pulumi-vault 7.0.0a1750489873__py3-none-any.whl → 7.1.0a1752118888__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. pulumi_vault/__init__.py +17 -0
  2. pulumi_vault/database/_inputs.py +48 -0
  3. pulumi_vault/database/outputs.py +30 -0
  4. pulumi_vault/database/secret_backend_connection.py +10 -0
  5. pulumi_vault/pkisecret/__init__.py +2 -0
  6. pulumi_vault/pkisecret/_inputs.py +94 -6
  7. pulumi_vault/pkisecret/backend_config_scep.py +692 -0
  8. pulumi_vault/pkisecret/get_backend_config_scep.py +252 -0
  9. pulumi_vault/pkisecret/outputs.py +112 -8
  10. pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +61 -14
  11. pulumi_vault/pulumi-plugin.json +1 -1
  12. pulumi_vault/quota_rate_limit.py +153 -3
  13. pulumi_vault/scep_auth_backend_role.py +855 -0
  14. pulumi_vault/transit/__init__.py +1 -0
  15. pulumi_vault/transit/get_cmac.py +257 -0
  16. pulumi_vault/transit/get_verify.py +16 -1
  17. {pulumi_vault-7.0.0a1750489873.dist-info → pulumi_vault-7.1.0a1752118888.dist-info}/METADATA +1 -1
  18. {pulumi_vault-7.0.0a1750489873.dist-info → pulumi_vault-7.1.0a1752118888.dist-info}/RECORD +20 -16
  19. {pulumi_vault-7.0.0a1750489873.dist-info → pulumi_vault-7.1.0a1752118888.dist-info}/WHEEL +0 -0
  20. {pulumi_vault-7.0.0a1750489873.dist-info → pulumi_vault-7.1.0a1752118888.dist-info}/top_level.txt +0 -0
pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py CHANGED
@@ -33,6 +33,7 @@ class SecretBackendRootSignIntermediateArgs:
33
33
  format: Optional[pulumi.Input[builtins.str]] = None,
34
34
  ip_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
35
35
  issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
36
+ key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
36
37
  locality: Optional[pulumi.Input[builtins.str]] = None,
37
38
  max_path_length: Optional[pulumi.Input[builtins.int]] = None,
38
39
  namespace: Optional[pulumi.Input[builtins.str]] = None,
@@ -73,6 +74,7 @@ class SecretBackendRootSignIntermediateArgs:
73
74
  be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
74
75
  the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users
75
76
  overriding the role's `issuer_ref` value.
77
+ :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] key_usages: Specify the key usages to be added to the existing set of key usages ("CRL", "CertSign") on the generated certificate.
76
78
  :param pulumi.Input[builtins.str] locality: The locality
77
79
  :param pulumi.Input[builtins.int] max_path_length: The maximum path length to encode in the generated certificate
78
80
  :param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
@@ -94,12 +96,12 @@ class SecretBackendRootSignIntermediateArgs:
94
96
  :param pulumi.Input[builtins.str] province: The province
95
97
  :param pulumi.Input[builtins.bool] revoke: If set to `true`, the certificate will be revoked on resource destruction.
96
98
  :param pulumi.Input[builtins.int] signature_bits: The number of bits to use in the signature algorithm
97
- :param pulumi.Input[builtins.str] skid: Value for the Subject Key Identifier field (RFC 5280 Section 4.2.1.2). Specified as a string in hex format.
99
+ :param pulumi.Input[builtins.str] skid: Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.
98
100
  :param pulumi.Input[builtins.str] street_address: The street address
99
101
  :param pulumi.Input[builtins.str] ttl: Time to live
100
102
  :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] uri_sans: List of alternative URIs
101
103
  :param pulumi.Input[builtins.bool] use_csr_values: Preserve CSR values
102
- :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used.
104
+ :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
103
105
  """
104
106
  pulumi.set(__self__, "backend", backend)
105
107
  pulumi.set(__self__, "common_name", common_name)
@@ -124,6 +126,8 @@ class SecretBackendRootSignIntermediateArgs:
124
126
  pulumi.set(__self__, "ip_sans", ip_sans)
125
127
  if issuer_ref is not None:
126
128
  pulumi.set(__self__, "issuer_ref", issuer_ref)
129
+ if key_usages is not None:
130
+ pulumi.set(__self__, "key_usages", key_usages)
127
131
  if locality is not None:
128
132
  pulumi.set(__self__, "locality", locality)
129
133
  if max_path_length is not None:
@@ -328,6 +332,18 @@ class SecretBackendRootSignIntermediateArgs:
328
332
  def issuer_ref(self, value: Optional[pulumi.Input[builtins.str]]):
329
333
  pulumi.set(self, "issuer_ref", value)
330
334
 
335
+ @property
336
+ @pulumi.getter(name="keyUsages")
337
+ def key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
338
+ """
339
+ Specify the key usages to be added to the existing set of key usages ("CRL", "CertSign") on the generated certificate.
340
+ """
341
+ return pulumi.get(self, "key_usages")
342
+
343
+ @key_usages.setter
344
+ def key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
345
+ pulumi.set(self, "key_usages", value)
346
+
331
347
  @property
332
348
  @pulumi.getter
333
349
  def locality(self) -> Optional[pulumi.Input[builtins.str]]:
@@ -529,7 +545,7 @@ class SecretBackendRootSignIntermediateArgs:
529
545
  @pulumi.getter
530
546
  def skid(self) -> Optional[pulumi.Input[builtins.str]]:
531
547
  """
532
- Value for the Subject Key Identifier field (RFC 5280 Section 4.2.1.2). Specified as a string in hex format.
548
+ Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.
533
549
  """
534
550
  return pulumi.get(self, "skid")
535
551
 
@@ -589,7 +605,7 @@ class SecretBackendRootSignIntermediateArgs:
589
605
  @pulumi.getter(name="usePss")
590
606
  def use_pss(self) -> Optional[pulumi.Input[builtins.bool]]:
591
607
  """
592
- Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used.
608
+ Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
593
609
  """
594
610
  return pulumi.get(self, "use_pss")
595
611
 
@@ -618,6 +634,7 @@ class _SecretBackendRootSignIntermediateState:
618
634
  ip_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
619
635
  issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
620
636
  issuing_ca: Optional[pulumi.Input[builtins.str]] = None,
637
+ key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
621
638
  locality: Optional[pulumi.Input[builtins.str]] = None,
622
639
  max_path_length: Optional[pulumi.Input[builtins.int]] = None,
623
640
  namespace: Optional[pulumi.Input[builtins.str]] = None,
@@ -664,6 +681,7 @@ class _SecretBackendRootSignIntermediateState:
664
681
  the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users
665
682
  overriding the role's `issuer_ref` value.
666
683
  :param pulumi.Input[builtins.str] issuing_ca: The issuing CA certificate in the `format` specified.
684
+ :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] key_usages: Specify the key usages to be added to the existing set of key usages ("CRL", "CertSign") on the generated certificate.
667
685
  :param pulumi.Input[builtins.str] locality: The locality
668
686
  :param pulumi.Input[builtins.int] max_path_length: The maximum path length to encode in the generated certificate
669
687
  :param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
@@ -686,12 +704,12 @@ class _SecretBackendRootSignIntermediateState:
686
704
  :param pulumi.Input[builtins.bool] revoke: If set to `true`, the certificate will be revoked on resource destruction.
687
705
  :param pulumi.Input[builtins.str] serial_number: The certificate's serial number, hex formatted.
688
706
  :param pulumi.Input[builtins.int] signature_bits: The number of bits to use in the signature algorithm
689
- :param pulumi.Input[builtins.str] skid: Value for the Subject Key Identifier field (RFC 5280 Section 4.2.1.2). Specified as a string in hex format.
707
+ :param pulumi.Input[builtins.str] skid: Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.
690
708
  :param pulumi.Input[builtins.str] street_address: The street address
691
709
  :param pulumi.Input[builtins.str] ttl: Time to live
692
710
  :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] uri_sans: List of alternative URIs
693
711
  :param pulumi.Input[builtins.bool] use_csr_values: Preserve CSR values
694
- :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used.
712
+ :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
695
713
  """
696
714
  if alt_names is not None:
697
715
  pulumi.set(__self__, "alt_names", alt_names)
@@ -727,6 +745,8 @@ class _SecretBackendRootSignIntermediateState:
727
745
  pulumi.set(__self__, "issuer_ref", issuer_ref)
728
746
  if issuing_ca is not None:
729
747
  pulumi.set(__self__, "issuing_ca", issuing_ca)
748
+ if key_usages is not None:
749
+ pulumi.set(__self__, "key_usages", key_usages)
730
750
  if locality is not None:
731
751
  pulumi.set(__self__, "locality", locality)
732
752
  if max_path_length is not None:
@@ -982,6 +1002,18 @@ class _SecretBackendRootSignIntermediateState:
982
1002
  def issuing_ca(self, value: Optional[pulumi.Input[builtins.str]]):
983
1003
  pulumi.set(self, "issuing_ca", value)
984
1004
 
1005
+ @property
1006
+ @pulumi.getter(name="keyUsages")
1007
+ def key_usages(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
1008
+ """
1009
+ Specify the key usages to be added to the existing set of key usages ("CRL", "CertSign") on the generated certificate.
1010
+ """
1011
+ return pulumi.get(self, "key_usages")
1012
+
1013
+ @key_usages.setter
1014
+ def key_usages(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
1015
+ pulumi.set(self, "key_usages", value)
1016
+
985
1017
  @property
986
1018
  @pulumi.getter
987
1019
  def locality(self) -> Optional[pulumi.Input[builtins.str]]:
@@ -1195,7 +1227,7 @@ class _SecretBackendRootSignIntermediateState:
1195
1227
  @pulumi.getter
1196
1228
  def skid(self) -> Optional[pulumi.Input[builtins.str]]:
1197
1229
  """
1198
- Value for the Subject Key Identifier field (RFC 5280 Section 4.2.1.2). Specified as a string in hex format.
1230
+ Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.
1199
1231
  """
1200
1232
  return pulumi.get(self, "skid")
1201
1233
 
@@ -1255,7 +1287,7 @@ class _SecretBackendRootSignIntermediateState:
1255
1287
  @pulumi.getter(name="usePss")
1256
1288
  def use_pss(self) -> Optional[pulumi.Input[builtins.bool]]:
1257
1289
  """
1258
- Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used.
1290
+ Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
1259
1291
  """
1260
1292
  return pulumi.get(self, "use_pss")
1261
1293
 
@@ -1283,6 +1315,7 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1283
1315
  format: Optional[pulumi.Input[builtins.str]] = None,
1284
1316
  ip_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
1285
1317
  issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
1318
+ key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
1286
1319
  locality: Optional[pulumi.Input[builtins.str]] = None,
1287
1320
  max_path_length: Optional[pulumi.Input[builtins.int]] = None,
1288
1321
  namespace: Optional[pulumi.Input[builtins.str]] = None,
@@ -1343,6 +1376,7 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1343
1376
  be the value `default`, a name, or an issuer ID. Use ACLs to prevent access to
1344
1377
  the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users
1345
1378
  overriding the role's `issuer_ref` value.
1379
+ :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] key_usages: Specify the key usages to be added to the existing set of key usages ("CRL", "CertSign") on the generated certificate.
1346
1380
  :param pulumi.Input[builtins.str] locality: The locality
1347
1381
  :param pulumi.Input[builtins.int] max_path_length: The maximum path length to encode in the generated certificate
1348
1382
  :param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
@@ -1364,12 +1398,12 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1364
1398
  :param pulumi.Input[builtins.str] province: The province
1365
1399
  :param pulumi.Input[builtins.bool] revoke: If set to `true`, the certificate will be revoked on resource destruction.
1366
1400
  :param pulumi.Input[builtins.int] signature_bits: The number of bits to use in the signature algorithm
1367
- :param pulumi.Input[builtins.str] skid: Value for the Subject Key Identifier field (RFC 5280 Section 4.2.1.2). Specified as a string in hex format.
1401
+ :param pulumi.Input[builtins.str] skid: Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.
1368
1402
  :param pulumi.Input[builtins.str] street_address: The street address
1369
1403
  :param pulumi.Input[builtins.str] ttl: Time to live
1370
1404
  :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] uri_sans: List of alternative URIs
1371
1405
  :param pulumi.Input[builtins.bool] use_csr_values: Preserve CSR values
1372
- :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used.
1406
+ :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
1373
1407
  """
1374
1408
  ...
1375
1409
  @overload
@@ -1424,6 +1458,7 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1424
1458
  format: Optional[pulumi.Input[builtins.str]] = None,
1425
1459
  ip_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
1426
1460
  issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
1461
+ key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
1427
1462
  locality: Optional[pulumi.Input[builtins.str]] = None,
1428
1463
  max_path_length: Optional[pulumi.Input[builtins.int]] = None,
1429
1464
  namespace: Optional[pulumi.Input[builtins.str]] = None,
@@ -1474,6 +1509,7 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1474
1509
  __props__.__dict__["format"] = format
1475
1510
  __props__.__dict__["ip_sans"] = ip_sans
1476
1511
  __props__.__dict__["issuer_ref"] = issuer_ref
1512
+ __props__.__dict__["key_usages"] = key_usages
1477
1513
  __props__.__dict__["locality"] = locality
1478
1514
  __props__.__dict__["max_path_length"] = max_path_length
1479
1515
  __props__.__dict__["namespace"] = namespace
@@ -1528,6 +1564,7 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1528
1564
  ip_sans: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
1529
1565
  issuer_ref: Optional[pulumi.Input[builtins.str]] = None,
1530
1566
  issuing_ca: Optional[pulumi.Input[builtins.str]] = None,
1567
+ key_usages: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
1531
1568
  locality: Optional[pulumi.Input[builtins.str]] = None,
1532
1569
  max_path_length: Optional[pulumi.Input[builtins.int]] = None,
1533
1570
  namespace: Optional[pulumi.Input[builtins.str]] = None,
@@ -1579,6 +1616,7 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1579
1616
  the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths to prevent users
1580
1617
  overriding the role's `issuer_ref` value.
1581
1618
  :param pulumi.Input[builtins.str] issuing_ca: The issuing CA certificate in the `format` specified.
1619
+ :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] key_usages: Specify the key usages to be added to the existing set of key usages ("CRL", "CertSign") on the generated certificate.
1582
1620
  :param pulumi.Input[builtins.str] locality: The locality
1583
1621
  :param pulumi.Input[builtins.int] max_path_length: The maximum path length to encode in the generated certificate
1584
1622
  :param pulumi.Input[builtins.str] namespace: The namespace to provision the resource in.
@@ -1601,12 +1639,12 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1601
1639
  :param pulumi.Input[builtins.bool] revoke: If set to `true`, the certificate will be revoked on resource destruction.
1602
1640
  :param pulumi.Input[builtins.str] serial_number: The certificate's serial number, hex formatted.
1603
1641
  :param pulumi.Input[builtins.int] signature_bits: The number of bits to use in the signature algorithm
1604
- :param pulumi.Input[builtins.str] skid: Value for the Subject Key Identifier field (RFC 5280 Section 4.2.1.2). Specified as a string in hex format.
1642
+ :param pulumi.Input[builtins.str] skid: Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.
1605
1643
  :param pulumi.Input[builtins.str] street_address: The street address
1606
1644
  :param pulumi.Input[builtins.str] ttl: Time to live
1607
1645
  :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] uri_sans: List of alternative URIs
1608
1646
  :param pulumi.Input[builtins.bool] use_csr_values: Preserve CSR values
1609
- :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used.
1647
+ :param pulumi.Input[builtins.bool] use_pss: Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
1610
1648
  """
1611
1649
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
1612
1650
 
@@ -1629,6 +1667,7 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1629
1667
  __props__.__dict__["ip_sans"] = ip_sans
1630
1668
  __props__.__dict__["issuer_ref"] = issuer_ref
1631
1669
  __props__.__dict__["issuing_ca"] = issuing_ca
1670
+ __props__.__dict__["key_usages"] = key_usages
1632
1671
  __props__.__dict__["locality"] = locality
1633
1672
  __props__.__dict__["max_path_length"] = max_path_length
1634
1673
  __props__.__dict__["namespace"] = namespace
@@ -1794,6 +1833,14 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1794
1833
  """
1795
1834
  return pulumi.get(self, "issuing_ca")
1796
1835
 
1836
+ @property
1837
+ @pulumi.getter(name="keyUsages")
1838
+ def key_usages(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
1839
+ """
1840
+ Specify the key usages to be added to the existing set of key usages ("CRL", "CertSign") on the generated certificate.
1841
+ """
1842
+ return pulumi.get(self, "key_usages")
1843
+
1797
1844
  @property
1798
1845
  @pulumi.getter
1799
1846
  def locality(self) -> pulumi.Output[Optional[builtins.str]]:
@@ -1939,7 +1986,7 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1939
1986
  @pulumi.getter
1940
1987
  def skid(self) -> pulumi.Output[Optional[builtins.str]]:
1941
1988
  """
1942
- Value for the Subject Key Identifier field (RFC 5280 Section 4.2.1.2). Specified as a string in hex format.
1989
+ Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.
1943
1990
  """
1944
1991
  return pulumi.get(self, "skid")
1945
1992
 
@@ -1979,7 +2026,7 @@ class SecretBackendRootSignIntermediate(pulumi.CustomResource):
1979
2026
  @pulumi.getter(name="usePss")
1980
2027
  def use_pss(self) -> pulumi.Output[Optional[builtins.bool]]:
1981
2028
  """
1982
- Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used.
2029
+ Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
1983
2030
  """
1984
2031
  return pulumi.get(self, "use_pss")
1985
2032
 
pulumi_vault/pulumi-plugin.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
2
  "resource": true,
3
3
  "name": "vault",
4
- "version": "7.0.0-alpha.1750489873"
4
+ "version": "7.1.0-alpha.1752118888"
5
5
  }
pulumi_vault/quota_rate_limit.py CHANGED
@@ -22,18 +22,27 @@ class QuotaRateLimitArgs:
22
22
  def __init__(__self__, *,
23
23
  rate: pulumi.Input[builtins.float],
24
24
  block_interval: Optional[pulumi.Input[builtins.int]] = None,
25
+ group_by: Optional[pulumi.Input[builtins.str]] = None,
25
26
  inheritable: Optional[pulumi.Input[builtins.bool]] = None,
26
27
  interval: Optional[pulumi.Input[builtins.int]] = None,
27
28
  name: Optional[pulumi.Input[builtins.str]] = None,
28
29
  namespace: Optional[pulumi.Input[builtins.str]] = None,
29
30
  path: Optional[pulumi.Input[builtins.str]] = None,
30
- role: Optional[pulumi.Input[builtins.str]] = None):
31
+ role: Optional[pulumi.Input[builtins.str]] = None,
32
+ secondary_rate: Optional[pulumi.Input[builtins.float]] = None):
31
33
  """
32
34
  The set of arguments for constructing a QuotaRateLimit resource.
33
35
  :param pulumi.Input[builtins.float] rate: The maximum number of requests at any given second to be allowed by the quota
34
36
  rule. The `rate` must be positive.
35
37
  :param pulumi.Input[builtins.int] block_interval: If set, when a client reaches a rate limit threshold, the client will
36
38
  be prohibited from any further requests until after the 'block_interval' in seconds has elapsed.
39
+ :param pulumi.Input[builtins.str] group_by: Attribute used to group requests for rate limiting. Limits are enforced independently for each
40
+ group. Valid `group_by` modes are: 1) `ip` that groups requests by their source IP address (**`group_by` defaults to
41
+ `ip` if unset, which is the only supported mode in community edition**); 2) `none` that groups together all requests
42
+ that match the rate limit quota rule; 3) `entity_then_ip` that groups requests by their entity ID for authenticated
43
+ requests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not
44
+ connected to an entity); and 4) `entity_then_none` which also groups requests by their entity ID when available, but
45
+ the rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).
37
46
  :param pulumi.Input[builtins.bool] inheritable: If set to `true` on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to `true` if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.
38
47
  :param pulumi.Input[builtins.int] interval: The duration in seconds to enforce rate limiting for.
39
48
  :param pulumi.Input[builtins.str] name: Name of the rate limit quota
@@ -48,10 +57,15 @@ class QuotaRateLimitArgs:
48
57
  `auth/userpass` to `namespace1/auth/userpass` moves this quota from being a global mount quota to
49
58
  a namespace specific mount quota. **Note, namespaces are supported in Enterprise only.**
50
59
  :param pulumi.Input[builtins.str] role: If set on a quota where `path` is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.
60
+ :param pulumi.Input[builtins.float] secondary_rate: Can only be set for the `group_by` modes `entity_then_ip` or `entity_then_none`. This is
61
+ the rate limit applied to the requests that fall under the "ip" or "none" groupings, while the authenticated requests
62
+ that contain an entity ID are subject to the `rate` field instead. Defaults to the same value as `rate`.
51
63
  """
52
64
  pulumi.set(__self__, "rate", rate)
53
65
  if block_interval is not None:
54
66
  pulumi.set(__self__, "block_interval", block_interval)
67
+ if group_by is not None:
68
+ pulumi.set(__self__, "group_by", group_by)
55
69
  if inheritable is not None:
56
70
  pulumi.set(__self__, "inheritable", inheritable)
57
71
  if interval is not None:
@@ -64,6 +78,8 @@ class QuotaRateLimitArgs:
64
78
  pulumi.set(__self__, "path", path)
65
79
  if role is not None:
66
80
  pulumi.set(__self__, "role", role)
81
+ if secondary_rate is not None:
82
+ pulumi.set(__self__, "secondary_rate", secondary_rate)
67
83
 
68
84
  @property
69
85
  @pulumi.getter
@@ -91,6 +107,24 @@ class QuotaRateLimitArgs:
91
107
  def block_interval(self, value: Optional[pulumi.Input[builtins.int]]):
92
108
  pulumi.set(self, "block_interval", value)
93
109
 
110
+ @property
111
+ @pulumi.getter(name="groupBy")
112
+ def group_by(self) -> Optional[pulumi.Input[builtins.str]]:
113
+ """
114
+ Attribute used to group requests for rate limiting. Limits are enforced independently for each
115
+ group. Valid `group_by` modes are: 1) `ip` that groups requests by their source IP address (**`group_by` defaults to
116
+ `ip` if unset, which is the only supported mode in community edition**); 2) `none` that groups together all requests
117
+ that match the rate limit quota rule; 3) `entity_then_ip` that groups requests by their entity ID for authenticated
118
+ requests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not
119
+ connected to an entity); and 4) `entity_then_none` which also groups requests by their entity ID when available, but
120
+ the rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).
121
+ """
122
+ return pulumi.get(self, "group_by")
123
+
124
+ @group_by.setter
125
+ def group_by(self, value: Optional[pulumi.Input[builtins.str]]):
126
+ pulumi.set(self, "group_by", value)
127
+
94
128
  @property
95
129
  @pulumi.getter
96
130
  def inheritable(self) -> Optional[pulumi.Input[builtins.bool]]:
@@ -171,22 +205,45 @@ class QuotaRateLimitArgs:
171
205
  def role(self, value: Optional[pulumi.Input[builtins.str]]):
172
206
  pulumi.set(self, "role", value)
173
207
 
208
+ @property
209
+ @pulumi.getter(name="secondaryRate")
210
+ def secondary_rate(self) -> Optional[pulumi.Input[builtins.float]]:
211
+ """
212
+ Can only be set for the `group_by` modes `entity_then_ip` or `entity_then_none`. This is
213
+ the rate limit applied to the requests that fall under the "ip" or "none" groupings, while the authenticated requests
214
+ that contain an entity ID are subject to the `rate` field instead. Defaults to the same value as `rate`.
215
+ """
216
+ return pulumi.get(self, "secondary_rate")
217
+
218
+ @secondary_rate.setter
219
+ def secondary_rate(self, value: Optional[pulumi.Input[builtins.float]]):
220
+ pulumi.set(self, "secondary_rate", value)
221
+
174
222
 
175
223
  @pulumi.input_type
176
224
  class _QuotaRateLimitState:
177
225
  def __init__(__self__, *,
178
226
  block_interval: Optional[pulumi.Input[builtins.int]] = None,
227
+ group_by: Optional[pulumi.Input[builtins.str]] = None,
179
228
  inheritable: Optional[pulumi.Input[builtins.bool]] = None,
180
229
  interval: Optional[pulumi.Input[builtins.int]] = None,
181
230
  name: Optional[pulumi.Input[builtins.str]] = None,
182
231
  namespace: Optional[pulumi.Input[builtins.str]] = None,
183
232
  path: Optional[pulumi.Input[builtins.str]] = None,
184
233
  rate: Optional[pulumi.Input[builtins.float]] = None,
185
- role: Optional[pulumi.Input[builtins.str]] = None):
234
+ role: Optional[pulumi.Input[builtins.str]] = None,
235
+ secondary_rate: Optional[pulumi.Input[builtins.float]] = None):
186
236
  """
187
237
  Input properties used for looking up and filtering QuotaRateLimit resources.
188
238
  :param pulumi.Input[builtins.int] block_interval: If set, when a client reaches a rate limit threshold, the client will
189
239
  be prohibited from any further requests until after the 'block_interval' in seconds has elapsed.
240
+ :param pulumi.Input[builtins.str] group_by: Attribute used to group requests for rate limiting. Limits are enforced independently for each
241
+ group. Valid `group_by` modes are: 1) `ip` that groups requests by their source IP address (**`group_by` defaults to
242
+ `ip` if unset, which is the only supported mode in community edition**); 2) `none` that groups together all requests
243
+ that match the rate limit quota rule; 3) `entity_then_ip` that groups requests by their entity ID for authenticated
244
+ requests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not
245
+ connected to an entity); and 4) `entity_then_none` which also groups requests by their entity ID when available, but
246
+ the rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).
190
247
  :param pulumi.Input[builtins.bool] inheritable: If set to `true` on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to `true` if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.
191
248
  :param pulumi.Input[builtins.int] interval: The duration in seconds to enforce rate limiting for.
192
249
  :param pulumi.Input[builtins.str] name: Name of the rate limit quota
@@ -203,9 +260,14 @@ class _QuotaRateLimitState:
203
260
  :param pulumi.Input[builtins.float] rate: The maximum number of requests at any given second to be allowed by the quota
204
261
  rule. The `rate` must be positive.
205
262
  :param pulumi.Input[builtins.str] role: If set on a quota where `path` is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.
263
+ :param pulumi.Input[builtins.float] secondary_rate: Can only be set for the `group_by` modes `entity_then_ip` or `entity_then_none`. This is
264
+ the rate limit applied to the requests that fall under the "ip" or "none" groupings, while the authenticated requests
265
+ that contain an entity ID are subject to the `rate` field instead. Defaults to the same value as `rate`.
206
266
  """
207
267
  if block_interval is not None:
208
268
  pulumi.set(__self__, "block_interval", block_interval)
269
+ if group_by is not None:
270
+ pulumi.set(__self__, "group_by", group_by)
209
271
  if inheritable is not None:
210
272
  pulumi.set(__self__, "inheritable", inheritable)
211
273
  if interval is not None:
@@ -220,6 +282,8 @@ class _QuotaRateLimitState:
220
282
  pulumi.set(__self__, "rate", rate)
221
283
  if role is not None:
222
284
  pulumi.set(__self__, "role", role)
285
+ if secondary_rate is not None:
286
+ pulumi.set(__self__, "secondary_rate", secondary_rate)
223
287
 
224
288
  @property
225
289
  @pulumi.getter(name="blockInterval")
@@ -234,6 +298,24 @@ class _QuotaRateLimitState:
234
298
  def block_interval(self, value: Optional[pulumi.Input[builtins.int]]):
235
299
  pulumi.set(self, "block_interval", value)
236
300
 
301
+ @property
302
+ @pulumi.getter(name="groupBy")
303
+ def group_by(self) -> Optional[pulumi.Input[builtins.str]]:
304
+ """
305
+ Attribute used to group requests for rate limiting. Limits are enforced independently for each
306
+ group. Valid `group_by` modes are: 1) `ip` that groups requests by their source IP address (**`group_by` defaults to
307
+ `ip` if unset, which is the only supported mode in community edition**); 2) `none` that groups together all requests
308
+ that match the rate limit quota rule; 3) `entity_then_ip` that groups requests by their entity ID for authenticated
309
+ requests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not
310
+ connected to an entity); and 4) `entity_then_none` which also groups requests by their entity ID when available, but
311
+ the rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).
312
+ """
313
+ return pulumi.get(self, "group_by")
314
+
315
+ @group_by.setter
316
+ def group_by(self, value: Optional[pulumi.Input[builtins.str]]):
317
+ pulumi.set(self, "group_by", value)
318
+
237
319
  @property
238
320
  @pulumi.getter
239
321
  def inheritable(self) -> Optional[pulumi.Input[builtins.bool]]:
@@ -327,6 +409,20 @@ class _QuotaRateLimitState:
327
409
  def role(self, value: Optional[pulumi.Input[builtins.str]]):
328
410
  pulumi.set(self, "role", value)
329
411
 
412
+ @property
413
+ @pulumi.getter(name="secondaryRate")
414
+ def secondary_rate(self) -> Optional[pulumi.Input[builtins.float]]:
415
+ """
416
+ Can only be set for the `group_by` modes `entity_then_ip` or `entity_then_none`. This is
417
+ the rate limit applied to the requests that fall under the "ip" or "none" groupings, while the authenticated requests
418
+ that contain an entity ID are subject to the `rate` field instead. Defaults to the same value as `rate`.
419
+ """
420
+ return pulumi.get(self, "secondary_rate")
421
+
422
+ @secondary_rate.setter
423
+ def secondary_rate(self, value: Optional[pulumi.Input[builtins.float]]):
424
+ pulumi.set(self, "secondary_rate", value)
425
+
330
426
 
331
427
  @pulumi.type_token("vault:index/quotaRateLimit:QuotaRateLimit")
332
428
  class QuotaRateLimit(pulumi.CustomResource):
@@ -335,6 +431,7 @@ class QuotaRateLimit(pulumi.CustomResource):
335
431
  resource_name: str,
336
432
  opts: Optional[pulumi.ResourceOptions] = None,
337
433
  block_interval: Optional[pulumi.Input[builtins.int]] = None,
434
+ group_by: Optional[pulumi.Input[builtins.str]] = None,
338
435
  inheritable: Optional[pulumi.Input[builtins.bool]] = None,
339
436
  interval: Optional[pulumi.Input[builtins.int]] = None,
340
437
  name: Optional[pulumi.Input[builtins.str]] = None,
@@ -342,6 +439,7 @@ class QuotaRateLimit(pulumi.CustomResource):
342
439
  path: Optional[pulumi.Input[builtins.str]] = None,
343
440
  rate: Optional[pulumi.Input[builtins.float]] = None,
344
441
  role: Optional[pulumi.Input[builtins.str]] = None,
442
+ secondary_rate: Optional[pulumi.Input[builtins.float]] = None,
345
443
  __props__=None):
346
444
  """
347
445
  Manage rate limit quotas which enforce API rate limiting using a token bucket algorithm.
@@ -375,6 +473,13 @@ class QuotaRateLimit(pulumi.CustomResource):
375
473
  :param pulumi.ResourceOptions opts: Options for the resource.
376
474
  :param pulumi.Input[builtins.int] block_interval: If set, when a client reaches a rate limit threshold, the client will
377
475
  be prohibited from any further requests until after the 'block_interval' in seconds has elapsed.
476
+ :param pulumi.Input[builtins.str] group_by: Attribute used to group requests for rate limiting. Limits are enforced independently for each
477
+ group. Valid `group_by` modes are: 1) `ip` that groups requests by their source IP address (**`group_by` defaults to
478
+ `ip` if unset, which is the only supported mode in community edition**); 2) `none` that groups together all requests
479
+ that match the rate limit quota rule; 3) `entity_then_ip` that groups requests by their entity ID for authenticated
480
+ requests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not
481
+ connected to an entity); and 4) `entity_then_none` which also groups requests by their entity ID when available, but
482
+ the rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).
378
483
  :param pulumi.Input[builtins.bool] inheritable: If set to `true` on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to `true` if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.
379
484
  :param pulumi.Input[builtins.int] interval: The duration in seconds to enforce rate limiting for.
380
485
  :param pulumi.Input[builtins.str] name: Name of the rate limit quota
@@ -391,6 +496,9 @@ class QuotaRateLimit(pulumi.CustomResource):
391
496
  :param pulumi.Input[builtins.float] rate: The maximum number of requests at any given second to be allowed by the quota
392
497
  rule. The `rate` must be positive.
393
498
  :param pulumi.Input[builtins.str] role: If set on a quota where `path` is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.
499
+ :param pulumi.Input[builtins.float] secondary_rate: Can only be set for the `group_by` modes `entity_then_ip` or `entity_then_none`. This is
500
+ the rate limit applied to the requests that fall under the "ip" or "none" groupings, while the authenticated requests
501
+ that contain an entity ID are subject to the `rate` field instead. Defaults to the same value as `rate`.
394
502
  """
395
503
  ...
396
504
  @overload
@@ -442,6 +550,7 @@ class QuotaRateLimit(pulumi.CustomResource):
442
550
  resource_name: str,
443
551
  opts: Optional[pulumi.ResourceOptions] = None,
444
552
  block_interval: Optional[pulumi.Input[builtins.int]] = None,
553
+ group_by: Optional[pulumi.Input[builtins.str]] = None,
445
554
  inheritable: Optional[pulumi.Input[builtins.bool]] = None,
446
555
  interval: Optional[pulumi.Input[builtins.int]] = None,
447
556
  name: Optional[pulumi.Input[builtins.str]] = None,
@@ -449,6 +558,7 @@ class QuotaRateLimit(pulumi.CustomResource):
449
558
  path: Optional[pulumi.Input[builtins.str]] = None,
450
559
  rate: Optional[pulumi.Input[builtins.float]] = None,
451
560
  role: Optional[pulumi.Input[builtins.str]] = None,
561
+ secondary_rate: Optional[pulumi.Input[builtins.float]] = None,
452
562
  __props__=None):
453
563
  opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
454
564
  if not isinstance(opts, pulumi.ResourceOptions):
@@ -459,6 +569,7 @@ class QuotaRateLimit(pulumi.CustomResource):
459
569
  __props__ = QuotaRateLimitArgs.__new__(QuotaRateLimitArgs)
460
570
 
461
571
  __props__.__dict__["block_interval"] = block_interval
572
+ __props__.__dict__["group_by"] = group_by
462
573
  __props__.__dict__["inheritable"] = inheritable
463
574
  __props__.__dict__["interval"] = interval
464
575
  __props__.__dict__["name"] = name
@@ -468,6 +579,7 @@ class QuotaRateLimit(pulumi.CustomResource):
468
579
  raise TypeError("Missing required property 'rate'")
469
580
  __props__.__dict__["rate"] = rate
470
581
  __props__.__dict__["role"] = role
582
+ __props__.__dict__["secondary_rate"] = secondary_rate
471
583
  super(QuotaRateLimit, __self__).__init__(
472
584
  'vault:index/quotaRateLimit:QuotaRateLimit',
473
585
  resource_name,
@@ -479,13 +591,15 @@ class QuotaRateLimit(pulumi.CustomResource):
479
591
  id: pulumi.Input[str],
480
592
  opts: Optional[pulumi.ResourceOptions] = None,
481
593
  block_interval: Optional[pulumi.Input[builtins.int]] = None,
594
+ group_by: Optional[pulumi.Input[builtins.str]] = None,
482
595
  inheritable: Optional[pulumi.Input[builtins.bool]] = None,
483
596
  interval: Optional[pulumi.Input[builtins.int]] = None,
484
597
  name: Optional[pulumi.Input[builtins.str]] = None,
485
598
  namespace: Optional[pulumi.Input[builtins.str]] = None,
486
599
  path: Optional[pulumi.Input[builtins.str]] = None,
487
600
  rate: Optional[pulumi.Input[builtins.float]] = None,
488
- role: Optional[pulumi.Input[builtins.str]] = None) -> 'QuotaRateLimit':
601
+ role: Optional[pulumi.Input[builtins.str]] = None,
602
+ secondary_rate: Optional[pulumi.Input[builtins.float]] = None) -> 'QuotaRateLimit':
489
603
  """
490
604
  Get an existing QuotaRateLimit resource's state with the given name, id, and optional extra
491
605
  properties used to qualify the lookup.
@@ -495,6 +609,13 @@ class QuotaRateLimit(pulumi.CustomResource):
495
609
  :param pulumi.ResourceOptions opts: Options for the resource.
496
610
  :param pulumi.Input[builtins.int] block_interval: If set, when a client reaches a rate limit threshold, the client will
497
611
  be prohibited from any further requests until after the 'block_interval' in seconds has elapsed.
612
+ :param pulumi.Input[builtins.str] group_by: Attribute used to group requests for rate limiting. Limits are enforced independently for each
613
+ group. Valid `group_by` modes are: 1) `ip` that groups requests by their source IP address (**`group_by` defaults to
614
+ `ip` if unset, which is the only supported mode in community edition**); 2) `none` that groups together all requests
615
+ that match the rate limit quota rule; 3) `entity_then_ip` that groups requests by their entity ID for authenticated
616
+ requests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not
617
+ connected to an entity); and 4) `entity_then_none` which also groups requests by their entity ID when available, but
618
+ the rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).
498
619
  :param pulumi.Input[builtins.bool] inheritable: If set to `true` on a quota where path is set to a namespace, the same quota will be cumulatively applied to all child namespace. The inheritable parameter cannot be set to `true` if the path does not specify a namespace. Only the quotas associated with the root namespace are inheritable by default. Requires Vault 1.15+.
499
620
  :param pulumi.Input[builtins.int] interval: The duration in seconds to enforce rate limiting for.
500
621
  :param pulumi.Input[builtins.str] name: Name of the rate limit quota
@@ -511,12 +632,16 @@ class QuotaRateLimit(pulumi.CustomResource):
511
632
  :param pulumi.Input[builtins.float] rate: The maximum number of requests at any given second to be allowed by the quota
512
633
  rule. The `rate` must be positive.
513
634
  :param pulumi.Input[builtins.str] role: If set on a quota where `path` is set to an auth mount with a concept of roles (such as /auth/approle/), this will make the quota restrict login requests to that mount that are made with the specified role.
635
+ :param pulumi.Input[builtins.float] secondary_rate: Can only be set for the `group_by` modes `entity_then_ip` or `entity_then_none`. This is
636
+ the rate limit applied to the requests that fall under the "ip" or "none" groupings, while the authenticated requests
637
+ that contain an entity ID are subject to the `rate` field instead. Defaults to the same value as `rate`.
514
638
  """
515
639
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
516
640
 
517
641
  __props__ = _QuotaRateLimitState.__new__(_QuotaRateLimitState)
518
642
 
519
643
  __props__.__dict__["block_interval"] = block_interval
644
+ __props__.__dict__["group_by"] = group_by
520
645
  __props__.__dict__["inheritable"] = inheritable
521
646
  __props__.__dict__["interval"] = interval
522
647
  __props__.__dict__["name"] = name
@@ -524,6 +649,7 @@ class QuotaRateLimit(pulumi.CustomResource):
524
649
  __props__.__dict__["path"] = path
525
650
  __props__.__dict__["rate"] = rate
526
651
  __props__.__dict__["role"] = role
652
+ __props__.__dict__["secondary_rate"] = secondary_rate
527
653
  return QuotaRateLimit(resource_name, opts=opts, __props__=__props__)
528
654
 
529
655
  @property
@@ -535,6 +661,20 @@ class QuotaRateLimit(pulumi.CustomResource):
535
661
  """
536
662
  return pulumi.get(self, "block_interval")
537
663
 
664
+ @property
665
+ @pulumi.getter(name="groupBy")
666
+ def group_by(self) -> pulumi.Output[builtins.str]:
667
+ """
668
+ Attribute used to group requests for rate limiting. Limits are enforced independently for each
669
+ group. Valid `group_by` modes are: 1) `ip` that groups requests by their source IP address (**`group_by` defaults to
670
+ `ip` if unset, which is the only supported mode in community edition**); 2) `none` that groups together all requests
671
+ that match the rate limit quota rule; 3) `entity_then_ip` that groups requests by their entity ID for authenticated
672
+ requests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not
673
+ connected to an entity); and 4) `entity_then_none` which also groups requests by their entity ID when available, but
674
+ the rest is all grouped together (i.e. unauthenticated or with authentication not connected to an entity).
675
+ """
676
+ return pulumi.get(self, "group_by")
677
+
538
678
  @property
539
679
  @pulumi.getter
540
680
  def inheritable(self) -> pulumi.Output[Optional[builtins.bool]]:
@@ -600,3 +740,13 @@ class QuotaRateLimit(pulumi.CustomResource):
600
740
  """
601
741
  return pulumi.get(self, "role")
602
742
 
743
+ @property
744
+ @pulumi.getter(name="secondaryRate")
745
+ def secondary_rate(self) -> pulumi.Output[builtins.float]:
746
+ """
747
+ Can only be set for the `group_by` modes `entity_then_ip` or `entity_then_none`. This is
748
+ the rate limit applied to the requests that fall under the "ip" or "none" groupings, while the authenticated requests
749
+ that contain an entity ID are subject to the `rate` field instead. Defaults to the same value as `rate`.
750
+ """
751
+ return pulumi.get(self, "secondary_rate")
752
+