration
             __props__.__dict__["organization_unit"] = organization_unit
             __props__.__dict__["organizations"] = organizations
@@ -1878,11 +2066,14 @@ class SecretBackendRole(pulumi.CustomResource):
             __props__.__dict__["postal_codes"] = postal_codes
             __props__.__dict__["provinces"] = provinces
             __props__.__dict__["require_cn"] = require_cn
+            __props__.__dict__["serial_number_source"] = serial_number_source
             __props__.__dict__["server_flag"] = server_flag
+            __props__.__dict__["signature_bits"] = signature_bits
             __props__.__dict__["street_addresses"] = street_addresses
             __props__.__dict__["ttl"] = ttl
             __props__.__dict__["use_csr_common_name"] = use_csr_common_name
             __props__.__dict__["use_csr_sans"] = use_csr_sans
+            __props__.__dict__["use_pss"] = use_pss
         super(SecretBackendRole, __self__).__init__(
             'vault:pkiSecret/secretBackendRole:SecretBackendRole',
             resource_name,
@@ -1893,53 +2084,58 @@ class SecretBackendRole(pulumi.CustomResource):
     def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
-            allow_any_name: Optional[pulumi.Input[bool]] = None,
-            allow_bare_domains: Optional[pulumi.Input[bool]] = None,
-            allow_glob_domains: Optional[pulumi.Input[bool]] = None,
-            allow_ip_sans: Optional[pulumi.Input[bool]] = None,
-            allow_localhost: Optional[pulumi.Input[bool]] = None,
-            allow_subdomains: Optional[pulumi.Input[bool]] = None,
-            allow_wildcard_certificates: Optional[pulumi.Input[bool]] = None,
-            allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            allowed_domains_template: Optional[pulumi.Input[bool]] = None,
-            allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            allowed_uri_sans_template: Optional[pulumi.Input[bool]] = None,
-            allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            backend: Optional[pulumi.Input[str]] = None,
-            basic_constraints_valid_for_non_ca: Optional[pulumi.Input[bool]] = None,
-            client_flag: Optional[pulumi.Input[bool]] = None,
-            cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            code_signing_flag: Optional[pulumi.Input[bool]] = None,
-            countries: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            email_protection_flag: Optional[pulumi.Input[bool]] = None,
-            enforce_hostnames: Optional[pulumi.Input[bool]] = None,
-            ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            generate_lease: Optional[pulumi.Input[bool]] = None,
-            issuer_ref: Optional[pulumi.Input[str]] = None,
-            key_bits: Optional[pulumi.Input[int]] = None,
-            key_type: Optional[pulumi.Input[str]] = None,
-            key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            localities: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            max_ttl: Optional[pulumi.Input[str]] = None,
-            name: Optional[pulumi.Input[str]] = None,
-            namespace: Optional[pulumi.Input[str]] = None,
-            no_store: Optional[pulumi.Input[bool]] = None,
-            not_before_duration: Optional[pulumi.Input[str]] = None,
-            organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            organizations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
+            allow_any_name: Optional[pulumi.Input[builtins.bool]] = None,
+            allow_bare_domains: Optional[pulumi.Input[builtins.bool]] = None,
+            allow_glob_domains: Optional[pulumi.Input[builtins.bool]] = None,
+            allow_ip_sans: Optional[pulumi.Input[builtins.bool]] = None,
+            allow_localhost: Optional[pulumi.Input[builtins.bool]] = None,
+            allow_subdomains: Optional[pulumi.Input[builtins.bool]] = None,
+            allow_wildcard_certificates: Optional[pulumi.Input[builtins.bool]] = None,
+            allowed_domains: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            allowed_domains_template: Optional[pulumi.Input[builtins.bool]] = None,
+            allowed_other_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            allowed_serial_numbers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            allowed_uri_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            allowed_uri_sans_template: Optional[pulumi.Input[builtins.bool]] = None,
+            allowed_user_ids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            backend: Optional[pulumi.Input[builtins.str]] = None,
+            basic_constraints_valid_for_non_ca: Optional[pulumi.Input[builtins.bool]] = None,
+            client_flag: Optional[pulumi.Input[builtins.bool]] = None,
+            cn_validations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            code_signing_flag: Optional[pulumi.Input[builtins.bool]] = None,
+            countries: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            email_protection_flag: Optional[pulumi.Input[builtins.bool]] = None,
+            enforce_hostnames: Optional[pulumi.Input[builtins.bool]] = None,
+            ext_key_usage_oids: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            ext_key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            generate_lease: Optional[pulumi.Input[builtins.bool]] = None,
+            issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
+            key_bits: Optional[pulumi.Input[builtins.int]] = None,
+            key_type: Optional[pulumi.Input[builtins.str]] = None,
+            key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            localities: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            max_ttl: Optional[pulumi.Input[builtins.str]] = None,
+            name: Optional[pulumi.Input[builtins.str]] = None,
+            namespace: Optional[pulumi.Input[builtins.str]] = None,
+            no_store: Optional[pulumi.Input[builtins.bool]] = None,
+            no_store_metadata: Optional[pulumi.Input[builtins.bool]] = None,
+            not_after: Optional[pulumi.Input[builtins.str]] = None,
+            not_before_duration: Optional[pulumi.Input[builtins.str]] = None,
+            organization_unit: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            organizations: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
             policy_identifier: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretBackendRolePolicyIdentifierArgs', 'SecretBackendRolePolicyIdentifierArgsDict']]]]] = None,
-            policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            provinces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            require_cn: Optional[pulumi.Input[bool]] = None,
-            server_flag: Optional[pulumi.Input[bool]] = None,
-            street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            ttl: Optional[pulumi.Input[str]] = None,
-            use_csr_common_name: Optional[pulumi.Input[bool]] = None,
-            use_csr_sans: Optional[pulumi.Input[bool]] = None) -> 'SecretBackendRole':
+            policy_identifiers: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            postal_codes: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            provinces: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            require_cn: Optional[pulumi.Input[builtins.bool]] = None,
+            serial_number_source: Optional[pulumi.Input[builtins.str]] = None,
+            server_flag: Optional[pulumi.Input[builtins.bool]] = None,
+            signature_bits: Optional[pulumi.Input[builtins.int]] = None,
+            street_addresses: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
+            ttl: Optional[pulumi.Input[builtins.str]] = None,
+            use_csr_common_name: Optional[pulumi.Input[builtins.bool]] = None,
+            use_csr_sans: Optional[pulumi.Input[builtins.bool]] = None,
+            use_pss: Optional[pulumi.Input[builtins.bool]] = None) -> 'SecretBackendRole':
         """
         Get an existing SecretBackendRole resource's state with the given name, id, and optional extra
         properties used to qualify the lookup.
@@ -1947,62 +2143,69 @@ class SecretBackendRole(pulumi.CustomResource):
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[bool] allow_any_name: Flag to allow any name
-        :param pulumi.Input[bool] allow_bare_domains: Flag to allow certificates matching the actual domain
-        :param pulumi.Input[bool] allow_glob_domains: Flag to allow names containing glob patterns.
-        :param pulumi.Input[bool] allow_ip_sans: Flag to allow IP SANs
-        :param pulumi.Input[bool] allow_localhost: Flag to allow certificates for localhost
-        :param pulumi.Input[bool] allow_subdomains: Flag to allow certificates matching subdomains
-        :param pulumi.Input[bool] allow_wildcard_certificates: Flag to allow wildcard certificates.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_domains: List of allowed domains for certificates
-        :param pulumi.Input[bool] allowed_domains_template: Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_other_sans: Defines allowed custom SANs
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_serial_numbers: An array of allowed serial numbers to put in Subject
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_uri_sans: Defines allowed URI SANs
-        :param pulumi.Input[bool] allowed_uri_sans_template: Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_user_ids: Defines allowed User IDs
-        :param pulumi.Input[str] backend: The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
-        :param pulumi.Input[bool] basic_constraints_valid_for_non_ca: Flag to mark basic constraints valid when issuing non-CA certificates
-        :param pulumi.Input[bool] client_flag: Flag to specify certificates for client use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] cn_validations: Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
-        :param pulumi.Input[bool] code_signing_flag: Flag to specify certificates for code signing use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] countries: The country of generated certificates
-        :param pulumi.Input[bool] email_protection_flag: Flag to specify certificates for email protection use
-        :param pulumi.Input[bool] enforce_hostnames: Flag to allow only valid host names
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] ext_key_usage_oids: Specify the allowed extended key usage OIDs constraint on issued certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] ext_key_usages: Specify the allowed extended key usage constraint on issued certificates
-        :param pulumi.Input[bool] generate_lease: Flag to generate leases with certificates
-        :param pulumi.Input[str] issuer_ref: Specifies the default issuer of this request. May
+        :param pulumi.Input[builtins.bool] allow_any_name: Flag to allow any name
+        :param pulumi.Input[builtins.bool] allow_bare_domains: Flag to allow certificates matching the actual domain
+        :param pulumi.Input[builtins.bool] allow_glob_domains: Flag to allow names containing glob patterns.
+        :param pulumi.Input[builtins.bool] allow_ip_sans: Flag to allow IP SANs
+        :param pulumi.Input[builtins.bool] allow_localhost: Flag to allow certificates for localhost
+        :param pulumi.Input[builtins.bool] allow_subdomains: Flag to allow certificates matching subdomains
+        :param pulumi.Input[builtins.bool] allow_wildcard_certificates: Flag to allow wildcard certificates.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_domains: List of allowed domains for certificates
+        :param pulumi.Input[builtins.bool] allowed_domains_template: Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_other_sans: Defines allowed custom SANs
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_serial_numbers: An array of allowed serial numbers to put in Subject
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_uri_sans: Defines allowed URI SANs
+        :param pulumi.Input[builtins.bool] allowed_uri_sans_template: Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] allowed_user_ids: Defines allowed User IDs
+        :param pulumi.Input[builtins.str] backend: The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
+        :param pulumi.Input[builtins.bool] basic_constraints_valid_for_non_ca: Flag to mark basic constraints valid when issuing non-CA certificates
+        :param pulumi.Input[builtins.bool] client_flag: Flag to specify certificates for client use
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] cn_validations: Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
+        :param pulumi.Input[builtins.bool] code_signing_flag: Flag to specify certificates for code signing use
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] countries: The country of generated certificates
+        :param pulumi.Input[builtins.bool] email_protection_flag: Flag to specify certificates for email protection use
+        :param pulumi.Input[builtins.bool] enforce_hostnames: Flag to allow only valid host names
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] ext_key_usage_oids: Specify the allowed extended key usage OIDs constraint on issued certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] ext_key_usages: Specify the allowed extended key usage constraint on issued certificates
+        :param pulumi.Input[builtins.bool] generate_lease: Flag to generate leases with certificates
+        :param pulumi.Input[builtins.str] issuer_ref: Specifies the default issuer of this request. May
                be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
                the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users
                overriding the role's `issuer_ref` value.
-        :param pulumi.Input[int] key_bits: The number of bits of generated keys
-        :param pulumi.Input[str] key_type: The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
+        :param pulumi.Input[builtins.int] key_bits: The number of bits of generated keys
+        :param pulumi.Input[builtins.str] key_type: The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
                Defaults to `rsa`
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] key_usages: Specify the allowed key usage constraint on issued
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] key_usages: Specify the allowed key usage constraint on issued
                certificates. Defaults to `["DigitalSignature", "KeyAgreement", "KeyEncipherment"])`.
                To specify no default key usage constraints, set this to an empty list `[]`.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] localities: The locality of generated certificates
-        :param pulumi.Input[str] max_ttl: The maximum lease TTL, in seconds, for the role.
-        :param pulumi.Input[str] name: The name to identify this role within the backend. Must be unique within the backend.
-        :param pulumi.Input[str] namespace: The namespace to provision the resource in.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] localities: The locality of generated certificates
+        :param pulumi.Input[builtins.str] max_ttl: The maximum lease TTL, in seconds, for the role.
+        :param pulumi.Input[builtins.str] name: The name to identify this role within the backend. Must be unique within the backend.
+        :param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[bool] no_store: Flag to not store certificates in the storage backend
-        :param pulumi.Input[str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] organization_unit: The organization unit of generated certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] organizations: The organization of generated certificates
+        :param pulumi.Input[builtins.bool] no_store: Flag to not store certificates in the storage backend
+        :param pulumi.Input[builtins.bool] no_store_metadata: Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs
+        :param pulumi.Input[builtins.str] not_after: Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
+        :param pulumi.Input[builtins.str] not_before_duration: Specifies the duration by which to backdate the NotBefore property.
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] organization_unit: The organization unit of generated certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] organizations: The organization of generated certificates
         :param pulumi.Input[Sequence[pulumi.Input[Union['SecretBackendRolePolicyIdentifierArgs', 'SecretBackendRolePolicyIdentifierArgsDict']]]] policy_identifier: (Vault 1.11+ only) A block for specifying policy identifers. The `policy_identifier` block can be repeated, and supports the following arguments:
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] postal_codes: The postal code of generated certificates
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] provinces: The province of generated certificates
-        :param pulumi.Input[bool] require_cn: Flag to force CN usage
-        :param pulumi.Input[bool] server_flag: Flag to specify certificates for server use
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] street_addresses: The street address of generated certificates
-        :param pulumi.Input[str] ttl: The TTL, in seconds, for any certificate issued against this role.
-        :param pulumi.Input[bool] use_csr_common_name: Flag to use the CN in the CSR
-        :param pulumi.Input[bool] use_csr_sans: Flag to use the SANs in the CSR
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] policy_identifiers: Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] postal_codes: The postal code of generated certificates
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] provinces: The province of generated certificates
+        :param pulumi.Input[builtins.bool] require_cn: Flag to force CN usage
+        :param pulumi.Input[builtins.str] serial_number_source: Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the serial_number parameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the serial_number parameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.
+               Example usage:
+        :param pulumi.Input[builtins.bool] server_flag: Flag to specify certificates for server use
+        :param pulumi.Input[builtins.int] signature_bits: The number of bits to use in the signature algorithm
+        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] street_addresses: The street address of generated certificates
+        :param pulumi.Input[builtins.str] ttl: The TTL, in seconds, for any certificate issued against this role.
+        :param pulumi.Input[builtins.bool] use_csr_common_name: Flag to use the CN in the CSR
+        :param pulumi.Input[builtins.bool] use_csr_sans: Flag to use the SANs in the CSR
+        :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
@@ -2042,6 +2245,8 @@ class SecretBackendRole(pulumi.CustomResource):
         __props__.__dict__["name"] = name
         __props__.__dict__["namespace"] = namespace
         __props__.__dict__["no_store"] = no_store
+        __props__.__dict__["no_store_metadata"] = no_store_metadata
+        __props__.__dict__["not_after"] = not_after
         __props__.__dict__["not_before_duration"] = not_before_duration
         __props__.__dict__["organization_unit"] = organization_unit
         __props__.__dict__["organizations"] = organizations
@@ -2050,16 +2255,19 @@ class SecretBackendRole(pulumi.CustomResource):
         __props__.__dict__["postal_codes"] = postal_codes
         __props__.__dict__["provinces"] = provinces
         __props__.__dict__["require_cn"] = require_cn
+        __props__.__dict__["serial_number_source"] = serial_number_source
         __props__.__dict__["server_flag"] = server_flag
+        __props__.__dict__["signature_bits"] = signature_bits
         __props__.__dict__["street_addresses"] = street_addresses
         __props__.__dict__["ttl"] = ttl
         __props__.__dict__["use_csr_common_name"] = use_csr_common_name
         __props__.__dict__["use_csr_sans"] = use_csr_sans
+        __props__.__dict__["use_pss"] = use_pss
         return SecretBackendRole(resource_name, opts=opts, __props__=__props__)
     @property
     @pulumi.getter(name="allowAnyName")
-    def allow_any_name(self) -> pulumi.Output[Optional[bool]]:
+    def allow_any_name(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to allow any name
         """
@@ -2067,7 +2275,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowBareDomains")
-    def allow_bare_domains(self) -> pulumi.Output[Optional[bool]]:
+    def allow_bare_domains(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to allow certificates matching the actual domain
         """
@@ -2075,7 +2283,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowGlobDomains")
-    def allow_glob_domains(self) -> pulumi.Output[Optional[bool]]:
+    def allow_glob_domains(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to allow names containing glob patterns.
         """
@@ -2083,7 +2291,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowIpSans")
-    def allow_ip_sans(self) -> pulumi.Output[Optional[bool]]:
+    def allow_ip_sans(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to allow IP SANs
         """
@@ -2091,7 +2299,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowLocalhost")
-    def allow_localhost(self) -> pulumi.Output[Optional[bool]]:
+    def allow_localhost(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to allow certificates for localhost
         """
@@ -2099,7 +2307,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowSubdomains")
-    def allow_subdomains(self) -> pulumi.Output[Optional[bool]]:
+    def allow_subdomains(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to allow certificates matching subdomains
         """
@@ -2107,7 +2315,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowWildcardCertificates")
-    def allow_wildcard_certificates(self) -> pulumi.Output[Optional[bool]]:
+    def allow_wildcard_certificates(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to allow wildcard certificates.
         """
@@ -2115,7 +2323,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowedDomains")
-    def allowed_domains(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def allowed_domains(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         List of allowed domains for certificates
         """
@@ -2123,7 +2331,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowedDomainsTemplate")
-    def allowed_domains_template(self) -> pulumi.Output[Optional[bool]]:
+    def allowed_domains_template(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag, if set, `allowed_domains` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
         """
@@ -2131,7 +2339,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowedOtherSans")
-    def allowed_other_sans(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def allowed_other_sans(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         Defines allowed custom SANs
         """
@@ -2139,7 +2347,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowedSerialNumbers")
-    def allowed_serial_numbers(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def allowed_serial_numbers(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         An array of allowed serial numbers to put in Subject
         """
@@ -2147,7 +2355,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowedUriSans")
-    def allowed_uri_sans(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def allowed_uri_sans(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         Defines allowed URI SANs
         """
@@ -2155,7 +2363,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowedUriSansTemplate")
-    def allowed_uri_sans_template(self) -> pulumi.Output[bool]:
+    def allowed_uri_sans_template(self) -> pulumi.Output[builtins.bool]:
         """
         Flag, if set, `allowed_uri_sans` can be specified using identity template expressions such as `{{identity.entity.aliases.<mount accessor>.name}}`.
         """
@@ -2163,7 +2371,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="allowedUserIds")
-    def allowed_user_ids(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def allowed_user_ids(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         Defines allowed User IDs
         """
@@ -2171,7 +2379,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter
-    def backend(self) -> pulumi.Output[str]:
+    def backend(self) -> pulumi.Output[builtins.str]:
         """
         The path the PKI secret backend is mounted at, with no leading or trailing `/`s.
         """
@@ -2179,7 +2387,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="basicConstraintsValidForNonCa")
-    def basic_constraints_valid_for_non_ca(self) -> pulumi.Output[Optional[bool]]:
+    def basic_constraints_valid_for_non_ca(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to mark basic constraints valid when issuing non-CA certificates
         """
@@ -2187,7 +2395,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="clientFlag")
-    def client_flag(self) -> pulumi.Output[Optional[bool]]:
+    def client_flag(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to specify certificates for client use
         """
@@ -2195,7 +2403,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="cnValidations")
-    def cn_validations(self) -> pulumi.Output[Sequence[str]]:
+    def cn_validations(self) -> pulumi.Output[Sequence[builtins.str]]:
         """
         Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`
         """
@@ -2203,7 +2411,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="codeSigningFlag")
-    def code_signing_flag(self) -> pulumi.Output[Optional[bool]]:
+    def code_signing_flag(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to specify certificates for code signing use
         """
@@ -2211,7 +2419,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter
-    def countries(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def countries(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         The country of generated certificates
         """
@@ -2219,7 +2427,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="emailProtectionFlag")
-    def email_protection_flag(self) -> pulumi.Output[Optional[bool]]:
+    def email_protection_flag(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to specify certificates for email protection use
         """
@@ -2227,7 +2435,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="enforceHostnames")
-    def enforce_hostnames(self) -> pulumi.Output[Optional[bool]]:
+    def enforce_hostnames(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to allow only valid host names
         """
@@ -2235,7 +2443,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="extKeyUsageOids")
-    def ext_key_usage_oids(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def ext_key_usage_oids(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         Specify the allowed extended key usage OIDs constraint on issued certificates
         """
@@ -2243,7 +2451,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="extKeyUsages")
-    def ext_key_usages(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def ext_key_usages(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         Specify the allowed extended key usage constraint on issued certificates
         """
@@ -2251,7 +2459,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="generateLease")
-    def generate_lease(self) -> pulumi.Output[Optional[bool]]:
+    def generate_lease(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to generate leases with certificates
         """
@@ -2259,7 +2467,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="issuerRef")
-    def issuer_ref(self) -> pulumi.Output[str]:
+    def issuer_ref(self) -> pulumi.Output[builtins.str]:
         """
         Specifies the default issuer of this request. May
         be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
@@ -2270,7 +2478,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="keyBits")
-    def key_bits(self) -> pulumi.Output[Optional[int]]:
+    def key_bits(self) -> pulumi.Output[Optional[builtins.int]]:
         """
         The number of bits of generated keys
         """
@@ -2278,7 +2486,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="keyType")
-    def key_type(self) -> pulumi.Output[Optional[str]]:
+    def key_type(self) -> pulumi.Output[Optional[builtins.str]]:
         """
         The generated key type, choices: `rsa`, `ec`, `ed25519`, `any`
         Defaults to `rsa`
@@ -2287,7 +2495,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="keyUsages")
-    def key_usages(self) -> pulumi.Output[Sequence[str]]:
+    def key_usages(self) -> pulumi.Output[Sequence[builtins.str]]:
         """
         Specify the allowed key usage constraint on issued
         certificates. Defaults to `["DigitalSignature", "KeyAgreement", "KeyEncipherment"])`.
@@ -2297,7 +2505,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter
-    def localities(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def localities(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         The locality of generated certificates
         """
@@ -2305,7 +2513,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="maxTtl")
-    def max_ttl(self) -> pulumi.Output[str]:
+    def max_ttl(self) -> pulumi.Output[builtins.str]:
         """
         The maximum lease TTL, in seconds, for the role.
         """
@@ -2313,7 +2521,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter
-    def name(self) -> pulumi.Output[str]:
+    def name(self) -> pulumi.Output[builtins.str]:
         """
         The name to identify this role within the backend. Must be unique within the backend.
         """
@@ -2321,7 +2529,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter
-    def namespace(self) -> pulumi.Output[Optional[str]]:
+    def namespace(self) -> pulumi.Output[Optional[builtins.str]]:
         """
         The namespace to provision the resource in.
         The value should not contain leading or trailing forward slashes.
@@ -2332,15 +2540,31 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="noStore")
-    def no_store(self) -> pulumi.Output[Optional[bool]]:
+    def no_store(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to not store certificates in the storage backend
         """
         return pulumi.get(self, "no_store")
+    @property
+    @pulumi.getter(name="noStoreMetadata")
+    def no_store_metadata(self) -> pulumi.Output[Optional[builtins.bool]]:
+        """
+        Allows metadata to be stored keyed on the certificate's serial number. The field is independent of no_store, allowing metadata storage regardless of whether certificates are stored. If true, metadata is not stored and an error is returned if the metadata field is specified on issuance APIs
+        """
+        return pulumi.get(self, "no_store_metadata")
+    @property
+    @pulumi.getter(name="notAfter")
+    def not_after(self) -> pulumi.Output[Optional[builtins.str]]:
+        """
+        Set the Not After field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
+        """
+        return pulumi.get(self, "not_after")
     @property
     @pulumi.getter(name="notBeforeDuration")
-    def not_before_duration(self) -> pulumi.Output[str]:
+    def not_before_duration(self) -> pulumi.Output[builtins.str]:
         """
         Specifies the duration by which to backdate the NotBefore property.
         """
@@ -2348,7 +2572,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="organizationUnit")
-    def organization_unit(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def organization_unit(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         The organization unit of generated certificates
         """
@@ -2356,7 +2580,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter
-    def organizations(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def organizations(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         The organization of generated certificates
         """
@@ -2372,7 +2596,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="policyIdentifiers")
-    def policy_identifiers(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def policy_identifiers(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         Specify the list of allowed policies OIDs. Use with Vault 1.10 or before. For Vault 1.11+, use `policy_identifier` blocks instead
         """
@@ -2380,7 +2604,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="postalCodes")
-    def postal_codes(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def postal_codes(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         The postal code of generated certificates
         """
@@ -2388,7 +2612,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter
-    def provinces(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def provinces(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         The province of generated certificates
         """
@@ -2396,23 +2620,41 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="requireCn")
-    def require_cn(self) -> pulumi.Output[Optional[bool]]:
+    def require_cn(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to force CN usage
         """
         return pulumi.get(self, "require_cn")
+    @property
+    @pulumi.getter(name="serialNumberSource")
+    def serial_number_source(self) -> pulumi.Output[builtins.str]:
+        """
+        Specifies the source of the subject serial number. Valid values are json-csr (default) or json. When set to json-csr, the subject serial number is taken from the serial_number parameter and falls back to the serial number in the CSR. When set to json, the subject serial number is taken from the serial_number parameter but will ignore any value in the CSR. For backwards compatibility an empty value for this field will default to the json-csr behavior.
+        Example usage:
+        """
+        return pulumi.get(self, "serial_number_source")
     @property
     @pulumi.getter(name="serverFlag")
-    def server_flag(self) -> pulumi.Output[Optional[bool]]:
+    def server_flag(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to specify certificates for server use
         """
         return pulumi.get(self, "server_flag")
+    @property
+    @pulumi.getter(name="signatureBits")
+    def signature_bits(self) -> pulumi.Output[builtins.int]:
+        """
+        The number of bits to use in the signature algorithm
+        """
+        return pulumi.get(self, "signature_bits")
     @property
     @pulumi.getter(name="streetAddresses")
-    def street_addresses(self) -> pulumi.Output[Optional[Sequence[str]]]:
+    def street_addresses(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
         """
         The street address of generated certificates
         """
@@ -2420,7 +2662,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter
-    def ttl(self) -> pulumi.Output[str]:
+    def ttl(self) -> pulumi.Output[builtins.str]:
         """
         The TTL, in seconds, for any certificate issued against this role.
         """
@@ -2428,7 +2670,7 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="useCsrCommonName")
-    def use_csr_common_name(self) -> pulumi.Output[Optional[bool]]:
+    def use_csr_common_name(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to use the CN in the CSR
         """
@@ -2436,9 +2678,17 @@ class SecretBackendRole(pulumi.CustomResource):
     @property
     @pulumi.getter(name="useCsrSans")
-    def use_csr_sans(self) -> pulumi.Output[Optional[bool]]:
+    def use_csr_sans(self) -> pulumi.Output[Optional[builtins.bool]]:
         """
         Flag to use the SANs in the CSR
         """
         return pulumi.get(self, "use_csr_sans")
+    @property
+    @pulumi.getter(name="usePss")
+    def use_pss(self) -> pulumi.Output[Optional[builtins.bool]]:
+        """
+        Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
+        """
+        return pulumi.get(self, "use_pss")

pulumi-vault 6.6.0a1741415971__py3-none-any.whl → 6.7.0__py3-none-any.whl

pulumi-vault 6.6.0a1741415971py3-none-any.whl → 6.7.0py3-none-any.whl