pulumi-vault 7.1.0__py3-none-any.whl → 7.2.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +19 -1
- pulumi_vault/_inputs.py +873 -673
- pulumi_vault/ad/__init__.py +1 -1
- pulumi_vault/ad/get_access_credentials.py +27 -28
- pulumi_vault/ad/secret_backend.py +579 -580
- pulumi_vault/ad/secret_library.py +120 -121
- pulumi_vault/ad/secret_role.py +104 -105
- pulumi_vault/alicloud/__init__.py +1 -1
- pulumi_vault/alicloud/auth_backend_role.py +222 -223
- pulumi_vault/approle/__init__.py +1 -1
- pulumi_vault/approle/auth_backend_login.py +138 -139
- pulumi_vault/approle/auth_backend_role.py +292 -293
- pulumi_vault/approle/auth_backend_role_secret_id.py +202 -203
- pulumi_vault/approle/get_auth_backend_role_id.py +23 -24
- pulumi_vault/audit.py +103 -104
- pulumi_vault/audit_request_header.py +52 -53
- pulumi_vault/auth_backend.py +132 -133
- pulumi_vault/aws/__init__.py +1 -1
- pulumi_vault/aws/auth_backend_cert.py +86 -87
- pulumi_vault/aws/auth_backend_client.py +307 -308
- pulumi_vault/aws/auth_backend_config_identity.py +103 -104
- pulumi_vault/aws/auth_backend_identity_whitelist.py +69 -70
- pulumi_vault/aws/auth_backend_login.py +258 -259
- pulumi_vault/aws/auth_backend_role.py +486 -487
- pulumi_vault/aws/auth_backend_role_tag.py +155 -156
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +69 -70
- pulumi_vault/aws/auth_backend_sts_role.py +86 -87
- pulumi_vault/aws/get_access_credentials.py +59 -60
- pulumi_vault/aws/get_static_access_credentials.py +19 -20
- pulumi_vault/aws/secret_backend.py +1016 -439
- pulumi_vault/aws/secret_backend_role.py +256 -257
- pulumi_vault/aws/secret_backend_static_role.py +137 -138
- pulumi_vault/azure/__init__.py +1 -1
- pulumi_vault/azure/_inputs.py +26 -27
- pulumi_vault/azure/auth_backend_config.py +222 -223
- pulumi_vault/azure/auth_backend_role.py +307 -308
- pulumi_vault/azure/backend.py +1057 -285
- pulumi_vault/azure/backend_role.py +194 -195
- pulumi_vault/azure/get_access_credentials.py +75 -76
- pulumi_vault/azure/outputs.py +16 -17
- pulumi_vault/cert_auth_backend_role.py +443 -444
- pulumi_vault/config/__init__.py +1 -1
- pulumi_vault/config/__init__.pyi +1 -2
- pulumi_vault/config/_inputs.py +13 -14
- pulumi_vault/config/outputs.py +380 -381
- pulumi_vault/config/ui_custom_message.py +140 -141
- pulumi_vault/config/vars.py +31 -32
- pulumi_vault/consul/__init__.py +1 -1
- pulumi_vault/consul/secret_backend.py +887 -256
- pulumi_vault/consul/secret_backend_role.py +222 -223
- pulumi_vault/database/__init__.py +1 -1
- pulumi_vault/database/_inputs.py +3167 -3168
- pulumi_vault/database/outputs.py +2123 -2124
- pulumi_vault/database/secret_backend_connection.py +259 -260
- pulumi_vault/database/secret_backend_role.py +205 -206
- pulumi_vault/database/secret_backend_static_role.py +218 -219
- pulumi_vault/database/secrets_mount.py +426 -380
- pulumi_vault/egp_policy.py +86 -87
- pulumi_vault/gcp/__init__.py +1 -1
- pulumi_vault/gcp/_inputs.py +98 -99
- pulumi_vault/gcp/auth_backend.py +322 -323
- pulumi_vault/gcp/auth_backend_role.py +347 -348
- pulumi_vault/gcp/get_auth_backend_role.py +91 -92
- pulumi_vault/gcp/outputs.py +66 -67
- pulumi_vault/gcp/secret_backend.py +878 -336
- pulumi_vault/gcp/secret_impersonated_account.py +112 -113
- pulumi_vault/gcp/secret_roleset.py +115 -116
- pulumi_vault/gcp/secret_static_account.py +115 -116
- pulumi_vault/generic/__init__.py +1 -1
- pulumi_vault/generic/endpoint.py +138 -139
- pulumi_vault/generic/get_secret.py +39 -40
- pulumi_vault/generic/secret.py +95 -96
- pulumi_vault/get_auth_backend.py +29 -30
- pulumi_vault/get_auth_backends.py +19 -20
- pulumi_vault/get_namespace.py +21 -22
- pulumi_vault/get_namespaces.py +19 -20
- pulumi_vault/get_nomad_access_token.py +25 -26
- pulumi_vault/get_policy_document.py +10 -11
- pulumi_vault/get_raft_autopilot_state.py +31 -32
- pulumi_vault/github/__init__.py +1 -1
- pulumi_vault/github/_inputs.py +50 -51
- pulumi_vault/github/auth_backend.py +285 -286
- pulumi_vault/github/outputs.py +34 -35
- pulumi_vault/github/team.py +69 -70
- pulumi_vault/github/user.py +69 -70
- pulumi_vault/identity/__init__.py +1 -1
- pulumi_vault/identity/entity.py +103 -104
- pulumi_vault/identity/entity_alias.py +86 -87
- pulumi_vault/identity/entity_policies.py +78 -79
- pulumi_vault/identity/get_entity.py +62 -63
- pulumi_vault/identity/get_group.py +75 -76
- pulumi_vault/identity/get_oidc_client_creds.py +19 -20
- pulumi_vault/identity/get_oidc_openid_config.py +39 -40
- pulumi_vault/identity/get_oidc_public_keys.py +17 -18
- pulumi_vault/identity/group.py +171 -172
- pulumi_vault/identity/group_alias.py +69 -70
- pulumi_vault/identity/group_member_entity_ids.py +69 -70
- pulumi_vault/identity/group_member_group_ids.py +69 -70
- pulumi_vault/identity/group_policies.py +78 -79
- pulumi_vault/identity/mfa_duo.py +183 -184
- pulumi_vault/identity/mfa_login_enforcement.py +147 -148
- pulumi_vault/identity/mfa_okta.py +166 -167
- pulumi_vault/identity/mfa_pingid.py +160 -161
- pulumi_vault/identity/mfa_totp.py +217 -218
- pulumi_vault/identity/oidc.py +35 -36
- pulumi_vault/identity/oidc_assignment.py +69 -70
- pulumi_vault/identity/oidc_client.py +155 -156
- pulumi_vault/identity/oidc_key.py +103 -104
- pulumi_vault/identity/oidc_key_allowed_client_id.py +52 -53
- pulumi_vault/identity/oidc_provider.py +112 -113
- pulumi_vault/identity/oidc_role.py +103 -104
- pulumi_vault/identity/oidc_scope.py +69 -70
- pulumi_vault/identity/outputs.py +42 -43
- pulumi_vault/jwt/__init__.py +1 -1
- pulumi_vault/jwt/_inputs.py +50 -51
- pulumi_vault/jwt/auth_backend.py +400 -354
- pulumi_vault/jwt/auth_backend_role.py +494 -495
- pulumi_vault/jwt/outputs.py +34 -35
- pulumi_vault/kmip/__init__.py +1 -1
- pulumi_vault/kmip/secret_backend.py +1006 -227
- pulumi_vault/kmip/secret_role.py +358 -359
- pulumi_vault/kmip/secret_scope.py +69 -70
- pulumi_vault/kubernetes/__init__.py +1 -1
- pulumi_vault/kubernetes/auth_backend_config.py +171 -172
- pulumi_vault/kubernetes/auth_backend_role.py +273 -274
- pulumi_vault/kubernetes/get_auth_backend_config.py +57 -58
- pulumi_vault/kubernetes/get_auth_backend_role.py +87 -88
- pulumi_vault/kubernetes/get_service_account_token.py +51 -52
- pulumi_vault/kubernetes/secret_backend.py +431 -385
- pulumi_vault/kubernetes/secret_backend_role.py +239 -240
- pulumi_vault/kv/__init__.py +1 -1
- pulumi_vault/kv/_inputs.py +25 -26
- pulumi_vault/kv/get_secret.py +25 -26
- pulumi_vault/kv/get_secret_subkeys_v2.py +39 -40
- pulumi_vault/kv/get_secret_v2.py +41 -42
- pulumi_vault/kv/get_secrets_list.py +17 -18
- pulumi_vault/kv/get_secrets_list_v2.py +25 -26
- pulumi_vault/kv/outputs.py +17 -18
- pulumi_vault/kv/secret.py +61 -62
- pulumi_vault/kv/secret_backend_v2.py +86 -87
- pulumi_vault/kv/secret_v2.py +184 -185
- pulumi_vault/ldap/__init__.py +1 -1
- pulumi_vault/ldap/auth_backend.py +716 -717
- pulumi_vault/ldap/auth_backend_group.py +69 -70
- pulumi_vault/ldap/auth_backend_user.py +86 -87
- pulumi_vault/ldap/get_dynamic_credentials.py +27 -28
- pulumi_vault/ldap/get_static_credentials.py +29 -30
- pulumi_vault/ldap/secret_backend.py +732 -693
- pulumi_vault/ldap/secret_backend_dynamic_role.py +154 -155
- pulumi_vault/ldap/secret_backend_library_set.py +120 -121
- pulumi_vault/ldap/secret_backend_static_role.py +120 -121
- pulumi_vault/managed/__init__.py +1 -1
- pulumi_vault/managed/_inputs.py +274 -275
- pulumi_vault/managed/keys.py +27 -28
- pulumi_vault/managed/outputs.py +184 -185
- pulumi_vault/mfa_duo.py +137 -138
- pulumi_vault/mfa_okta.py +137 -138
- pulumi_vault/mfa_pingid.py +149 -150
- pulumi_vault/mfa_totp.py +154 -155
- pulumi_vault/mongodbatlas/__init__.py +1 -1
- pulumi_vault/mongodbatlas/secret_backend.py +78 -79
- pulumi_vault/mongodbatlas/secret_role.py +188 -189
- pulumi_vault/mount.py +380 -334
- pulumi_vault/namespace.py +78 -79
- pulumi_vault/nomad_secret_backend.py +909 -271
- pulumi_vault/nomad_secret_role.py +103 -104
- pulumi_vault/oci_auth_backend.py +683 -0
- pulumi_vault/oci_auth_backend_role.py +798 -0
- pulumi_vault/okta/__init__.py +1 -1
- pulumi_vault/okta/_inputs.py +31 -32
- pulumi_vault/okta/auth_backend.py +305 -306
- pulumi_vault/okta/auth_backend_group.py +69 -70
- pulumi_vault/okta/auth_backend_user.py +86 -87
- pulumi_vault/okta/outputs.py +21 -22
- pulumi_vault/outputs.py +234 -82
- pulumi_vault/pkisecret/__init__.py +1 -1
- pulumi_vault/pkisecret/_inputs.py +55 -56
- pulumi_vault/pkisecret/backend_acme_eab.py +116 -117
- pulumi_vault/pkisecret/backend_config_acme.py +175 -176
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +394 -395
- pulumi_vault/pkisecret/backend_config_cluster.py +71 -72
- pulumi_vault/pkisecret/backend_config_cmpv2.py +132 -133
- pulumi_vault/pkisecret/backend_config_est.py +149 -150
- pulumi_vault/pkisecret/backend_config_scep.py +205 -159
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +37 -38
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +32 -33
- pulumi_vault/pkisecret/get_backend_config_est.py +30 -31
- pulumi_vault/pkisecret/get_backend_config_scep.py +50 -31
- pulumi_vault/pkisecret/get_backend_issuer.py +63 -64
- pulumi_vault/pkisecret/get_backend_issuers.py +23 -24
- pulumi_vault/pkisecret/get_backend_key.py +29 -30
- pulumi_vault/pkisecret/get_backend_keys.py +23 -24
- pulumi_vault/pkisecret/outputs.py +61 -62
- pulumi_vault/pkisecret/secret_backend_cert.py +415 -416
- pulumi_vault/pkisecret/secret_backend_config_ca.py +54 -55
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +75 -76
- pulumi_vault/pkisecret/secret_backend_config_urls.py +105 -106
- pulumi_vault/pkisecret/secret_backend_crl_config.py +241 -242
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +515 -516
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +78 -79
- pulumi_vault/pkisecret/secret_backend_issuer.py +286 -287
- pulumi_vault/pkisecret/secret_backend_key.py +146 -147
- pulumi_vault/pkisecret/secret_backend_role.py +873 -874
- pulumi_vault/pkisecret/secret_backend_root_cert.py +677 -678
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +660 -661
- pulumi_vault/pkisecret/secret_backend_sign.py +346 -347
- pulumi_vault/plugin.py +154 -155
- pulumi_vault/plugin_pinned_version.py +52 -53
- pulumi_vault/policy.py +52 -53
- pulumi_vault/provider.py +160 -161
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +103 -104
- pulumi_vault/quota_rate_limit.py +171 -172
- pulumi_vault/rabbitmq/__init__.py +1 -1
- pulumi_vault/rabbitmq/_inputs.py +50 -51
- pulumi_vault/rabbitmq/outputs.py +34 -35
- pulumi_vault/rabbitmq/secret_backend.py +902 -231
- pulumi_vault/rabbitmq/secret_backend_role.py +79 -80
- pulumi_vault/raft_autopilot.py +137 -138
- pulumi_vault/raft_snapshot_agent_config.py +477 -478
- pulumi_vault/rgp_policy.py +69 -70
- pulumi_vault/saml/__init__.py +1 -1
- pulumi_vault/saml/auth_backend.py +188 -189
- pulumi_vault/saml/auth_backend_role.py +290 -291
- pulumi_vault/scep_auth_backend_role.py +252 -253
- pulumi_vault/secrets/__init__.py +1 -1
- pulumi_vault/secrets/_inputs.py +19 -20
- pulumi_vault/secrets/outputs.py +13 -14
- pulumi_vault/secrets/sync_association.py +88 -89
- pulumi_vault/secrets/sync_aws_destination.py +180 -181
- pulumi_vault/secrets/sync_azure_destination.py +180 -181
- pulumi_vault/secrets/sync_config.py +52 -53
- pulumi_vault/secrets/sync_gcp_destination.py +129 -130
- pulumi_vault/secrets/sync_gh_destination.py +163 -164
- pulumi_vault/secrets/sync_github_apps.py +78 -79
- pulumi_vault/secrets/sync_vercel_destination.py +146 -147
- pulumi_vault/ssh/__init__.py +1 -1
- pulumi_vault/ssh/_inputs.py +13 -14
- pulumi_vault/ssh/get_secret_backend_sign.py +65 -66
- pulumi_vault/ssh/outputs.py +9 -10
- pulumi_vault/ssh/secret_backend_ca.py +217 -124
- pulumi_vault/ssh/secret_backend_role.py +446 -447
- pulumi_vault/terraformcloud/__init__.py +1 -1
- pulumi_vault/terraformcloud/secret_backend.py +833 -155
- pulumi_vault/terraformcloud/secret_creds.py +93 -94
- pulumi_vault/terraformcloud/secret_role.py +117 -118
- pulumi_vault/token.py +301 -302
- pulumi_vault/tokenauth/__init__.py +1 -1
- pulumi_vault/tokenauth/auth_backend_role.py +324 -325
- pulumi_vault/transform/__init__.py +1 -1
- pulumi_vault/transform/alphabet.py +69 -70
- pulumi_vault/transform/get_decode.py +57 -58
- pulumi_vault/transform/get_encode.py +57 -58
- pulumi_vault/transform/role.py +69 -70
- pulumi_vault/transform/template.py +137 -138
- pulumi_vault/transform/transformation.py +171 -172
- pulumi_vault/transit/__init__.py +1 -1
- pulumi_vault/transit/get_cmac.py +47 -48
- pulumi_vault/transit/get_decrypt.py +25 -26
- pulumi_vault/transit/get_encrypt.py +29 -30
- pulumi_vault/transit/get_sign.py +71 -72
- pulumi_vault/transit/get_verify.py +83 -84
- pulumi_vault/transit/secret_backend_key.py +377 -350
- pulumi_vault/transit/secret_cache_config.py +52 -53
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/METADATA +1 -1
- pulumi_vault-7.2.0.dist-info/RECORD +270 -0
- pulumi_vault-7.1.0.dist-info/RECORD +0 -268
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/top_level.txt +0 -0
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -20,64 +19,64 @@ __all__ = ['AuthBackendClientArgs', 'AuthBackendClient']
|
|
|
20
19
|
@pulumi.input_type
|
|
21
20
|
class AuthBackendClientArgs:
|
|
22
21
|
def __init__(__self__, *,
|
|
23
|
-
access_key: Optional[pulumi.Input[
|
|
24
|
-
backend: Optional[pulumi.Input[
|
|
25
|
-
disable_automated_rotation: Optional[pulumi.Input[
|
|
26
|
-
ec2_endpoint: Optional[pulumi.Input[
|
|
27
|
-
iam_endpoint: Optional[pulumi.Input[
|
|
28
|
-
iam_server_id_header_value: Optional[pulumi.Input[
|
|
29
|
-
identity_token_audience: Optional[pulumi.Input[
|
|
30
|
-
identity_token_ttl: Optional[pulumi.Input[
|
|
31
|
-
max_retries: Optional[pulumi.Input[
|
|
32
|
-
namespace: Optional[pulumi.Input[
|
|
33
|
-
role_arn: Optional[pulumi.Input[
|
|
34
|
-
rotation_period: Optional[pulumi.Input[
|
|
35
|
-
rotation_schedule: Optional[pulumi.Input[
|
|
36
|
-
rotation_window: Optional[pulumi.Input[
|
|
37
|
-
secret_key: Optional[pulumi.Input[
|
|
38
|
-
sts_endpoint: Optional[pulumi.Input[
|
|
39
|
-
sts_region: Optional[pulumi.Input[
|
|
40
|
-
use_sts_region_from_client: Optional[pulumi.Input[
|
|
22
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
23
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
24
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
25
|
+
ec2_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
26
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
27
|
+
iam_server_id_header_value: Optional[pulumi.Input[_builtins.str]] = None,
|
|
28
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
29
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
30
|
+
max_retries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
31
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
32
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
33
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
34
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
36
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
38
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
39
|
+
use_sts_region_from_client: Optional[pulumi.Input[_builtins.bool]] = None):
|
|
41
40
|
"""
|
|
42
41
|
The set of arguments for constructing a AuthBackendClient resource.
|
|
43
|
-
:param pulumi.Input[
|
|
42
|
+
:param pulumi.Input[_builtins.str] access_key: The AWS access key that Vault should use for the
|
|
44
43
|
auth backend. Mutually exclusive with `identity_token_audience`.
|
|
45
|
-
:param pulumi.Input[
|
|
44
|
+
:param pulumi.Input[_builtins.str] backend: The path the AWS auth backend being configured was
|
|
46
45
|
mounted at. Defaults to `aws`.
|
|
47
|
-
:param pulumi.Input[
|
|
48
|
-
:param pulumi.Input[
|
|
46
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
47
|
+
:param pulumi.Input[_builtins.str] ec2_endpoint: Override the URL Vault uses when making EC2 API
|
|
49
48
|
calls.
|
|
50
|
-
:param pulumi.Input[
|
|
49
|
+
:param pulumi.Input[_builtins.str] iam_endpoint: Override the URL Vault uses when making IAM API
|
|
51
50
|
calls.
|
|
52
|
-
:param pulumi.Input[
|
|
51
|
+
:param pulumi.Input[_builtins.str] iam_server_id_header_value: The value to require in the
|
|
53
52
|
`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
|
|
54
53
|
that are used in the IAM auth method.
|
|
55
|
-
:param pulumi.Input[
|
|
54
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Mutually exclusive with `access_key`.
|
|
56
55
|
Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
57
|
-
:param pulumi.Input[
|
|
56
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
58
57
|
*Available only for Vault Enterprise*
|
|
59
|
-
:param pulumi.Input[
|
|
58
|
+
:param pulumi.Input[_builtins.int] max_retries: Number of max retries the client should use for recoverable errors.
|
|
60
59
|
The default `-1` falls back to the AWS SDK's default behavior.
|
|
61
|
-
:param pulumi.Input[
|
|
60
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
62
61
|
The value should not contain leading or trailing forward slashes.
|
|
63
62
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
64
63
|
*Available only for Vault Enterprise*.
|
|
65
|
-
:param pulumi.Input[
|
|
64
|
+
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
66
65
|
*Available only for Vault Enterprise*
|
|
67
|
-
:param pulumi.Input[
|
|
66
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
68
67
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
69
|
-
:param pulumi.Input[
|
|
68
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
70
69
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
71
|
-
:param pulumi.Input[
|
|
70
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
72
71
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
73
72
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
74
|
-
:param pulumi.Input[
|
|
73
|
+
:param pulumi.Input[_builtins.str] secret_key: The AWS secret key that Vault should use for the
|
|
75
74
|
auth backend.
|
|
76
|
-
:param pulumi.Input[
|
|
75
|
+
:param pulumi.Input[_builtins.str] sts_endpoint: Override the URL Vault uses when making STS API
|
|
77
76
|
calls.
|
|
78
|
-
:param pulumi.Input[
|
|
77
|
+
:param pulumi.Input[_builtins.str] sts_region: Override the default region when making STS API
|
|
79
78
|
calls. The `sts_endpoint` argument must be set when using `sts_region`.
|
|
80
|
-
:param pulumi.Input[
|
|
79
|
+
:param pulumi.Input[_builtins.bool] use_sts_region_from_client: Available in Vault v1.15+. If set,
|
|
81
80
|
overrides both `sts_endpoint` and `sts_region` to instead use the region
|
|
82
81
|
specified in the client request headers for IAM-based authentication.
|
|
83
82
|
This can be useful when you have client requests coming from different
|
|
@@ -120,9 +119,9 @@ class AuthBackendClientArgs:
|
|
|
120
119
|
if use_sts_region_from_client is not None:
|
|
121
120
|
pulumi.set(__self__, "use_sts_region_from_client", use_sts_region_from_client)
|
|
122
121
|
|
|
123
|
-
@property
|
|
122
|
+
@_builtins.property
|
|
124
123
|
@pulumi.getter(name="accessKey")
|
|
125
|
-
def access_key(self) -> Optional[pulumi.Input[
|
|
124
|
+
def access_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
126
125
|
"""
|
|
127
126
|
The AWS access key that Vault should use for the
|
|
128
127
|
auth backend. Mutually exclusive with `identity_token_audience`.
|
|
@@ -130,12 +129,12 @@ class AuthBackendClientArgs:
|
|
|
130
129
|
return pulumi.get(self, "access_key")
|
|
131
130
|
|
|
132
131
|
@access_key.setter
|
|
133
|
-
def access_key(self, value: Optional[pulumi.Input[
|
|
132
|
+
def access_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
134
133
|
pulumi.set(self, "access_key", value)
|
|
135
134
|
|
|
136
|
-
@property
|
|
135
|
+
@_builtins.property
|
|
137
136
|
@pulumi.getter
|
|
138
|
-
def backend(self) -> Optional[pulumi.Input[
|
|
137
|
+
def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
139
138
|
"""
|
|
140
139
|
The path the AWS auth backend being configured was
|
|
141
140
|
mounted at. Defaults to `aws`.
|
|
@@ -143,24 +142,24 @@ class AuthBackendClientArgs:
|
|
|
143
142
|
return pulumi.get(self, "backend")
|
|
144
143
|
|
|
145
144
|
@backend.setter
|
|
146
|
-
def backend(self, value: Optional[pulumi.Input[
|
|
145
|
+
def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
147
146
|
pulumi.set(self, "backend", value)
|
|
148
147
|
|
|
149
|
-
@property
|
|
148
|
+
@_builtins.property
|
|
150
149
|
@pulumi.getter(name="disableAutomatedRotation")
|
|
151
|
-
def disable_automated_rotation(self) -> Optional[pulumi.Input[
|
|
150
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
152
151
|
"""
|
|
153
152
|
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
154
153
|
"""
|
|
155
154
|
return pulumi.get(self, "disable_automated_rotation")
|
|
156
155
|
|
|
157
156
|
@disable_automated_rotation.setter
|
|
158
|
-
def disable_automated_rotation(self, value: Optional[pulumi.Input[
|
|
157
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
159
158
|
pulumi.set(self, "disable_automated_rotation", value)
|
|
160
159
|
|
|
161
|
-
@property
|
|
160
|
+
@_builtins.property
|
|
162
161
|
@pulumi.getter(name="ec2Endpoint")
|
|
163
|
-
def ec2_endpoint(self) -> Optional[pulumi.Input[
|
|
162
|
+
def ec2_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
164
163
|
"""
|
|
165
164
|
Override the URL Vault uses when making EC2 API
|
|
166
165
|
calls.
|
|
@@ -168,12 +167,12 @@ class AuthBackendClientArgs:
|
|
|
168
167
|
return pulumi.get(self, "ec2_endpoint")
|
|
169
168
|
|
|
170
169
|
@ec2_endpoint.setter
|
|
171
|
-
def ec2_endpoint(self, value: Optional[pulumi.Input[
|
|
170
|
+
def ec2_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
172
171
|
pulumi.set(self, "ec2_endpoint", value)
|
|
173
172
|
|
|
174
|
-
@property
|
|
173
|
+
@_builtins.property
|
|
175
174
|
@pulumi.getter(name="iamEndpoint")
|
|
176
|
-
def iam_endpoint(self) -> Optional[pulumi.Input[
|
|
175
|
+
def iam_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
177
176
|
"""
|
|
178
177
|
Override the URL Vault uses when making IAM API
|
|
179
178
|
calls.
|
|
@@ -181,12 +180,12 @@ class AuthBackendClientArgs:
|
|
|
181
180
|
return pulumi.get(self, "iam_endpoint")
|
|
182
181
|
|
|
183
182
|
@iam_endpoint.setter
|
|
184
|
-
def iam_endpoint(self, value: Optional[pulumi.Input[
|
|
183
|
+
def iam_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
185
184
|
pulumi.set(self, "iam_endpoint", value)
|
|
186
185
|
|
|
187
|
-
@property
|
|
186
|
+
@_builtins.property
|
|
188
187
|
@pulumi.getter(name="iamServerIdHeaderValue")
|
|
189
|
-
def iam_server_id_header_value(self) -> Optional[pulumi.Input[
|
|
188
|
+
def iam_server_id_header_value(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
190
189
|
"""
|
|
191
190
|
The value to require in the
|
|
192
191
|
`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
|
|
@@ -195,12 +194,12 @@ class AuthBackendClientArgs:
|
|
|
195
194
|
return pulumi.get(self, "iam_server_id_header_value")
|
|
196
195
|
|
|
197
196
|
@iam_server_id_header_value.setter
|
|
198
|
-
def iam_server_id_header_value(self, value: Optional[pulumi.Input[
|
|
197
|
+
def iam_server_id_header_value(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
199
198
|
pulumi.set(self, "iam_server_id_header_value", value)
|
|
200
199
|
|
|
201
|
-
@property
|
|
200
|
+
@_builtins.property
|
|
202
201
|
@pulumi.getter(name="identityTokenAudience")
|
|
203
|
-
def identity_token_audience(self) -> Optional[pulumi.Input[
|
|
202
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
204
203
|
"""
|
|
205
204
|
The audience claim value. Mutually exclusive with `access_key`.
|
|
206
205
|
Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
@@ -208,12 +207,12 @@ class AuthBackendClientArgs:
|
|
|
208
207
|
return pulumi.get(self, "identity_token_audience")
|
|
209
208
|
|
|
210
209
|
@identity_token_audience.setter
|
|
211
|
-
def identity_token_audience(self, value: Optional[pulumi.Input[
|
|
210
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
212
211
|
pulumi.set(self, "identity_token_audience", value)
|
|
213
212
|
|
|
214
|
-
@property
|
|
213
|
+
@_builtins.property
|
|
215
214
|
@pulumi.getter(name="identityTokenTtl")
|
|
216
|
-
def identity_token_ttl(self) -> Optional[pulumi.Input[
|
|
215
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
217
216
|
"""
|
|
218
217
|
The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
219
218
|
*Available only for Vault Enterprise*
|
|
@@ -221,12 +220,12 @@ class AuthBackendClientArgs:
|
|
|
221
220
|
return pulumi.get(self, "identity_token_ttl")
|
|
222
221
|
|
|
223
222
|
@identity_token_ttl.setter
|
|
224
|
-
def identity_token_ttl(self, value: Optional[pulumi.Input[
|
|
223
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
225
224
|
pulumi.set(self, "identity_token_ttl", value)
|
|
226
225
|
|
|
227
|
-
@property
|
|
226
|
+
@_builtins.property
|
|
228
227
|
@pulumi.getter(name="maxRetries")
|
|
229
|
-
def max_retries(self) -> Optional[pulumi.Input[
|
|
228
|
+
def max_retries(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
230
229
|
"""
|
|
231
230
|
Number of max retries the client should use for recoverable errors.
|
|
232
231
|
The default `-1` falls back to the AWS SDK's default behavior.
|
|
@@ -234,12 +233,12 @@ class AuthBackendClientArgs:
|
|
|
234
233
|
return pulumi.get(self, "max_retries")
|
|
235
234
|
|
|
236
235
|
@max_retries.setter
|
|
237
|
-
def max_retries(self, value: Optional[pulumi.Input[
|
|
236
|
+
def max_retries(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
238
237
|
pulumi.set(self, "max_retries", value)
|
|
239
238
|
|
|
240
|
-
@property
|
|
239
|
+
@_builtins.property
|
|
241
240
|
@pulumi.getter
|
|
242
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
241
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
243
242
|
"""
|
|
244
243
|
The namespace to provision the resource in.
|
|
245
244
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -249,12 +248,12 @@ class AuthBackendClientArgs:
|
|
|
249
248
|
return pulumi.get(self, "namespace")
|
|
250
249
|
|
|
251
250
|
@namespace.setter
|
|
252
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
251
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
253
252
|
pulumi.set(self, "namespace", value)
|
|
254
253
|
|
|
255
|
-
@property
|
|
254
|
+
@_builtins.property
|
|
256
255
|
@pulumi.getter(name="roleArn")
|
|
257
|
-
def role_arn(self) -> Optional[pulumi.Input[
|
|
256
|
+
def role_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
258
257
|
"""
|
|
259
258
|
Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
260
259
|
*Available only for Vault Enterprise*
|
|
@@ -262,12 +261,12 @@ class AuthBackendClientArgs:
|
|
|
262
261
|
return pulumi.get(self, "role_arn")
|
|
263
262
|
|
|
264
263
|
@role_arn.setter
|
|
265
|
-
def role_arn(self, value: Optional[pulumi.Input[
|
|
264
|
+
def role_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
266
265
|
pulumi.set(self, "role_arn", value)
|
|
267
266
|
|
|
268
|
-
@property
|
|
267
|
+
@_builtins.property
|
|
269
268
|
@pulumi.getter(name="rotationPeriod")
|
|
270
|
-
def rotation_period(self) -> Optional[pulumi.Input[
|
|
269
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
271
270
|
"""
|
|
272
271
|
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
273
272
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
@@ -275,12 +274,12 @@ class AuthBackendClientArgs:
|
|
|
275
274
|
return pulumi.get(self, "rotation_period")
|
|
276
275
|
|
|
277
276
|
@rotation_period.setter
|
|
278
|
-
def rotation_period(self, value: Optional[pulumi.Input[
|
|
277
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
279
278
|
pulumi.set(self, "rotation_period", value)
|
|
280
279
|
|
|
281
|
-
@property
|
|
280
|
+
@_builtins.property
|
|
282
281
|
@pulumi.getter(name="rotationSchedule")
|
|
283
|
-
def rotation_schedule(self) -> Optional[pulumi.Input[
|
|
282
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
284
283
|
"""
|
|
285
284
|
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
286
285
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
@@ -288,12 +287,12 @@ class AuthBackendClientArgs:
|
|
|
288
287
|
return pulumi.get(self, "rotation_schedule")
|
|
289
288
|
|
|
290
289
|
@rotation_schedule.setter
|
|
291
|
-
def rotation_schedule(self, value: Optional[pulumi.Input[
|
|
290
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
292
291
|
pulumi.set(self, "rotation_schedule", value)
|
|
293
292
|
|
|
294
|
-
@property
|
|
293
|
+
@_builtins.property
|
|
295
294
|
@pulumi.getter(name="rotationWindow")
|
|
296
|
-
def rotation_window(self) -> Optional[pulumi.Input[
|
|
295
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
297
296
|
"""
|
|
298
297
|
The maximum amount of time in seconds allowed to complete
|
|
299
298
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
@@ -302,12 +301,12 @@ class AuthBackendClientArgs:
|
|
|
302
301
|
return pulumi.get(self, "rotation_window")
|
|
303
302
|
|
|
304
303
|
@rotation_window.setter
|
|
305
|
-
def rotation_window(self, value: Optional[pulumi.Input[
|
|
304
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
306
305
|
pulumi.set(self, "rotation_window", value)
|
|
307
306
|
|
|
308
|
-
@property
|
|
307
|
+
@_builtins.property
|
|
309
308
|
@pulumi.getter(name="secretKey")
|
|
310
|
-
def secret_key(self) -> Optional[pulumi.Input[
|
|
309
|
+
def secret_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
311
310
|
"""
|
|
312
311
|
The AWS secret key that Vault should use for the
|
|
313
312
|
auth backend.
|
|
@@ -315,12 +314,12 @@ class AuthBackendClientArgs:
|
|
|
315
314
|
return pulumi.get(self, "secret_key")
|
|
316
315
|
|
|
317
316
|
@secret_key.setter
|
|
318
|
-
def secret_key(self, value: Optional[pulumi.Input[
|
|
317
|
+
def secret_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
319
318
|
pulumi.set(self, "secret_key", value)
|
|
320
319
|
|
|
321
|
-
@property
|
|
320
|
+
@_builtins.property
|
|
322
321
|
@pulumi.getter(name="stsEndpoint")
|
|
323
|
-
def sts_endpoint(self) -> Optional[pulumi.Input[
|
|
322
|
+
def sts_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
324
323
|
"""
|
|
325
324
|
Override the URL Vault uses when making STS API
|
|
326
325
|
calls.
|
|
@@ -328,12 +327,12 @@ class AuthBackendClientArgs:
|
|
|
328
327
|
return pulumi.get(self, "sts_endpoint")
|
|
329
328
|
|
|
330
329
|
@sts_endpoint.setter
|
|
331
|
-
def sts_endpoint(self, value: Optional[pulumi.Input[
|
|
330
|
+
def sts_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
332
331
|
pulumi.set(self, "sts_endpoint", value)
|
|
333
332
|
|
|
334
|
-
@property
|
|
333
|
+
@_builtins.property
|
|
335
334
|
@pulumi.getter(name="stsRegion")
|
|
336
|
-
def sts_region(self) -> Optional[pulumi.Input[
|
|
335
|
+
def sts_region(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
337
336
|
"""
|
|
338
337
|
Override the default region when making STS API
|
|
339
338
|
calls. The `sts_endpoint` argument must be set when using `sts_region`.
|
|
@@ -341,12 +340,12 @@ class AuthBackendClientArgs:
|
|
|
341
340
|
return pulumi.get(self, "sts_region")
|
|
342
341
|
|
|
343
342
|
@sts_region.setter
|
|
344
|
-
def sts_region(self, value: Optional[pulumi.Input[
|
|
343
|
+
def sts_region(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
345
344
|
pulumi.set(self, "sts_region", value)
|
|
346
345
|
|
|
347
|
-
@property
|
|
346
|
+
@_builtins.property
|
|
348
347
|
@pulumi.getter(name="useStsRegionFromClient")
|
|
349
|
-
def use_sts_region_from_client(self) -> Optional[pulumi.Input[
|
|
348
|
+
def use_sts_region_from_client(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
350
349
|
"""
|
|
351
350
|
Available in Vault v1.15+. If set,
|
|
352
351
|
overrides both `sts_endpoint` and `sts_region` to instead use the region
|
|
@@ -357,71 +356,71 @@ class AuthBackendClientArgs:
|
|
|
357
356
|
return pulumi.get(self, "use_sts_region_from_client")
|
|
358
357
|
|
|
359
358
|
@use_sts_region_from_client.setter
|
|
360
|
-
def use_sts_region_from_client(self, value: Optional[pulumi.Input[
|
|
359
|
+
def use_sts_region_from_client(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
361
360
|
pulumi.set(self, "use_sts_region_from_client", value)
|
|
362
361
|
|
|
363
362
|
|
|
364
363
|
@pulumi.input_type
|
|
365
364
|
class _AuthBackendClientState:
|
|
366
365
|
def __init__(__self__, *,
|
|
367
|
-
access_key: Optional[pulumi.Input[
|
|
368
|
-
backend: Optional[pulumi.Input[
|
|
369
|
-
disable_automated_rotation: Optional[pulumi.Input[
|
|
370
|
-
ec2_endpoint: Optional[pulumi.Input[
|
|
371
|
-
iam_endpoint: Optional[pulumi.Input[
|
|
372
|
-
iam_server_id_header_value: Optional[pulumi.Input[
|
|
373
|
-
identity_token_audience: Optional[pulumi.Input[
|
|
374
|
-
identity_token_ttl: Optional[pulumi.Input[
|
|
375
|
-
max_retries: Optional[pulumi.Input[
|
|
376
|
-
namespace: Optional[pulumi.Input[
|
|
377
|
-
role_arn: Optional[pulumi.Input[
|
|
378
|
-
rotation_period: Optional[pulumi.Input[
|
|
379
|
-
rotation_schedule: Optional[pulumi.Input[
|
|
380
|
-
rotation_window: Optional[pulumi.Input[
|
|
381
|
-
secret_key: Optional[pulumi.Input[
|
|
382
|
-
sts_endpoint: Optional[pulumi.Input[
|
|
383
|
-
sts_region: Optional[pulumi.Input[
|
|
384
|
-
use_sts_region_from_client: Optional[pulumi.Input[
|
|
366
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
367
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
368
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
369
|
+
ec2_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
370
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
371
|
+
iam_server_id_header_value: Optional[pulumi.Input[_builtins.str]] = None,
|
|
372
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
373
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
374
|
+
max_retries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
375
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
376
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
377
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
378
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
379
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
380
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
381
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
382
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
383
|
+
use_sts_region_from_client: Optional[pulumi.Input[_builtins.bool]] = None):
|
|
385
384
|
"""
|
|
386
385
|
Input properties used for looking up and filtering AuthBackendClient resources.
|
|
387
|
-
:param pulumi.Input[
|
|
386
|
+
:param pulumi.Input[_builtins.str] access_key: The AWS access key that Vault should use for the
|
|
388
387
|
auth backend. Mutually exclusive with `identity_token_audience`.
|
|
389
|
-
:param pulumi.Input[
|
|
388
|
+
:param pulumi.Input[_builtins.str] backend: The path the AWS auth backend being configured was
|
|
390
389
|
mounted at. Defaults to `aws`.
|
|
391
|
-
:param pulumi.Input[
|
|
392
|
-
:param pulumi.Input[
|
|
390
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
391
|
+
:param pulumi.Input[_builtins.str] ec2_endpoint: Override the URL Vault uses when making EC2 API
|
|
393
392
|
calls.
|
|
394
|
-
:param pulumi.Input[
|
|
393
|
+
:param pulumi.Input[_builtins.str] iam_endpoint: Override the URL Vault uses when making IAM API
|
|
395
394
|
calls.
|
|
396
|
-
:param pulumi.Input[
|
|
395
|
+
:param pulumi.Input[_builtins.str] iam_server_id_header_value: The value to require in the
|
|
397
396
|
`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
|
|
398
397
|
that are used in the IAM auth method.
|
|
399
|
-
:param pulumi.Input[
|
|
398
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Mutually exclusive with `access_key`.
|
|
400
399
|
Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
401
|
-
:param pulumi.Input[
|
|
400
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
402
401
|
*Available only for Vault Enterprise*
|
|
403
|
-
:param pulumi.Input[
|
|
402
|
+
:param pulumi.Input[_builtins.int] max_retries: Number of max retries the client should use for recoverable errors.
|
|
404
403
|
The default `-1` falls back to the AWS SDK's default behavior.
|
|
405
|
-
:param pulumi.Input[
|
|
404
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
406
405
|
The value should not contain leading or trailing forward slashes.
|
|
407
406
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
408
407
|
*Available only for Vault Enterprise*.
|
|
409
|
-
:param pulumi.Input[
|
|
408
|
+
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
410
409
|
*Available only for Vault Enterprise*
|
|
411
|
-
:param pulumi.Input[
|
|
410
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
412
411
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
413
|
-
:param pulumi.Input[
|
|
412
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
414
413
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
415
|
-
:param pulumi.Input[
|
|
414
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
416
415
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
417
416
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
418
|
-
:param pulumi.Input[
|
|
417
|
+
:param pulumi.Input[_builtins.str] secret_key: The AWS secret key that Vault should use for the
|
|
419
418
|
auth backend.
|
|
420
|
-
:param pulumi.Input[
|
|
419
|
+
:param pulumi.Input[_builtins.str] sts_endpoint: Override the URL Vault uses when making STS API
|
|
421
420
|
calls.
|
|
422
|
-
:param pulumi.Input[
|
|
421
|
+
:param pulumi.Input[_builtins.str] sts_region: Override the default region when making STS API
|
|
423
422
|
calls. The `sts_endpoint` argument must be set when using `sts_region`.
|
|
424
|
-
:param pulumi.Input[
|
|
423
|
+
:param pulumi.Input[_builtins.bool] use_sts_region_from_client: Available in Vault v1.15+. If set,
|
|
425
424
|
overrides both `sts_endpoint` and `sts_region` to instead use the region
|
|
426
425
|
specified in the client request headers for IAM-based authentication.
|
|
427
426
|
This can be useful when you have client requests coming from different
|
|
@@ -464,9 +463,9 @@ class _AuthBackendClientState:
|
|
|
464
463
|
if use_sts_region_from_client is not None:
|
|
465
464
|
pulumi.set(__self__, "use_sts_region_from_client", use_sts_region_from_client)
|
|
466
465
|
|
|
467
|
-
@property
|
|
466
|
+
@_builtins.property
|
|
468
467
|
@pulumi.getter(name="accessKey")
|
|
469
|
-
def access_key(self) -> Optional[pulumi.Input[
|
|
468
|
+
def access_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
470
469
|
"""
|
|
471
470
|
The AWS access key that Vault should use for the
|
|
472
471
|
auth backend. Mutually exclusive with `identity_token_audience`.
|
|
@@ -474,12 +473,12 @@ class _AuthBackendClientState:
|
|
|
474
473
|
return pulumi.get(self, "access_key")
|
|
475
474
|
|
|
476
475
|
@access_key.setter
|
|
477
|
-
def access_key(self, value: Optional[pulumi.Input[
|
|
476
|
+
def access_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
478
477
|
pulumi.set(self, "access_key", value)
|
|
479
478
|
|
|
480
|
-
@property
|
|
479
|
+
@_builtins.property
|
|
481
480
|
@pulumi.getter
|
|
482
|
-
def backend(self) -> Optional[pulumi.Input[
|
|
481
|
+
def backend(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
483
482
|
"""
|
|
484
483
|
The path the AWS auth backend being configured was
|
|
485
484
|
mounted at. Defaults to `aws`.
|
|
@@ -487,24 +486,24 @@ class _AuthBackendClientState:
|
|
|
487
486
|
return pulumi.get(self, "backend")
|
|
488
487
|
|
|
489
488
|
@backend.setter
|
|
490
|
-
def backend(self, value: Optional[pulumi.Input[
|
|
489
|
+
def backend(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
491
490
|
pulumi.set(self, "backend", value)
|
|
492
491
|
|
|
493
|
-
@property
|
|
492
|
+
@_builtins.property
|
|
494
493
|
@pulumi.getter(name="disableAutomatedRotation")
|
|
495
|
-
def disable_automated_rotation(self) -> Optional[pulumi.Input[
|
|
494
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
496
495
|
"""
|
|
497
496
|
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
498
497
|
"""
|
|
499
498
|
return pulumi.get(self, "disable_automated_rotation")
|
|
500
499
|
|
|
501
500
|
@disable_automated_rotation.setter
|
|
502
|
-
def disable_automated_rotation(self, value: Optional[pulumi.Input[
|
|
501
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
503
502
|
pulumi.set(self, "disable_automated_rotation", value)
|
|
504
503
|
|
|
505
|
-
@property
|
|
504
|
+
@_builtins.property
|
|
506
505
|
@pulumi.getter(name="ec2Endpoint")
|
|
507
|
-
def ec2_endpoint(self) -> Optional[pulumi.Input[
|
|
506
|
+
def ec2_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
508
507
|
"""
|
|
509
508
|
Override the URL Vault uses when making EC2 API
|
|
510
509
|
calls.
|
|
@@ -512,12 +511,12 @@ class _AuthBackendClientState:
|
|
|
512
511
|
return pulumi.get(self, "ec2_endpoint")
|
|
513
512
|
|
|
514
513
|
@ec2_endpoint.setter
|
|
515
|
-
def ec2_endpoint(self, value: Optional[pulumi.Input[
|
|
514
|
+
def ec2_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
516
515
|
pulumi.set(self, "ec2_endpoint", value)
|
|
517
516
|
|
|
518
|
-
@property
|
|
517
|
+
@_builtins.property
|
|
519
518
|
@pulumi.getter(name="iamEndpoint")
|
|
520
|
-
def iam_endpoint(self) -> Optional[pulumi.Input[
|
|
519
|
+
def iam_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
521
520
|
"""
|
|
522
521
|
Override the URL Vault uses when making IAM API
|
|
523
522
|
calls.
|
|
@@ -525,12 +524,12 @@ class _AuthBackendClientState:
|
|
|
525
524
|
return pulumi.get(self, "iam_endpoint")
|
|
526
525
|
|
|
527
526
|
@iam_endpoint.setter
|
|
528
|
-
def iam_endpoint(self, value: Optional[pulumi.Input[
|
|
527
|
+
def iam_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
529
528
|
pulumi.set(self, "iam_endpoint", value)
|
|
530
529
|
|
|
531
|
-
@property
|
|
530
|
+
@_builtins.property
|
|
532
531
|
@pulumi.getter(name="iamServerIdHeaderValue")
|
|
533
|
-
def iam_server_id_header_value(self) -> Optional[pulumi.Input[
|
|
532
|
+
def iam_server_id_header_value(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
534
533
|
"""
|
|
535
534
|
The value to require in the
|
|
536
535
|
`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
|
|
@@ -539,12 +538,12 @@ class _AuthBackendClientState:
|
|
|
539
538
|
return pulumi.get(self, "iam_server_id_header_value")
|
|
540
539
|
|
|
541
540
|
@iam_server_id_header_value.setter
|
|
542
|
-
def iam_server_id_header_value(self, value: Optional[pulumi.Input[
|
|
541
|
+
def iam_server_id_header_value(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
543
542
|
pulumi.set(self, "iam_server_id_header_value", value)
|
|
544
543
|
|
|
545
|
-
@property
|
|
544
|
+
@_builtins.property
|
|
546
545
|
@pulumi.getter(name="identityTokenAudience")
|
|
547
|
-
def identity_token_audience(self) -> Optional[pulumi.Input[
|
|
546
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
548
547
|
"""
|
|
549
548
|
The audience claim value. Mutually exclusive with `access_key`.
|
|
550
549
|
Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
@@ -552,12 +551,12 @@ class _AuthBackendClientState:
|
|
|
552
551
|
return pulumi.get(self, "identity_token_audience")
|
|
553
552
|
|
|
554
553
|
@identity_token_audience.setter
|
|
555
|
-
def identity_token_audience(self, value: Optional[pulumi.Input[
|
|
554
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
556
555
|
pulumi.set(self, "identity_token_audience", value)
|
|
557
556
|
|
|
558
|
-
@property
|
|
557
|
+
@_builtins.property
|
|
559
558
|
@pulumi.getter(name="identityTokenTtl")
|
|
560
|
-
def identity_token_ttl(self) -> Optional[pulumi.Input[
|
|
559
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
561
560
|
"""
|
|
562
561
|
The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
563
562
|
*Available only for Vault Enterprise*
|
|
@@ -565,12 +564,12 @@ class _AuthBackendClientState:
|
|
|
565
564
|
return pulumi.get(self, "identity_token_ttl")
|
|
566
565
|
|
|
567
566
|
@identity_token_ttl.setter
|
|
568
|
-
def identity_token_ttl(self, value: Optional[pulumi.Input[
|
|
567
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
569
568
|
pulumi.set(self, "identity_token_ttl", value)
|
|
570
569
|
|
|
571
|
-
@property
|
|
570
|
+
@_builtins.property
|
|
572
571
|
@pulumi.getter(name="maxRetries")
|
|
573
|
-
def max_retries(self) -> Optional[pulumi.Input[
|
|
572
|
+
def max_retries(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
574
573
|
"""
|
|
575
574
|
Number of max retries the client should use for recoverable errors.
|
|
576
575
|
The default `-1` falls back to the AWS SDK's default behavior.
|
|
@@ -578,12 +577,12 @@ class _AuthBackendClientState:
|
|
|
578
577
|
return pulumi.get(self, "max_retries")
|
|
579
578
|
|
|
580
579
|
@max_retries.setter
|
|
581
|
-
def max_retries(self, value: Optional[pulumi.Input[
|
|
580
|
+
def max_retries(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
582
581
|
pulumi.set(self, "max_retries", value)
|
|
583
582
|
|
|
584
|
-
@property
|
|
583
|
+
@_builtins.property
|
|
585
584
|
@pulumi.getter
|
|
586
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
585
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
587
586
|
"""
|
|
588
587
|
The namespace to provision the resource in.
|
|
589
588
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -593,12 +592,12 @@ class _AuthBackendClientState:
|
|
|
593
592
|
return pulumi.get(self, "namespace")
|
|
594
593
|
|
|
595
594
|
@namespace.setter
|
|
596
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
595
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
597
596
|
pulumi.set(self, "namespace", value)
|
|
598
597
|
|
|
599
|
-
@property
|
|
598
|
+
@_builtins.property
|
|
600
599
|
@pulumi.getter(name="roleArn")
|
|
601
|
-
def role_arn(self) -> Optional[pulumi.Input[
|
|
600
|
+
def role_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
602
601
|
"""
|
|
603
602
|
Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
604
603
|
*Available only for Vault Enterprise*
|
|
@@ -606,12 +605,12 @@ class _AuthBackendClientState:
|
|
|
606
605
|
return pulumi.get(self, "role_arn")
|
|
607
606
|
|
|
608
607
|
@role_arn.setter
|
|
609
|
-
def role_arn(self, value: Optional[pulumi.Input[
|
|
608
|
+
def role_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
610
609
|
pulumi.set(self, "role_arn", value)
|
|
611
610
|
|
|
612
|
-
@property
|
|
611
|
+
@_builtins.property
|
|
613
612
|
@pulumi.getter(name="rotationPeriod")
|
|
614
|
-
def rotation_period(self) -> Optional[pulumi.Input[
|
|
613
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
615
614
|
"""
|
|
616
615
|
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
617
616
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
@@ -619,12 +618,12 @@ class _AuthBackendClientState:
|
|
|
619
618
|
return pulumi.get(self, "rotation_period")
|
|
620
619
|
|
|
621
620
|
@rotation_period.setter
|
|
622
|
-
def rotation_period(self, value: Optional[pulumi.Input[
|
|
621
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
623
622
|
pulumi.set(self, "rotation_period", value)
|
|
624
623
|
|
|
625
|
-
@property
|
|
624
|
+
@_builtins.property
|
|
626
625
|
@pulumi.getter(name="rotationSchedule")
|
|
627
|
-
def rotation_schedule(self) -> Optional[pulumi.Input[
|
|
626
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
628
627
|
"""
|
|
629
628
|
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
630
629
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
@@ -632,12 +631,12 @@ class _AuthBackendClientState:
|
|
|
632
631
|
return pulumi.get(self, "rotation_schedule")
|
|
633
632
|
|
|
634
633
|
@rotation_schedule.setter
|
|
635
|
-
def rotation_schedule(self, value: Optional[pulumi.Input[
|
|
634
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
636
635
|
pulumi.set(self, "rotation_schedule", value)
|
|
637
636
|
|
|
638
|
-
@property
|
|
637
|
+
@_builtins.property
|
|
639
638
|
@pulumi.getter(name="rotationWindow")
|
|
640
|
-
def rotation_window(self) -> Optional[pulumi.Input[
|
|
639
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
641
640
|
"""
|
|
642
641
|
The maximum amount of time in seconds allowed to complete
|
|
643
642
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
@@ -646,12 +645,12 @@ class _AuthBackendClientState:
|
|
|
646
645
|
return pulumi.get(self, "rotation_window")
|
|
647
646
|
|
|
648
647
|
@rotation_window.setter
|
|
649
|
-
def rotation_window(self, value: Optional[pulumi.Input[
|
|
648
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
650
649
|
pulumi.set(self, "rotation_window", value)
|
|
651
650
|
|
|
652
|
-
@property
|
|
651
|
+
@_builtins.property
|
|
653
652
|
@pulumi.getter(name="secretKey")
|
|
654
|
-
def secret_key(self) -> Optional[pulumi.Input[
|
|
653
|
+
def secret_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
655
654
|
"""
|
|
656
655
|
The AWS secret key that Vault should use for the
|
|
657
656
|
auth backend.
|
|
@@ -659,12 +658,12 @@ class _AuthBackendClientState:
|
|
|
659
658
|
return pulumi.get(self, "secret_key")
|
|
660
659
|
|
|
661
660
|
@secret_key.setter
|
|
662
|
-
def secret_key(self, value: Optional[pulumi.Input[
|
|
661
|
+
def secret_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
663
662
|
pulumi.set(self, "secret_key", value)
|
|
664
663
|
|
|
665
|
-
@property
|
|
664
|
+
@_builtins.property
|
|
666
665
|
@pulumi.getter(name="stsEndpoint")
|
|
667
|
-
def sts_endpoint(self) -> Optional[pulumi.Input[
|
|
666
|
+
def sts_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
668
667
|
"""
|
|
669
668
|
Override the URL Vault uses when making STS API
|
|
670
669
|
calls.
|
|
@@ -672,12 +671,12 @@ class _AuthBackendClientState:
|
|
|
672
671
|
return pulumi.get(self, "sts_endpoint")
|
|
673
672
|
|
|
674
673
|
@sts_endpoint.setter
|
|
675
|
-
def sts_endpoint(self, value: Optional[pulumi.Input[
|
|
674
|
+
def sts_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
676
675
|
pulumi.set(self, "sts_endpoint", value)
|
|
677
676
|
|
|
678
|
-
@property
|
|
677
|
+
@_builtins.property
|
|
679
678
|
@pulumi.getter(name="stsRegion")
|
|
680
|
-
def sts_region(self) -> Optional[pulumi.Input[
|
|
679
|
+
def sts_region(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
681
680
|
"""
|
|
682
681
|
Override the default region when making STS API
|
|
683
682
|
calls. The `sts_endpoint` argument must be set when using `sts_region`.
|
|
@@ -685,12 +684,12 @@ class _AuthBackendClientState:
|
|
|
685
684
|
return pulumi.get(self, "sts_region")
|
|
686
685
|
|
|
687
686
|
@sts_region.setter
|
|
688
|
-
def sts_region(self, value: Optional[pulumi.Input[
|
|
687
|
+
def sts_region(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
689
688
|
pulumi.set(self, "sts_region", value)
|
|
690
689
|
|
|
691
|
-
@property
|
|
690
|
+
@_builtins.property
|
|
692
691
|
@pulumi.getter(name="useStsRegionFromClient")
|
|
693
|
-
def use_sts_region_from_client(self) -> Optional[pulumi.Input[
|
|
692
|
+
def use_sts_region_from_client(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
694
693
|
"""
|
|
695
694
|
Available in Vault v1.15+. If set,
|
|
696
695
|
overrides both `sts_endpoint` and `sts_region` to instead use the region
|
|
@@ -701,7 +700,7 @@ class _AuthBackendClientState:
|
|
|
701
700
|
return pulumi.get(self, "use_sts_region_from_client")
|
|
702
701
|
|
|
703
702
|
@use_sts_region_from_client.setter
|
|
704
|
-
def use_sts_region_from_client(self, value: Optional[pulumi.Input[
|
|
703
|
+
def use_sts_region_from_client(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
705
704
|
pulumi.set(self, "use_sts_region_from_client", value)
|
|
706
705
|
|
|
707
706
|
|
|
@@ -711,24 +710,24 @@ class AuthBackendClient(pulumi.CustomResource):
|
|
|
711
710
|
def __init__(__self__,
|
|
712
711
|
resource_name: str,
|
|
713
712
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
714
|
-
access_key: Optional[pulumi.Input[
|
|
715
|
-
backend: Optional[pulumi.Input[
|
|
716
|
-
disable_automated_rotation: Optional[pulumi.Input[
|
|
717
|
-
ec2_endpoint: Optional[pulumi.Input[
|
|
718
|
-
iam_endpoint: Optional[pulumi.Input[
|
|
719
|
-
iam_server_id_header_value: Optional[pulumi.Input[
|
|
720
|
-
identity_token_audience: Optional[pulumi.Input[
|
|
721
|
-
identity_token_ttl: Optional[pulumi.Input[
|
|
722
|
-
max_retries: Optional[pulumi.Input[
|
|
723
|
-
namespace: Optional[pulumi.Input[
|
|
724
|
-
role_arn: Optional[pulumi.Input[
|
|
725
|
-
rotation_period: Optional[pulumi.Input[
|
|
726
|
-
rotation_schedule: Optional[pulumi.Input[
|
|
727
|
-
rotation_window: Optional[pulumi.Input[
|
|
728
|
-
secret_key: Optional[pulumi.Input[
|
|
729
|
-
sts_endpoint: Optional[pulumi.Input[
|
|
730
|
-
sts_region: Optional[pulumi.Input[
|
|
731
|
-
use_sts_region_from_client: Optional[pulumi.Input[
|
|
713
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
714
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
715
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
716
|
+
ec2_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
717
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
718
|
+
iam_server_id_header_value: Optional[pulumi.Input[_builtins.str]] = None,
|
|
719
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
720
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
721
|
+
max_retries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
722
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
723
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
724
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
725
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
726
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
727
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
728
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
729
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
730
|
+
use_sts_region_from_client: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
732
731
|
__props__=None):
|
|
733
732
|
"""
|
|
734
733
|
## Example Usage
|
|
@@ -770,44 +769,44 @@ class AuthBackendClient(pulumi.CustomResource):
|
|
|
770
769
|
|
|
771
770
|
:param str resource_name: The name of the resource.
|
|
772
771
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
773
|
-
:param pulumi.Input[
|
|
772
|
+
:param pulumi.Input[_builtins.str] access_key: The AWS access key that Vault should use for the
|
|
774
773
|
auth backend. Mutually exclusive with `identity_token_audience`.
|
|
775
|
-
:param pulumi.Input[
|
|
774
|
+
:param pulumi.Input[_builtins.str] backend: The path the AWS auth backend being configured was
|
|
776
775
|
mounted at. Defaults to `aws`.
|
|
777
|
-
:param pulumi.Input[
|
|
778
|
-
:param pulumi.Input[
|
|
776
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
777
|
+
:param pulumi.Input[_builtins.str] ec2_endpoint: Override the URL Vault uses when making EC2 API
|
|
779
778
|
calls.
|
|
780
|
-
:param pulumi.Input[
|
|
779
|
+
:param pulumi.Input[_builtins.str] iam_endpoint: Override the URL Vault uses when making IAM API
|
|
781
780
|
calls.
|
|
782
|
-
:param pulumi.Input[
|
|
781
|
+
:param pulumi.Input[_builtins.str] iam_server_id_header_value: The value to require in the
|
|
783
782
|
`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
|
|
784
783
|
that are used in the IAM auth method.
|
|
785
|
-
:param pulumi.Input[
|
|
784
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Mutually exclusive with `access_key`.
|
|
786
785
|
Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
787
|
-
:param pulumi.Input[
|
|
786
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
788
787
|
*Available only for Vault Enterprise*
|
|
789
|
-
:param pulumi.Input[
|
|
788
|
+
:param pulumi.Input[_builtins.int] max_retries: Number of max retries the client should use for recoverable errors.
|
|
790
789
|
The default `-1` falls back to the AWS SDK's default behavior.
|
|
791
|
-
:param pulumi.Input[
|
|
790
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
792
791
|
The value should not contain leading or trailing forward slashes.
|
|
793
792
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
794
793
|
*Available only for Vault Enterprise*.
|
|
795
|
-
:param pulumi.Input[
|
|
794
|
+
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
796
795
|
*Available only for Vault Enterprise*
|
|
797
|
-
:param pulumi.Input[
|
|
796
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
798
797
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
799
|
-
:param pulumi.Input[
|
|
798
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
800
799
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
801
|
-
:param pulumi.Input[
|
|
800
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
802
801
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
803
802
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
804
|
-
:param pulumi.Input[
|
|
803
|
+
:param pulumi.Input[_builtins.str] secret_key: The AWS secret key that Vault should use for the
|
|
805
804
|
auth backend.
|
|
806
|
-
:param pulumi.Input[
|
|
805
|
+
:param pulumi.Input[_builtins.str] sts_endpoint: Override the URL Vault uses when making STS API
|
|
807
806
|
calls.
|
|
808
|
-
:param pulumi.Input[
|
|
807
|
+
:param pulumi.Input[_builtins.str] sts_region: Override the default region when making STS API
|
|
809
808
|
calls. The `sts_endpoint` argument must be set when using `sts_region`.
|
|
810
|
-
:param pulumi.Input[
|
|
809
|
+
:param pulumi.Input[_builtins.bool] use_sts_region_from_client: Available in Vault v1.15+. If set,
|
|
811
810
|
overrides both `sts_endpoint` and `sts_region` to instead use the region
|
|
812
811
|
specified in the client request headers for IAM-based authentication.
|
|
813
812
|
This can be useful when you have client requests coming from different
|
|
@@ -872,24 +871,24 @@ class AuthBackendClient(pulumi.CustomResource):
|
|
|
872
871
|
def _internal_init(__self__,
|
|
873
872
|
resource_name: str,
|
|
874
873
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
875
|
-
access_key: Optional[pulumi.Input[
|
|
876
|
-
backend: Optional[pulumi.Input[
|
|
877
|
-
disable_automated_rotation: Optional[pulumi.Input[
|
|
878
|
-
ec2_endpoint: Optional[pulumi.Input[
|
|
879
|
-
iam_endpoint: Optional[pulumi.Input[
|
|
880
|
-
iam_server_id_header_value: Optional[pulumi.Input[
|
|
881
|
-
identity_token_audience: Optional[pulumi.Input[
|
|
882
|
-
identity_token_ttl: Optional[pulumi.Input[
|
|
883
|
-
max_retries: Optional[pulumi.Input[
|
|
884
|
-
namespace: Optional[pulumi.Input[
|
|
885
|
-
role_arn: Optional[pulumi.Input[
|
|
886
|
-
rotation_period: Optional[pulumi.Input[
|
|
887
|
-
rotation_schedule: Optional[pulumi.Input[
|
|
888
|
-
rotation_window: Optional[pulumi.Input[
|
|
889
|
-
secret_key: Optional[pulumi.Input[
|
|
890
|
-
sts_endpoint: Optional[pulumi.Input[
|
|
891
|
-
sts_region: Optional[pulumi.Input[
|
|
892
|
-
use_sts_region_from_client: Optional[pulumi.Input[
|
|
874
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
875
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
876
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
877
|
+
ec2_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
878
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
879
|
+
iam_server_id_header_value: Optional[pulumi.Input[_builtins.str]] = None,
|
|
880
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
881
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
882
|
+
max_retries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
883
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
884
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
885
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
886
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
887
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
888
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
889
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
890
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
891
|
+
use_sts_region_from_client: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
893
892
|
__props__=None):
|
|
894
893
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
895
894
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -929,24 +928,24 @@ class AuthBackendClient(pulumi.CustomResource):
|
|
|
929
928
|
def get(resource_name: str,
|
|
930
929
|
id: pulumi.Input[str],
|
|
931
930
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
932
|
-
access_key: Optional[pulumi.Input[
|
|
933
|
-
backend: Optional[pulumi.Input[
|
|
934
|
-
disable_automated_rotation: Optional[pulumi.Input[
|
|
935
|
-
ec2_endpoint: Optional[pulumi.Input[
|
|
936
|
-
iam_endpoint: Optional[pulumi.Input[
|
|
937
|
-
iam_server_id_header_value: Optional[pulumi.Input[
|
|
938
|
-
identity_token_audience: Optional[pulumi.Input[
|
|
939
|
-
identity_token_ttl: Optional[pulumi.Input[
|
|
940
|
-
max_retries: Optional[pulumi.Input[
|
|
941
|
-
namespace: Optional[pulumi.Input[
|
|
942
|
-
role_arn: Optional[pulumi.Input[
|
|
943
|
-
rotation_period: Optional[pulumi.Input[
|
|
944
|
-
rotation_schedule: Optional[pulumi.Input[
|
|
945
|
-
rotation_window: Optional[pulumi.Input[
|
|
946
|
-
secret_key: Optional[pulumi.Input[
|
|
947
|
-
sts_endpoint: Optional[pulumi.Input[
|
|
948
|
-
sts_region: Optional[pulumi.Input[
|
|
949
|
-
use_sts_region_from_client: Optional[pulumi.Input[
|
|
931
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
932
|
+
backend: Optional[pulumi.Input[_builtins.str]] = None,
|
|
933
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
934
|
+
ec2_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
935
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
936
|
+
iam_server_id_header_value: Optional[pulumi.Input[_builtins.str]] = None,
|
|
937
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
938
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
939
|
+
max_retries: Optional[pulumi.Input[_builtins.int]] = None,
|
|
940
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
941
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
942
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
943
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
944
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
945
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
946
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
947
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
948
|
+
use_sts_region_from_client: Optional[pulumi.Input[_builtins.bool]] = None) -> 'AuthBackendClient':
|
|
950
949
|
"""
|
|
951
950
|
Get an existing AuthBackendClient resource's state with the given name, id, and optional extra
|
|
952
951
|
properties used to qualify the lookup.
|
|
@@ -954,44 +953,44 @@ class AuthBackendClient(pulumi.CustomResource):
|
|
|
954
953
|
:param str resource_name: The unique name of the resulting resource.
|
|
955
954
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
956
955
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
957
|
-
:param pulumi.Input[
|
|
956
|
+
:param pulumi.Input[_builtins.str] access_key: The AWS access key that Vault should use for the
|
|
958
957
|
auth backend. Mutually exclusive with `identity_token_audience`.
|
|
959
|
-
:param pulumi.Input[
|
|
958
|
+
:param pulumi.Input[_builtins.str] backend: The path the AWS auth backend being configured was
|
|
960
959
|
mounted at. Defaults to `aws`.
|
|
961
|
-
:param pulumi.Input[
|
|
962
|
-
:param pulumi.Input[
|
|
960
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
961
|
+
:param pulumi.Input[_builtins.str] ec2_endpoint: Override the URL Vault uses when making EC2 API
|
|
963
962
|
calls.
|
|
964
|
-
:param pulumi.Input[
|
|
963
|
+
:param pulumi.Input[_builtins.str] iam_endpoint: Override the URL Vault uses when making IAM API
|
|
965
964
|
calls.
|
|
966
|
-
:param pulumi.Input[
|
|
965
|
+
:param pulumi.Input[_builtins.str] iam_server_id_header_value: The value to require in the
|
|
967
966
|
`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
|
|
968
967
|
that are used in the IAM auth method.
|
|
969
|
-
:param pulumi.Input[
|
|
968
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Mutually exclusive with `access_key`.
|
|
970
969
|
Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
971
|
-
:param pulumi.Input[
|
|
970
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
972
971
|
*Available only for Vault Enterprise*
|
|
973
|
-
:param pulumi.Input[
|
|
972
|
+
:param pulumi.Input[_builtins.int] max_retries: Number of max retries the client should use for recoverable errors.
|
|
974
973
|
The default `-1` falls back to the AWS SDK's default behavior.
|
|
975
|
-
:param pulumi.Input[
|
|
974
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
976
975
|
The value should not contain leading or trailing forward slashes.
|
|
977
976
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
978
977
|
*Available only for Vault Enterprise*.
|
|
979
|
-
:param pulumi.Input[
|
|
978
|
+
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
980
979
|
*Available only for Vault Enterprise*
|
|
981
|
-
:param pulumi.Input[
|
|
980
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
982
981
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
983
|
-
:param pulumi.Input[
|
|
982
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
984
983
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
985
|
-
:param pulumi.Input[
|
|
984
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
986
985
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
987
986
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
988
|
-
:param pulumi.Input[
|
|
987
|
+
:param pulumi.Input[_builtins.str] secret_key: The AWS secret key that Vault should use for the
|
|
989
988
|
auth backend.
|
|
990
|
-
:param pulumi.Input[
|
|
989
|
+
:param pulumi.Input[_builtins.str] sts_endpoint: Override the URL Vault uses when making STS API
|
|
991
990
|
calls.
|
|
992
|
-
:param pulumi.Input[
|
|
991
|
+
:param pulumi.Input[_builtins.str] sts_region: Override the default region when making STS API
|
|
993
992
|
calls. The `sts_endpoint` argument must be set when using `sts_region`.
|
|
994
|
-
:param pulumi.Input[
|
|
993
|
+
:param pulumi.Input[_builtins.bool] use_sts_region_from_client: Available in Vault v1.15+. If set,
|
|
995
994
|
overrides both `sts_endpoint` and `sts_region` to instead use the region
|
|
996
995
|
specified in the client request headers for IAM-based authentication.
|
|
997
996
|
This can be useful when you have client requests coming from different
|
|
@@ -1021,53 +1020,53 @@ class AuthBackendClient(pulumi.CustomResource):
|
|
|
1021
1020
|
__props__.__dict__["use_sts_region_from_client"] = use_sts_region_from_client
|
|
1022
1021
|
return AuthBackendClient(resource_name, opts=opts, __props__=__props__)
|
|
1023
1022
|
|
|
1024
|
-
@property
|
|
1023
|
+
@_builtins.property
|
|
1025
1024
|
@pulumi.getter(name="accessKey")
|
|
1026
|
-
def access_key(self) -> pulumi.Output[Optional[
|
|
1025
|
+
def access_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1027
1026
|
"""
|
|
1028
1027
|
The AWS access key that Vault should use for the
|
|
1029
1028
|
auth backend. Mutually exclusive with `identity_token_audience`.
|
|
1030
1029
|
"""
|
|
1031
1030
|
return pulumi.get(self, "access_key")
|
|
1032
1031
|
|
|
1033
|
-
@property
|
|
1032
|
+
@_builtins.property
|
|
1034
1033
|
@pulumi.getter
|
|
1035
|
-
def backend(self) -> pulumi.Output[Optional[
|
|
1034
|
+
def backend(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1036
1035
|
"""
|
|
1037
1036
|
The path the AWS auth backend being configured was
|
|
1038
1037
|
mounted at. Defaults to `aws`.
|
|
1039
1038
|
"""
|
|
1040
1039
|
return pulumi.get(self, "backend")
|
|
1041
1040
|
|
|
1042
|
-
@property
|
|
1041
|
+
@_builtins.property
|
|
1043
1042
|
@pulumi.getter(name="disableAutomatedRotation")
|
|
1044
|
-
def disable_automated_rotation(self) -> pulumi.Output[Optional[
|
|
1043
|
+
def disable_automated_rotation(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1045
1044
|
"""
|
|
1046
1045
|
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1047
1046
|
"""
|
|
1048
1047
|
return pulumi.get(self, "disable_automated_rotation")
|
|
1049
1048
|
|
|
1050
|
-
@property
|
|
1049
|
+
@_builtins.property
|
|
1051
1050
|
@pulumi.getter(name="ec2Endpoint")
|
|
1052
|
-
def ec2_endpoint(self) -> pulumi.Output[Optional[
|
|
1051
|
+
def ec2_endpoint(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1053
1052
|
"""
|
|
1054
1053
|
Override the URL Vault uses when making EC2 API
|
|
1055
1054
|
calls.
|
|
1056
1055
|
"""
|
|
1057
1056
|
return pulumi.get(self, "ec2_endpoint")
|
|
1058
1057
|
|
|
1059
|
-
@property
|
|
1058
|
+
@_builtins.property
|
|
1060
1059
|
@pulumi.getter(name="iamEndpoint")
|
|
1061
|
-
def iam_endpoint(self) -> pulumi.Output[Optional[
|
|
1060
|
+
def iam_endpoint(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1062
1061
|
"""
|
|
1063
1062
|
Override the URL Vault uses when making IAM API
|
|
1064
1063
|
calls.
|
|
1065
1064
|
"""
|
|
1066
1065
|
return pulumi.get(self, "iam_endpoint")
|
|
1067
1066
|
|
|
1068
|
-
@property
|
|
1067
|
+
@_builtins.property
|
|
1069
1068
|
@pulumi.getter(name="iamServerIdHeaderValue")
|
|
1070
|
-
def iam_server_id_header_value(self) -> pulumi.Output[Optional[
|
|
1069
|
+
def iam_server_id_header_value(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1071
1070
|
"""
|
|
1072
1071
|
The value to require in the
|
|
1073
1072
|
`X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` requests
|
|
@@ -1075,36 +1074,36 @@ class AuthBackendClient(pulumi.CustomResource):
|
|
|
1075
1074
|
"""
|
|
1076
1075
|
return pulumi.get(self, "iam_server_id_header_value")
|
|
1077
1076
|
|
|
1078
|
-
@property
|
|
1077
|
+
@_builtins.property
|
|
1079
1078
|
@pulumi.getter(name="identityTokenAudience")
|
|
1080
|
-
def identity_token_audience(self) -> pulumi.Output[Optional[
|
|
1079
|
+
def identity_token_audience(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1081
1080
|
"""
|
|
1082
1081
|
The audience claim value. Mutually exclusive with `access_key`.
|
|
1083
1082
|
Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
1084
1083
|
"""
|
|
1085
1084
|
return pulumi.get(self, "identity_token_audience")
|
|
1086
1085
|
|
|
1087
|
-
@property
|
|
1086
|
+
@_builtins.property
|
|
1088
1087
|
@pulumi.getter(name="identityTokenTtl")
|
|
1089
|
-
def identity_token_ttl(self) -> pulumi.Output[
|
|
1088
|
+
def identity_token_ttl(self) -> pulumi.Output[_builtins.int]:
|
|
1090
1089
|
"""
|
|
1091
1090
|
The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
1092
1091
|
*Available only for Vault Enterprise*
|
|
1093
1092
|
"""
|
|
1094
1093
|
return pulumi.get(self, "identity_token_ttl")
|
|
1095
1094
|
|
|
1096
|
-
@property
|
|
1095
|
+
@_builtins.property
|
|
1097
1096
|
@pulumi.getter(name="maxRetries")
|
|
1098
|
-
def max_retries(self) -> pulumi.Output[Optional[
|
|
1097
|
+
def max_retries(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1099
1098
|
"""
|
|
1100
1099
|
Number of max retries the client should use for recoverable errors.
|
|
1101
1100
|
The default `-1` falls back to the AWS SDK's default behavior.
|
|
1102
1101
|
"""
|
|
1103
1102
|
return pulumi.get(self, "max_retries")
|
|
1104
1103
|
|
|
1105
|
-
@property
|
|
1104
|
+
@_builtins.property
|
|
1106
1105
|
@pulumi.getter
|
|
1107
|
-
def namespace(self) -> pulumi.Output[Optional[
|
|
1106
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1108
1107
|
"""
|
|
1109
1108
|
The namespace to provision the resource in.
|
|
1110
1109
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -1113,36 +1112,36 @@ class AuthBackendClient(pulumi.CustomResource):
|
|
|
1113
1112
|
"""
|
|
1114
1113
|
return pulumi.get(self, "namespace")
|
|
1115
1114
|
|
|
1116
|
-
@property
|
|
1115
|
+
@_builtins.property
|
|
1117
1116
|
@pulumi.getter(name="roleArn")
|
|
1118
|
-
def role_arn(self) -> pulumi.Output[Optional[
|
|
1117
|
+
def role_arn(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1119
1118
|
"""
|
|
1120
1119
|
Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
1121
1120
|
*Available only for Vault Enterprise*
|
|
1122
1121
|
"""
|
|
1123
1122
|
return pulumi.get(self, "role_arn")
|
|
1124
1123
|
|
|
1125
|
-
@property
|
|
1124
|
+
@_builtins.property
|
|
1126
1125
|
@pulumi.getter(name="rotationPeriod")
|
|
1127
|
-
def rotation_period(self) -> pulumi.Output[Optional[
|
|
1126
|
+
def rotation_period(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1128
1127
|
"""
|
|
1129
1128
|
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1130
1129
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1131
1130
|
"""
|
|
1132
1131
|
return pulumi.get(self, "rotation_period")
|
|
1133
1132
|
|
|
1134
|
-
@property
|
|
1133
|
+
@_builtins.property
|
|
1135
1134
|
@pulumi.getter(name="rotationSchedule")
|
|
1136
|
-
def rotation_schedule(self) -> pulumi.Output[Optional[
|
|
1135
|
+
def rotation_schedule(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1137
1136
|
"""
|
|
1138
1137
|
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1139
1138
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1140
1139
|
"""
|
|
1141
1140
|
return pulumi.get(self, "rotation_schedule")
|
|
1142
1141
|
|
|
1143
|
-
@property
|
|
1142
|
+
@_builtins.property
|
|
1144
1143
|
@pulumi.getter(name="rotationWindow")
|
|
1145
|
-
def rotation_window(self) -> pulumi.Output[Optional[
|
|
1144
|
+
def rotation_window(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1146
1145
|
"""
|
|
1147
1146
|
The maximum amount of time in seconds allowed to complete
|
|
1148
1147
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
@@ -1150,36 +1149,36 @@ class AuthBackendClient(pulumi.CustomResource):
|
|
|
1150
1149
|
"""
|
|
1151
1150
|
return pulumi.get(self, "rotation_window")
|
|
1152
1151
|
|
|
1153
|
-
@property
|
|
1152
|
+
@_builtins.property
|
|
1154
1153
|
@pulumi.getter(name="secretKey")
|
|
1155
|
-
def secret_key(self) -> pulumi.Output[Optional[
|
|
1154
|
+
def secret_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1156
1155
|
"""
|
|
1157
1156
|
The AWS secret key that Vault should use for the
|
|
1158
1157
|
auth backend.
|
|
1159
1158
|
"""
|
|
1160
1159
|
return pulumi.get(self, "secret_key")
|
|
1161
1160
|
|
|
1162
|
-
@property
|
|
1161
|
+
@_builtins.property
|
|
1163
1162
|
@pulumi.getter(name="stsEndpoint")
|
|
1164
|
-
def sts_endpoint(self) -> pulumi.Output[Optional[
|
|
1163
|
+
def sts_endpoint(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1165
1164
|
"""
|
|
1166
1165
|
Override the URL Vault uses when making STS API
|
|
1167
1166
|
calls.
|
|
1168
1167
|
"""
|
|
1169
1168
|
return pulumi.get(self, "sts_endpoint")
|
|
1170
1169
|
|
|
1171
|
-
@property
|
|
1170
|
+
@_builtins.property
|
|
1172
1171
|
@pulumi.getter(name="stsRegion")
|
|
1173
|
-
def sts_region(self) -> pulumi.Output[Optional[
|
|
1172
|
+
def sts_region(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1174
1173
|
"""
|
|
1175
1174
|
Override the default region when making STS API
|
|
1176
1175
|
calls. The `sts_endpoint` argument must be set when using `sts_region`.
|
|
1177
1176
|
"""
|
|
1178
1177
|
return pulumi.get(self, "sts_region")
|
|
1179
1178
|
|
|
1180
|
-
@property
|
|
1179
|
+
@_builtins.property
|
|
1181
1180
|
@pulumi.getter(name="useStsRegionFromClient")
|
|
1182
|
-
def use_sts_region_from_client(self) -> pulumi.Output[
|
|
1181
|
+
def use_sts_region_from_client(self) -> pulumi.Output[_builtins.bool]:
|
|
1183
1182
|
"""
|
|
1184
1183
|
Available in Vault v1.15+. If set,
|
|
1185
1184
|
overrides both `sts_endpoint` and `sts_region` to instead use the region
|