pulumi-vault 7.1.0__py3-none-any.whl → 7.2.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +19 -1
- pulumi_vault/_inputs.py +873 -673
- pulumi_vault/ad/__init__.py +1 -1
- pulumi_vault/ad/get_access_credentials.py +27 -28
- pulumi_vault/ad/secret_backend.py +579 -580
- pulumi_vault/ad/secret_library.py +120 -121
- pulumi_vault/ad/secret_role.py +104 -105
- pulumi_vault/alicloud/__init__.py +1 -1
- pulumi_vault/alicloud/auth_backend_role.py +222 -223
- pulumi_vault/approle/__init__.py +1 -1
- pulumi_vault/approle/auth_backend_login.py +138 -139
- pulumi_vault/approle/auth_backend_role.py +292 -293
- pulumi_vault/approle/auth_backend_role_secret_id.py +202 -203
- pulumi_vault/approle/get_auth_backend_role_id.py +23 -24
- pulumi_vault/audit.py +103 -104
- pulumi_vault/audit_request_header.py +52 -53
- pulumi_vault/auth_backend.py +132 -133
- pulumi_vault/aws/__init__.py +1 -1
- pulumi_vault/aws/auth_backend_cert.py +86 -87
- pulumi_vault/aws/auth_backend_client.py +307 -308
- pulumi_vault/aws/auth_backend_config_identity.py +103 -104
- pulumi_vault/aws/auth_backend_identity_whitelist.py +69 -70
- pulumi_vault/aws/auth_backend_login.py +258 -259
- pulumi_vault/aws/auth_backend_role.py +486 -487
- pulumi_vault/aws/auth_backend_role_tag.py +155 -156
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +69 -70
- pulumi_vault/aws/auth_backend_sts_role.py +86 -87
- pulumi_vault/aws/get_access_credentials.py +59 -60
- pulumi_vault/aws/get_static_access_credentials.py +19 -20
- pulumi_vault/aws/secret_backend.py +1016 -439
- pulumi_vault/aws/secret_backend_role.py +256 -257
- pulumi_vault/aws/secret_backend_static_role.py +137 -138
- pulumi_vault/azure/__init__.py +1 -1
- pulumi_vault/azure/_inputs.py +26 -27
- pulumi_vault/azure/auth_backend_config.py +222 -223
- pulumi_vault/azure/auth_backend_role.py +307 -308
- pulumi_vault/azure/backend.py +1057 -285
- pulumi_vault/azure/backend_role.py +194 -195
- pulumi_vault/azure/get_access_credentials.py +75 -76
- pulumi_vault/azure/outputs.py +16 -17
- pulumi_vault/cert_auth_backend_role.py +443 -444
- pulumi_vault/config/__init__.py +1 -1
- pulumi_vault/config/__init__.pyi +1 -2
- pulumi_vault/config/_inputs.py +13 -14
- pulumi_vault/config/outputs.py +380 -381
- pulumi_vault/config/ui_custom_message.py +140 -141
- pulumi_vault/config/vars.py +31 -32
- pulumi_vault/consul/__init__.py +1 -1
- pulumi_vault/consul/secret_backend.py +887 -256
- pulumi_vault/consul/secret_backend_role.py +222 -223
- pulumi_vault/database/__init__.py +1 -1
- pulumi_vault/database/_inputs.py +3167 -3168
- pulumi_vault/database/outputs.py +2123 -2124
- pulumi_vault/database/secret_backend_connection.py +259 -260
- pulumi_vault/database/secret_backend_role.py +205 -206
- pulumi_vault/database/secret_backend_static_role.py +218 -219
- pulumi_vault/database/secrets_mount.py +426 -380
- pulumi_vault/egp_policy.py +86 -87
- pulumi_vault/gcp/__init__.py +1 -1
- pulumi_vault/gcp/_inputs.py +98 -99
- pulumi_vault/gcp/auth_backend.py +322 -323
- pulumi_vault/gcp/auth_backend_role.py +347 -348
- pulumi_vault/gcp/get_auth_backend_role.py +91 -92
- pulumi_vault/gcp/outputs.py +66 -67
- pulumi_vault/gcp/secret_backend.py +878 -336
- pulumi_vault/gcp/secret_impersonated_account.py +112 -113
- pulumi_vault/gcp/secret_roleset.py +115 -116
- pulumi_vault/gcp/secret_static_account.py +115 -116
- pulumi_vault/generic/__init__.py +1 -1
- pulumi_vault/generic/endpoint.py +138 -139
- pulumi_vault/generic/get_secret.py +39 -40
- pulumi_vault/generic/secret.py +95 -96
- pulumi_vault/get_auth_backend.py +29 -30
- pulumi_vault/get_auth_backends.py +19 -20
- pulumi_vault/get_namespace.py +21 -22
- pulumi_vault/get_namespaces.py +19 -20
- pulumi_vault/get_nomad_access_token.py +25 -26
- pulumi_vault/get_policy_document.py +10 -11
- pulumi_vault/get_raft_autopilot_state.py +31 -32
- pulumi_vault/github/__init__.py +1 -1
- pulumi_vault/github/_inputs.py +50 -51
- pulumi_vault/github/auth_backend.py +285 -286
- pulumi_vault/github/outputs.py +34 -35
- pulumi_vault/github/team.py +69 -70
- pulumi_vault/github/user.py +69 -70
- pulumi_vault/identity/__init__.py +1 -1
- pulumi_vault/identity/entity.py +103 -104
- pulumi_vault/identity/entity_alias.py +86 -87
- pulumi_vault/identity/entity_policies.py +78 -79
- pulumi_vault/identity/get_entity.py +62 -63
- pulumi_vault/identity/get_group.py +75 -76
- pulumi_vault/identity/get_oidc_client_creds.py +19 -20
- pulumi_vault/identity/get_oidc_openid_config.py +39 -40
- pulumi_vault/identity/get_oidc_public_keys.py +17 -18
- pulumi_vault/identity/group.py +171 -172
- pulumi_vault/identity/group_alias.py +69 -70
- pulumi_vault/identity/group_member_entity_ids.py +69 -70
- pulumi_vault/identity/group_member_group_ids.py +69 -70
- pulumi_vault/identity/group_policies.py +78 -79
- pulumi_vault/identity/mfa_duo.py +183 -184
- pulumi_vault/identity/mfa_login_enforcement.py +147 -148
- pulumi_vault/identity/mfa_okta.py +166 -167
- pulumi_vault/identity/mfa_pingid.py +160 -161
- pulumi_vault/identity/mfa_totp.py +217 -218
- pulumi_vault/identity/oidc.py +35 -36
- pulumi_vault/identity/oidc_assignment.py +69 -70
- pulumi_vault/identity/oidc_client.py +155 -156
- pulumi_vault/identity/oidc_key.py +103 -104
- pulumi_vault/identity/oidc_key_allowed_client_id.py +52 -53
- pulumi_vault/identity/oidc_provider.py +112 -113
- pulumi_vault/identity/oidc_role.py +103 -104
- pulumi_vault/identity/oidc_scope.py +69 -70
- pulumi_vault/identity/outputs.py +42 -43
- pulumi_vault/jwt/__init__.py +1 -1
- pulumi_vault/jwt/_inputs.py +50 -51
- pulumi_vault/jwt/auth_backend.py +400 -354
- pulumi_vault/jwt/auth_backend_role.py +494 -495
- pulumi_vault/jwt/outputs.py +34 -35
- pulumi_vault/kmip/__init__.py +1 -1
- pulumi_vault/kmip/secret_backend.py +1006 -227
- pulumi_vault/kmip/secret_role.py +358 -359
- pulumi_vault/kmip/secret_scope.py +69 -70
- pulumi_vault/kubernetes/__init__.py +1 -1
- pulumi_vault/kubernetes/auth_backend_config.py +171 -172
- pulumi_vault/kubernetes/auth_backend_role.py +273 -274
- pulumi_vault/kubernetes/get_auth_backend_config.py +57 -58
- pulumi_vault/kubernetes/get_auth_backend_role.py +87 -88
- pulumi_vault/kubernetes/get_service_account_token.py +51 -52
- pulumi_vault/kubernetes/secret_backend.py +431 -385
- pulumi_vault/kubernetes/secret_backend_role.py +239 -240
- pulumi_vault/kv/__init__.py +1 -1
- pulumi_vault/kv/_inputs.py +25 -26
- pulumi_vault/kv/get_secret.py +25 -26
- pulumi_vault/kv/get_secret_subkeys_v2.py +39 -40
- pulumi_vault/kv/get_secret_v2.py +41 -42
- pulumi_vault/kv/get_secrets_list.py +17 -18
- pulumi_vault/kv/get_secrets_list_v2.py +25 -26
- pulumi_vault/kv/outputs.py +17 -18
- pulumi_vault/kv/secret.py +61 -62
- pulumi_vault/kv/secret_backend_v2.py +86 -87
- pulumi_vault/kv/secret_v2.py +184 -185
- pulumi_vault/ldap/__init__.py +1 -1
- pulumi_vault/ldap/auth_backend.py +716 -717
- pulumi_vault/ldap/auth_backend_group.py +69 -70
- pulumi_vault/ldap/auth_backend_user.py +86 -87
- pulumi_vault/ldap/get_dynamic_credentials.py +27 -28
- pulumi_vault/ldap/get_static_credentials.py +29 -30
- pulumi_vault/ldap/secret_backend.py +732 -693
- pulumi_vault/ldap/secret_backend_dynamic_role.py +154 -155
- pulumi_vault/ldap/secret_backend_library_set.py +120 -121
- pulumi_vault/ldap/secret_backend_static_role.py +120 -121
- pulumi_vault/managed/__init__.py +1 -1
- pulumi_vault/managed/_inputs.py +274 -275
- pulumi_vault/managed/keys.py +27 -28
- pulumi_vault/managed/outputs.py +184 -185
- pulumi_vault/mfa_duo.py +137 -138
- pulumi_vault/mfa_okta.py +137 -138
- pulumi_vault/mfa_pingid.py +149 -150
- pulumi_vault/mfa_totp.py +154 -155
- pulumi_vault/mongodbatlas/__init__.py +1 -1
- pulumi_vault/mongodbatlas/secret_backend.py +78 -79
- pulumi_vault/mongodbatlas/secret_role.py +188 -189
- pulumi_vault/mount.py +380 -334
- pulumi_vault/namespace.py +78 -79
- pulumi_vault/nomad_secret_backend.py +909 -271
- pulumi_vault/nomad_secret_role.py +103 -104
- pulumi_vault/oci_auth_backend.py +683 -0
- pulumi_vault/oci_auth_backend_role.py +798 -0
- pulumi_vault/okta/__init__.py +1 -1
- pulumi_vault/okta/_inputs.py +31 -32
- pulumi_vault/okta/auth_backend.py +305 -306
- pulumi_vault/okta/auth_backend_group.py +69 -70
- pulumi_vault/okta/auth_backend_user.py +86 -87
- pulumi_vault/okta/outputs.py +21 -22
- pulumi_vault/outputs.py +234 -82
- pulumi_vault/pkisecret/__init__.py +1 -1
- pulumi_vault/pkisecret/_inputs.py +55 -56
- pulumi_vault/pkisecret/backend_acme_eab.py +116 -117
- pulumi_vault/pkisecret/backend_config_acme.py +175 -176
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +394 -395
- pulumi_vault/pkisecret/backend_config_cluster.py +71 -72
- pulumi_vault/pkisecret/backend_config_cmpv2.py +132 -133
- pulumi_vault/pkisecret/backend_config_est.py +149 -150
- pulumi_vault/pkisecret/backend_config_scep.py +205 -159
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +37 -38
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +32 -33
- pulumi_vault/pkisecret/get_backend_config_est.py +30 -31
- pulumi_vault/pkisecret/get_backend_config_scep.py +50 -31
- pulumi_vault/pkisecret/get_backend_issuer.py +63 -64
- pulumi_vault/pkisecret/get_backend_issuers.py +23 -24
- pulumi_vault/pkisecret/get_backend_key.py +29 -30
- pulumi_vault/pkisecret/get_backend_keys.py +23 -24
- pulumi_vault/pkisecret/outputs.py +61 -62
- pulumi_vault/pkisecret/secret_backend_cert.py +415 -416
- pulumi_vault/pkisecret/secret_backend_config_ca.py +54 -55
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +75 -76
- pulumi_vault/pkisecret/secret_backend_config_urls.py +105 -106
- pulumi_vault/pkisecret/secret_backend_crl_config.py +241 -242
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +515 -516
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +78 -79
- pulumi_vault/pkisecret/secret_backend_issuer.py +286 -287
- pulumi_vault/pkisecret/secret_backend_key.py +146 -147
- pulumi_vault/pkisecret/secret_backend_role.py +873 -874
- pulumi_vault/pkisecret/secret_backend_root_cert.py +677 -678
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +660 -661
- pulumi_vault/pkisecret/secret_backend_sign.py +346 -347
- pulumi_vault/plugin.py +154 -155
- pulumi_vault/plugin_pinned_version.py +52 -53
- pulumi_vault/policy.py +52 -53
- pulumi_vault/provider.py +160 -161
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +103 -104
- pulumi_vault/quota_rate_limit.py +171 -172
- pulumi_vault/rabbitmq/__init__.py +1 -1
- pulumi_vault/rabbitmq/_inputs.py +50 -51
- pulumi_vault/rabbitmq/outputs.py +34 -35
- pulumi_vault/rabbitmq/secret_backend.py +902 -231
- pulumi_vault/rabbitmq/secret_backend_role.py +79 -80
- pulumi_vault/raft_autopilot.py +137 -138
- pulumi_vault/raft_snapshot_agent_config.py +477 -478
- pulumi_vault/rgp_policy.py +69 -70
- pulumi_vault/saml/__init__.py +1 -1
- pulumi_vault/saml/auth_backend.py +188 -189
- pulumi_vault/saml/auth_backend_role.py +290 -291
- pulumi_vault/scep_auth_backend_role.py +252 -253
- pulumi_vault/secrets/__init__.py +1 -1
- pulumi_vault/secrets/_inputs.py +19 -20
- pulumi_vault/secrets/outputs.py +13 -14
- pulumi_vault/secrets/sync_association.py +88 -89
- pulumi_vault/secrets/sync_aws_destination.py +180 -181
- pulumi_vault/secrets/sync_azure_destination.py +180 -181
- pulumi_vault/secrets/sync_config.py +52 -53
- pulumi_vault/secrets/sync_gcp_destination.py +129 -130
- pulumi_vault/secrets/sync_gh_destination.py +163 -164
- pulumi_vault/secrets/sync_github_apps.py +78 -79
- pulumi_vault/secrets/sync_vercel_destination.py +146 -147
- pulumi_vault/ssh/__init__.py +1 -1
- pulumi_vault/ssh/_inputs.py +13 -14
- pulumi_vault/ssh/get_secret_backend_sign.py +65 -66
- pulumi_vault/ssh/outputs.py +9 -10
- pulumi_vault/ssh/secret_backend_ca.py +217 -124
- pulumi_vault/ssh/secret_backend_role.py +446 -447
- pulumi_vault/terraformcloud/__init__.py +1 -1
- pulumi_vault/terraformcloud/secret_backend.py +833 -155
- pulumi_vault/terraformcloud/secret_creds.py +93 -94
- pulumi_vault/terraformcloud/secret_role.py +117 -118
- pulumi_vault/token.py +301 -302
- pulumi_vault/tokenauth/__init__.py +1 -1
- pulumi_vault/tokenauth/auth_backend_role.py +324 -325
- pulumi_vault/transform/__init__.py +1 -1
- pulumi_vault/transform/alphabet.py +69 -70
- pulumi_vault/transform/get_decode.py +57 -58
- pulumi_vault/transform/get_encode.py +57 -58
- pulumi_vault/transform/role.py +69 -70
- pulumi_vault/transform/template.py +137 -138
- pulumi_vault/transform/transformation.py +171 -172
- pulumi_vault/transit/__init__.py +1 -1
- pulumi_vault/transit/get_cmac.py +47 -48
- pulumi_vault/transit/get_decrypt.py +25 -26
- pulumi_vault/transit/get_encrypt.py +29 -30
- pulumi_vault/transit/get_sign.py +71 -72
- pulumi_vault/transit/get_verify.py +83 -84
- pulumi_vault/transit/secret_backend_key.py +377 -350
- pulumi_vault/transit/secret_cache_config.py +52 -53
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/METADATA +1 -1
- pulumi_vault-7.2.0.dist-info/RECORD +270 -0
- pulumi_vault-7.1.0.dist-info/RECORD +0 -268
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/top_level.txt +0 -0
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -20,68 +19,90 @@ __all__ = ['SecretBackendArgs', 'SecretBackend']
|
|
|
20
19
|
@pulumi.input_type
|
|
21
20
|
class SecretBackendArgs:
|
|
22
21
|
def __init__(__self__, *,
|
|
23
|
-
access_key: Optional[pulumi.Input[
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
22
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
23
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
24
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
25
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
26
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
27
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
28
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
29
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
31
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
32
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
33
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
34
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
35
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
36
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
38
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
39
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
40
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
41
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
42
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
43
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
44
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
45
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
46
|
+
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
47
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
48
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
49
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
50
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
51
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
52
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
53
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
54
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
55
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
56
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
57
|
+
username_template: Optional[pulumi.Input[_builtins.str]] = None):
|
|
47
58
|
"""
|
|
48
59
|
The set of arguments for constructing a SecretBackend resource.
|
|
49
|
-
:param pulumi.Input[
|
|
60
|
+
:param pulumi.Input[_builtins.str] access_key: The AWS Access Key ID this backend should use to
|
|
50
61
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
51
|
-
:param pulumi.Input[
|
|
52
|
-
|
|
53
|
-
:param pulumi.Input[
|
|
54
|
-
:param pulumi.Input[
|
|
55
|
-
:param pulumi.Input[
|
|
62
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
63
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
64
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
65
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
66
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
67
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
68
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
69
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
70
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
56
71
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
57
|
-
:param pulumi.Input[
|
|
58
|
-
:param pulumi.Input[
|
|
59
|
-
:param pulumi.Input[
|
|
60
|
-
:param pulumi.Input[
|
|
61
|
-
:param pulumi.Input[
|
|
62
|
-
:param pulumi.Input[
|
|
63
|
-
|
|
64
|
-
:param pulumi.Input[
|
|
72
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
73
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
74
|
+
:param pulumi.Input[_builtins.str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
75
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
|
|
76
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
77
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
78
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
79
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the secret backend is local only
|
|
80
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
81
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
65
82
|
The value should not contain leading or trailing forward slashes.
|
|
66
83
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
67
84
|
*Available only for Vault Enterprise*.
|
|
68
|
-
:param pulumi.Input[
|
|
85
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
86
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
87
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
69
88
|
not begin or end with a `/`. Defaults to `aws`.
|
|
70
|
-
:param pulumi.Input[
|
|
71
|
-
:param pulumi.Input[
|
|
72
|
-
:param pulumi.Input[
|
|
89
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
90
|
+
:param pulumi.Input[_builtins.str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
91
|
+
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
92
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
73
93
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
74
|
-
:param pulumi.Input[
|
|
94
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
75
95
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
76
|
-
:param pulumi.Input[
|
|
96
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
77
97
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
78
98
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
79
|
-
:param pulumi.Input[
|
|
80
|
-
:param pulumi.Input[
|
|
81
|
-
:param pulumi.Input[
|
|
82
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
83
|
-
:param pulumi.Input[
|
|
84
|
-
:param pulumi.Input[
|
|
99
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
100
|
+
:param pulumi.Input[_builtins.str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
101
|
+
:param pulumi.Input[_builtins.str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
102
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
103
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_regions: Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
104
|
+
:param pulumi.Input[_builtins.str] sts_region: Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
105
|
+
:param pulumi.Input[_builtins.str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
85
106
|
|
|
86
107
|
```
|
|
87
108
|
{{ if (eq .Type "STS") }}
|
|
@@ -94,14 +115,28 @@ class SecretBackendArgs:
|
|
|
94
115
|
"""
|
|
95
116
|
if access_key is not None:
|
|
96
117
|
pulumi.set(__self__, "access_key", access_key)
|
|
118
|
+
if allowed_managed_keys is not None:
|
|
119
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
120
|
+
if allowed_response_headers is not None:
|
|
121
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
122
|
+
if audit_non_hmac_request_keys is not None:
|
|
123
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
124
|
+
if audit_non_hmac_response_keys is not None:
|
|
125
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
97
126
|
if default_lease_ttl_seconds is not None:
|
|
98
127
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
128
|
+
if delegated_auth_accessors is not None:
|
|
129
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
99
130
|
if description is not None:
|
|
100
131
|
pulumi.set(__self__, "description", description)
|
|
101
132
|
if disable_automated_rotation is not None:
|
|
102
133
|
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
103
134
|
if disable_remount is not None:
|
|
104
135
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
136
|
+
if external_entropy_access is not None:
|
|
137
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
138
|
+
if force_no_cache is not None:
|
|
139
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
105
140
|
if iam_endpoint is not None:
|
|
106
141
|
pulumi.set(__self__, "iam_endpoint", iam_endpoint)
|
|
107
142
|
if identity_token_audience is not None:
|
|
@@ -110,14 +145,22 @@ class SecretBackendArgs:
|
|
|
110
145
|
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
111
146
|
if identity_token_ttl is not None:
|
|
112
147
|
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
148
|
+
if listing_visibility is not None:
|
|
149
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
113
150
|
if local is not None:
|
|
114
151
|
pulumi.set(__self__, "local", local)
|
|
115
152
|
if max_lease_ttl_seconds is not None:
|
|
116
153
|
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
117
154
|
if namespace is not None:
|
|
118
155
|
pulumi.set(__self__, "namespace", namespace)
|
|
156
|
+
if options is not None:
|
|
157
|
+
pulumi.set(__self__, "options", options)
|
|
158
|
+
if passthrough_request_headers is not None:
|
|
159
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
119
160
|
if path is not None:
|
|
120
161
|
pulumi.set(__self__, "path", path)
|
|
162
|
+
if plugin_version is not None:
|
|
163
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
121
164
|
if region is not None:
|
|
122
165
|
pulumi.set(__self__, "region", region)
|
|
123
166
|
if role_arn is not None:
|
|
@@ -128,6 +171,8 @@ class SecretBackendArgs:
|
|
|
128
171
|
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
129
172
|
if rotation_window is not None:
|
|
130
173
|
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
174
|
+
if seal_wrap is not None:
|
|
175
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
131
176
|
if secret_key is not None:
|
|
132
177
|
pulumi.set(__self__, "secret_key", secret_key)
|
|
133
178
|
if sts_endpoint is not None:
|
|
@@ -141,9 +186,9 @@ class SecretBackendArgs:
|
|
|
141
186
|
if username_template is not None:
|
|
142
187
|
pulumi.set(__self__, "username_template", username_template)
|
|
143
188
|
|
|
144
|
-
@property
|
|
189
|
+
@_builtins.property
|
|
145
190
|
@pulumi.getter(name="accessKey")
|
|
146
|
-
def access_key(self) -> Optional[pulumi.Input[
|
|
191
|
+
def access_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
147
192
|
"""
|
|
148
193
|
The AWS Access Key ID this backend should use to
|
|
149
194
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
@@ -151,49 +196,108 @@ class SecretBackendArgs:
|
|
|
151
196
|
return pulumi.get(self, "access_key")
|
|
152
197
|
|
|
153
198
|
@access_key.setter
|
|
154
|
-
def access_key(self, value: Optional[pulumi.Input[
|
|
199
|
+
def access_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
155
200
|
pulumi.set(self, "access_key", value)
|
|
156
201
|
|
|
157
|
-
@property
|
|
202
|
+
@_builtins.property
|
|
203
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
204
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
205
|
+
"""
|
|
206
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
207
|
+
"""
|
|
208
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
209
|
+
|
|
210
|
+
@allowed_managed_keys.setter
|
|
211
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
212
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
213
|
+
|
|
214
|
+
@_builtins.property
|
|
215
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
216
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
217
|
+
"""
|
|
218
|
+
List of headers to allow and pass from the request to the plugin
|
|
219
|
+
"""
|
|
220
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
221
|
+
|
|
222
|
+
@allowed_response_headers.setter
|
|
223
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
224
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
225
|
+
|
|
226
|
+
@_builtins.property
|
|
227
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
228
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
229
|
+
"""
|
|
230
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
231
|
+
"""
|
|
232
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
233
|
+
|
|
234
|
+
@audit_non_hmac_request_keys.setter
|
|
235
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
236
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
237
|
+
|
|
238
|
+
@_builtins.property
|
|
239
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
240
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
241
|
+
"""
|
|
242
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
243
|
+
"""
|
|
244
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
245
|
+
|
|
246
|
+
@audit_non_hmac_response_keys.setter
|
|
247
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
248
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
249
|
+
|
|
250
|
+
@_builtins.property
|
|
158
251
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
159
|
-
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[
|
|
252
|
+
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
160
253
|
"""
|
|
161
|
-
|
|
162
|
-
issued by this backend.
|
|
254
|
+
Default lease duration for secrets in seconds
|
|
163
255
|
"""
|
|
164
256
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
165
257
|
|
|
166
258
|
@default_lease_ttl_seconds.setter
|
|
167
|
-
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[
|
|
259
|
+
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
168
260
|
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
169
261
|
|
|
170
|
-
@property
|
|
262
|
+
@_builtins.property
|
|
263
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
264
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
265
|
+
"""
|
|
266
|
+
List of headers to allow and pass from the request to the plugin
|
|
267
|
+
"""
|
|
268
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
269
|
+
|
|
270
|
+
@delegated_auth_accessors.setter
|
|
271
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
272
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
273
|
+
|
|
274
|
+
@_builtins.property
|
|
171
275
|
@pulumi.getter
|
|
172
|
-
def description(self) -> Optional[pulumi.Input[
|
|
276
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
173
277
|
"""
|
|
174
|
-
|
|
278
|
+
Human-friendly description of the mount for the backend.
|
|
175
279
|
"""
|
|
176
280
|
return pulumi.get(self, "description")
|
|
177
281
|
|
|
178
282
|
@description.setter
|
|
179
|
-
def description(self, value: Optional[pulumi.Input[
|
|
283
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
180
284
|
pulumi.set(self, "description", value)
|
|
181
285
|
|
|
182
|
-
@property
|
|
286
|
+
@_builtins.property
|
|
183
287
|
@pulumi.getter(name="disableAutomatedRotation")
|
|
184
|
-
def disable_automated_rotation(self) -> Optional[pulumi.Input[
|
|
288
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
185
289
|
"""
|
|
186
290
|
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
187
291
|
"""
|
|
188
292
|
return pulumi.get(self, "disable_automated_rotation")
|
|
189
293
|
|
|
190
294
|
@disable_automated_rotation.setter
|
|
191
|
-
def disable_automated_rotation(self, value: Optional[pulumi.Input[
|
|
295
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
192
296
|
pulumi.set(self, "disable_automated_rotation", value)
|
|
193
297
|
|
|
194
|
-
@property
|
|
298
|
+
@_builtins.property
|
|
195
299
|
@pulumi.getter(name="disableRemount")
|
|
196
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
300
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
197
301
|
"""
|
|
198
302
|
If set, opts out of mount migration on path updates.
|
|
199
303
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -201,85 +305,120 @@ class SecretBackendArgs:
|
|
|
201
305
|
return pulumi.get(self, "disable_remount")
|
|
202
306
|
|
|
203
307
|
@disable_remount.setter
|
|
204
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
308
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
205
309
|
pulumi.set(self, "disable_remount", value)
|
|
206
310
|
|
|
207
|
-
@property
|
|
311
|
+
@_builtins.property
|
|
312
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
313
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
314
|
+
"""
|
|
315
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
316
|
+
"""
|
|
317
|
+
return pulumi.get(self, "external_entropy_access")
|
|
318
|
+
|
|
319
|
+
@external_entropy_access.setter
|
|
320
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
321
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
322
|
+
|
|
323
|
+
@_builtins.property
|
|
324
|
+
@pulumi.getter(name="forceNoCache")
|
|
325
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
326
|
+
"""
|
|
327
|
+
If set to true, disables caching.
|
|
328
|
+
"""
|
|
329
|
+
return pulumi.get(self, "force_no_cache")
|
|
330
|
+
|
|
331
|
+
@force_no_cache.setter
|
|
332
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
333
|
+
pulumi.set(self, "force_no_cache", value)
|
|
334
|
+
|
|
335
|
+
@_builtins.property
|
|
208
336
|
@pulumi.getter(name="iamEndpoint")
|
|
209
|
-
def iam_endpoint(self) -> Optional[pulumi.Input[
|
|
337
|
+
def iam_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
210
338
|
"""
|
|
211
339
|
Specifies a custom HTTP IAM endpoint to use.
|
|
212
340
|
"""
|
|
213
341
|
return pulumi.get(self, "iam_endpoint")
|
|
214
342
|
|
|
215
343
|
@iam_endpoint.setter
|
|
216
|
-
def iam_endpoint(self, value: Optional[pulumi.Input[
|
|
344
|
+
def iam_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
217
345
|
pulumi.set(self, "iam_endpoint", value)
|
|
218
346
|
|
|
219
|
-
@property
|
|
347
|
+
@_builtins.property
|
|
220
348
|
@pulumi.getter(name="identityTokenAudience")
|
|
221
|
-
def identity_token_audience(self) -> Optional[pulumi.Input[
|
|
349
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
222
350
|
"""
|
|
223
351
|
The audience claim value. Requires Vault 1.16+.
|
|
224
352
|
"""
|
|
225
353
|
return pulumi.get(self, "identity_token_audience")
|
|
226
354
|
|
|
227
355
|
@identity_token_audience.setter
|
|
228
|
-
def identity_token_audience(self, value: Optional[pulumi.Input[
|
|
356
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
229
357
|
pulumi.set(self, "identity_token_audience", value)
|
|
230
358
|
|
|
231
|
-
@property
|
|
359
|
+
@_builtins.property
|
|
232
360
|
@pulumi.getter(name="identityTokenKey")
|
|
233
|
-
def identity_token_key(self) -> Optional[pulumi.Input[
|
|
361
|
+
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
234
362
|
"""
|
|
235
|
-
The key to use for signing identity tokens.
|
|
363
|
+
The key to use for signing identity tokens.
|
|
236
364
|
"""
|
|
237
365
|
return pulumi.get(self, "identity_token_key")
|
|
238
366
|
|
|
239
367
|
@identity_token_key.setter
|
|
240
|
-
def identity_token_key(self, value: Optional[pulumi.Input[
|
|
368
|
+
def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
241
369
|
pulumi.set(self, "identity_token_key", value)
|
|
242
370
|
|
|
243
|
-
@property
|
|
371
|
+
@_builtins.property
|
|
244
372
|
@pulumi.getter(name="identityTokenTtl")
|
|
245
|
-
def identity_token_ttl(self) -> Optional[pulumi.Input[
|
|
373
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
246
374
|
"""
|
|
247
375
|
The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
248
376
|
"""
|
|
249
377
|
return pulumi.get(self, "identity_token_ttl")
|
|
250
378
|
|
|
251
379
|
@identity_token_ttl.setter
|
|
252
|
-
def identity_token_ttl(self, value: Optional[pulumi.Input[
|
|
380
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
253
381
|
pulumi.set(self, "identity_token_ttl", value)
|
|
254
382
|
|
|
255
|
-
@property
|
|
383
|
+
@_builtins.property
|
|
384
|
+
@pulumi.getter(name="listingVisibility")
|
|
385
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
386
|
+
"""
|
|
387
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
388
|
+
"""
|
|
389
|
+
return pulumi.get(self, "listing_visibility")
|
|
390
|
+
|
|
391
|
+
@listing_visibility.setter
|
|
392
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
393
|
+
pulumi.set(self, "listing_visibility", value)
|
|
394
|
+
|
|
395
|
+
@_builtins.property
|
|
256
396
|
@pulumi.getter
|
|
257
|
-
def local(self) -> Optional[pulumi.Input[
|
|
397
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
258
398
|
"""
|
|
259
|
-
Specifies
|
|
399
|
+
Specifies if the secret backend is local only
|
|
260
400
|
"""
|
|
261
401
|
return pulumi.get(self, "local")
|
|
262
402
|
|
|
263
403
|
@local.setter
|
|
264
|
-
def local(self, value: Optional[pulumi.Input[
|
|
404
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
265
405
|
pulumi.set(self, "local", value)
|
|
266
406
|
|
|
267
|
-
@property
|
|
407
|
+
@_builtins.property
|
|
268
408
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
269
|
-
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[
|
|
409
|
+
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
270
410
|
"""
|
|
271
|
-
|
|
272
|
-
for credentials issued by this backend.
|
|
411
|
+
Maximum possible lease duration for secrets in seconds
|
|
273
412
|
"""
|
|
274
413
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
275
414
|
|
|
276
415
|
@max_lease_ttl_seconds.setter
|
|
277
|
-
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[
|
|
416
|
+
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
278
417
|
pulumi.set(self, "max_lease_ttl_seconds", value)
|
|
279
418
|
|
|
280
|
-
@property
|
|
419
|
+
@_builtins.property
|
|
281
420
|
@pulumi.getter
|
|
282
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
421
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
283
422
|
"""
|
|
284
423
|
The namespace to provision the resource in.
|
|
285
424
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -289,12 +428,36 @@ class SecretBackendArgs:
|
|
|
289
428
|
return pulumi.get(self, "namespace")
|
|
290
429
|
|
|
291
430
|
@namespace.setter
|
|
292
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
431
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
293
432
|
pulumi.set(self, "namespace", value)
|
|
294
433
|
|
|
295
|
-
@property
|
|
434
|
+
@_builtins.property
|
|
435
|
+
@pulumi.getter
|
|
436
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
437
|
+
"""
|
|
438
|
+
Specifies mount type specific options that are passed to the backend
|
|
439
|
+
"""
|
|
440
|
+
return pulumi.get(self, "options")
|
|
441
|
+
|
|
442
|
+
@options.setter
|
|
443
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
444
|
+
pulumi.set(self, "options", value)
|
|
445
|
+
|
|
446
|
+
@_builtins.property
|
|
447
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
448
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
449
|
+
"""
|
|
450
|
+
List of headers to allow and pass from the request to the plugin
|
|
451
|
+
"""
|
|
452
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
453
|
+
|
|
454
|
+
@passthrough_request_headers.setter
|
|
455
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
456
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
457
|
+
|
|
458
|
+
@_builtins.property
|
|
296
459
|
@pulumi.getter
|
|
297
|
-
def path(self) -> Optional[pulumi.Input[
|
|
460
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
298
461
|
"""
|
|
299
462
|
The unique path this backend should be mounted at. Must
|
|
300
463
|
not begin or end with a `/`. Defaults to `aws`.
|
|
@@ -302,36 +465,48 @@ class SecretBackendArgs:
|
|
|
302
465
|
return pulumi.get(self, "path")
|
|
303
466
|
|
|
304
467
|
@path.setter
|
|
305
|
-
def path(self, value: Optional[pulumi.Input[
|
|
468
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
306
469
|
pulumi.set(self, "path", value)
|
|
307
470
|
|
|
308
|
-
@property
|
|
471
|
+
@_builtins.property
|
|
472
|
+
@pulumi.getter(name="pluginVersion")
|
|
473
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
474
|
+
"""
|
|
475
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
476
|
+
"""
|
|
477
|
+
return pulumi.get(self, "plugin_version")
|
|
478
|
+
|
|
479
|
+
@plugin_version.setter
|
|
480
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
481
|
+
pulumi.set(self, "plugin_version", value)
|
|
482
|
+
|
|
483
|
+
@_builtins.property
|
|
309
484
|
@pulumi.getter
|
|
310
|
-
def region(self) -> Optional[pulumi.Input[
|
|
485
|
+
def region(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
311
486
|
"""
|
|
312
487
|
The AWS region to make API calls against. Defaults to us-east-1.
|
|
313
488
|
"""
|
|
314
489
|
return pulumi.get(self, "region")
|
|
315
490
|
|
|
316
491
|
@region.setter
|
|
317
|
-
def region(self, value: Optional[pulumi.Input[
|
|
492
|
+
def region(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
318
493
|
pulumi.set(self, "region", value)
|
|
319
494
|
|
|
320
|
-
@property
|
|
495
|
+
@_builtins.property
|
|
321
496
|
@pulumi.getter(name="roleArn")
|
|
322
|
-
def role_arn(self) -> Optional[pulumi.Input[
|
|
497
|
+
def role_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
323
498
|
"""
|
|
324
499
|
Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
325
500
|
"""
|
|
326
501
|
return pulumi.get(self, "role_arn")
|
|
327
502
|
|
|
328
503
|
@role_arn.setter
|
|
329
|
-
def role_arn(self, value: Optional[pulumi.Input[
|
|
504
|
+
def role_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
330
505
|
pulumi.set(self, "role_arn", value)
|
|
331
506
|
|
|
332
|
-
@property
|
|
507
|
+
@_builtins.property
|
|
333
508
|
@pulumi.getter(name="rotationPeriod")
|
|
334
|
-
def rotation_period(self) -> Optional[pulumi.Input[
|
|
509
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
335
510
|
"""
|
|
336
511
|
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
337
512
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
@@ -339,12 +514,12 @@ class SecretBackendArgs:
|
|
|
339
514
|
return pulumi.get(self, "rotation_period")
|
|
340
515
|
|
|
341
516
|
@rotation_period.setter
|
|
342
|
-
def rotation_period(self, value: Optional[pulumi.Input[
|
|
517
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
343
518
|
pulumi.set(self, "rotation_period", value)
|
|
344
519
|
|
|
345
|
-
@property
|
|
520
|
+
@_builtins.property
|
|
346
521
|
@pulumi.getter(name="rotationSchedule")
|
|
347
|
-
def rotation_schedule(self) -> Optional[pulumi.Input[
|
|
522
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
348
523
|
"""
|
|
349
524
|
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
350
525
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
@@ -352,12 +527,12 @@ class SecretBackendArgs:
|
|
|
352
527
|
return pulumi.get(self, "rotation_schedule")
|
|
353
528
|
|
|
354
529
|
@rotation_schedule.setter
|
|
355
|
-
def rotation_schedule(self, value: Optional[pulumi.Input[
|
|
530
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
356
531
|
pulumi.set(self, "rotation_schedule", value)
|
|
357
532
|
|
|
358
|
-
@property
|
|
533
|
+
@_builtins.property
|
|
359
534
|
@pulumi.getter(name="rotationWindow")
|
|
360
|
-
def rotation_window(self) -> Optional[pulumi.Input[
|
|
535
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
361
536
|
"""
|
|
362
537
|
The maximum amount of time in seconds allowed to complete
|
|
363
538
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
@@ -366,72 +541,84 @@ class SecretBackendArgs:
|
|
|
366
541
|
return pulumi.get(self, "rotation_window")
|
|
367
542
|
|
|
368
543
|
@rotation_window.setter
|
|
369
|
-
def rotation_window(self, value: Optional[pulumi.Input[
|
|
544
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
370
545
|
pulumi.set(self, "rotation_window", value)
|
|
371
546
|
|
|
372
|
-
@property
|
|
547
|
+
@_builtins.property
|
|
548
|
+
@pulumi.getter(name="sealWrap")
|
|
549
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
550
|
+
"""
|
|
551
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
552
|
+
"""
|
|
553
|
+
return pulumi.get(self, "seal_wrap")
|
|
554
|
+
|
|
555
|
+
@seal_wrap.setter
|
|
556
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
557
|
+
pulumi.set(self, "seal_wrap", value)
|
|
558
|
+
|
|
559
|
+
@_builtins.property
|
|
373
560
|
@pulumi.getter(name="secretKey")
|
|
374
|
-
def secret_key(self) -> Optional[pulumi.Input[
|
|
561
|
+
def secret_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
375
562
|
"""
|
|
376
563
|
The AWS Secret Access Key to use when generating new credentials.
|
|
377
564
|
"""
|
|
378
565
|
return pulumi.get(self, "secret_key")
|
|
379
566
|
|
|
380
567
|
@secret_key.setter
|
|
381
|
-
def secret_key(self, value: Optional[pulumi.Input[
|
|
568
|
+
def secret_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
382
569
|
pulumi.set(self, "secret_key", value)
|
|
383
570
|
|
|
384
|
-
@property
|
|
571
|
+
@_builtins.property
|
|
385
572
|
@pulumi.getter(name="stsEndpoint")
|
|
386
|
-
def sts_endpoint(self) -> Optional[pulumi.Input[
|
|
573
|
+
def sts_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
387
574
|
"""
|
|
388
575
|
Specifies a custom HTTP STS endpoint to use.
|
|
389
576
|
"""
|
|
390
577
|
return pulumi.get(self, "sts_endpoint")
|
|
391
578
|
|
|
392
579
|
@sts_endpoint.setter
|
|
393
|
-
def sts_endpoint(self, value: Optional[pulumi.Input[
|
|
580
|
+
def sts_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
394
581
|
pulumi.set(self, "sts_endpoint", value)
|
|
395
582
|
|
|
396
|
-
@property
|
|
583
|
+
@_builtins.property
|
|
397
584
|
@pulumi.getter(name="stsFallbackEndpoints")
|
|
398
|
-
def sts_fallback_endpoints(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
585
|
+
def sts_fallback_endpoints(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
399
586
|
"""
|
|
400
587
|
Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
401
588
|
"""
|
|
402
589
|
return pulumi.get(self, "sts_fallback_endpoints")
|
|
403
590
|
|
|
404
591
|
@sts_fallback_endpoints.setter
|
|
405
|
-
def sts_fallback_endpoints(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
592
|
+
def sts_fallback_endpoints(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
406
593
|
pulumi.set(self, "sts_fallback_endpoints", value)
|
|
407
594
|
|
|
408
|
-
@property
|
|
595
|
+
@_builtins.property
|
|
409
596
|
@pulumi.getter(name="stsFallbackRegions")
|
|
410
|
-
def sts_fallback_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
597
|
+
def sts_fallback_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
411
598
|
"""
|
|
412
599
|
Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
413
600
|
"""
|
|
414
601
|
return pulumi.get(self, "sts_fallback_regions")
|
|
415
602
|
|
|
416
603
|
@sts_fallback_regions.setter
|
|
417
|
-
def sts_fallback_regions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
604
|
+
def sts_fallback_regions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
418
605
|
pulumi.set(self, "sts_fallback_regions", value)
|
|
419
606
|
|
|
420
|
-
@property
|
|
607
|
+
@_builtins.property
|
|
421
608
|
@pulumi.getter(name="stsRegion")
|
|
422
|
-
def sts_region(self) -> Optional[pulumi.Input[
|
|
609
|
+
def sts_region(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
423
610
|
"""
|
|
424
611
|
Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
425
612
|
"""
|
|
426
613
|
return pulumi.get(self, "sts_region")
|
|
427
614
|
|
|
428
615
|
@sts_region.setter
|
|
429
|
-
def sts_region(self, value: Optional[pulumi.Input[
|
|
616
|
+
def sts_region(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
430
617
|
pulumi.set(self, "sts_region", value)
|
|
431
618
|
|
|
432
|
-
@property
|
|
619
|
+
@_builtins.property
|
|
433
620
|
@pulumi.getter(name="usernameTemplate")
|
|
434
|
-
def username_template(self) -> Optional[pulumi.Input[
|
|
621
|
+
def username_template(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
435
622
|
"""
|
|
436
623
|
Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
437
624
|
|
|
@@ -447,75 +634,99 @@ class SecretBackendArgs:
|
|
|
447
634
|
return pulumi.get(self, "username_template")
|
|
448
635
|
|
|
449
636
|
@username_template.setter
|
|
450
|
-
def username_template(self, value: Optional[pulumi.Input[
|
|
637
|
+
def username_template(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
451
638
|
pulumi.set(self, "username_template", value)
|
|
452
639
|
|
|
453
640
|
|
|
454
641
|
@pulumi.input_type
|
|
455
642
|
class _SecretBackendState:
|
|
456
643
|
def __init__(__self__, *,
|
|
457
|
-
access_key: Optional[pulumi.Input[
|
|
458
|
-
|
|
459
|
-
|
|
460
|
-
|
|
461
|
-
|
|
462
|
-
|
|
463
|
-
|
|
464
|
-
|
|
465
|
-
|
|
466
|
-
|
|
467
|
-
|
|
468
|
-
|
|
469
|
-
|
|
470
|
-
|
|
471
|
-
|
|
472
|
-
|
|
473
|
-
|
|
474
|
-
|
|
475
|
-
|
|
476
|
-
|
|
477
|
-
|
|
478
|
-
|
|
479
|
-
|
|
480
|
-
|
|
644
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
645
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
646
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
647
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
648
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
649
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
650
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
651
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
652
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
653
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
654
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
655
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
656
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
657
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
658
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
659
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
660
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
661
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
662
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
663
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
664
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
665
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
666
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
667
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
668
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
669
|
+
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
670
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
671
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
672
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
673
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
674
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
675
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
676
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
677
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
678
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
679
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
680
|
+
username_template: Optional[pulumi.Input[_builtins.str]] = None):
|
|
481
681
|
"""
|
|
482
682
|
Input properties used for looking up and filtering SecretBackend resources.
|
|
483
|
-
:param pulumi.Input[
|
|
683
|
+
:param pulumi.Input[_builtins.str] access_key: The AWS Access Key ID this backend should use to
|
|
484
684
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
485
|
-
:param pulumi.Input[
|
|
486
|
-
|
|
487
|
-
:param pulumi.Input[
|
|
488
|
-
:param pulumi.Input[
|
|
489
|
-
:param pulumi.Input[
|
|
685
|
+
:param pulumi.Input[_builtins.str] accessor: Accessor of the mount
|
|
686
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
687
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
688
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
689
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
690
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
691
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
692
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
693
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
694
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
490
695
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
491
|
-
:param pulumi.Input[
|
|
492
|
-
:param pulumi.Input[
|
|
493
|
-
:param pulumi.Input[
|
|
494
|
-
:param pulumi.Input[
|
|
495
|
-
:param pulumi.Input[
|
|
496
|
-
:param pulumi.Input[
|
|
497
|
-
|
|
498
|
-
:param pulumi.Input[
|
|
696
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
697
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
698
|
+
:param pulumi.Input[_builtins.str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
699
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
|
|
700
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
701
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
702
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
703
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the secret backend is local only
|
|
704
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
705
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
499
706
|
The value should not contain leading or trailing forward slashes.
|
|
500
707
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
501
708
|
*Available only for Vault Enterprise*.
|
|
502
|
-
:param pulumi.Input[
|
|
709
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
710
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
711
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
503
712
|
not begin or end with a `/`. Defaults to `aws`.
|
|
504
|
-
:param pulumi.Input[
|
|
505
|
-
:param pulumi.Input[
|
|
506
|
-
:param pulumi.Input[
|
|
713
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
714
|
+
:param pulumi.Input[_builtins.str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
715
|
+
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
716
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
507
717
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
508
|
-
:param pulumi.Input[
|
|
718
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
509
719
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
510
|
-
:param pulumi.Input[
|
|
720
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
511
721
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
512
722
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
513
|
-
:param pulumi.Input[
|
|
514
|
-
:param pulumi.Input[
|
|
515
|
-
:param pulumi.Input[
|
|
516
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
517
|
-
:param pulumi.Input[
|
|
518
|
-
:param pulumi.Input[
|
|
723
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
724
|
+
:param pulumi.Input[_builtins.str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
725
|
+
:param pulumi.Input[_builtins.str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
726
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
727
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_regions: Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
728
|
+
:param pulumi.Input[_builtins.str] sts_region: Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
729
|
+
:param pulumi.Input[_builtins.str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
519
730
|
|
|
520
731
|
```
|
|
521
732
|
{{ if (eq .Type "STS") }}
|
|
@@ -528,14 +739,30 @@ class _SecretBackendState:
|
|
|
528
739
|
"""
|
|
529
740
|
if access_key is not None:
|
|
530
741
|
pulumi.set(__self__, "access_key", access_key)
|
|
742
|
+
if accessor is not None:
|
|
743
|
+
pulumi.set(__self__, "accessor", accessor)
|
|
744
|
+
if allowed_managed_keys is not None:
|
|
745
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
746
|
+
if allowed_response_headers is not None:
|
|
747
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
748
|
+
if audit_non_hmac_request_keys is not None:
|
|
749
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
750
|
+
if audit_non_hmac_response_keys is not None:
|
|
751
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
531
752
|
if default_lease_ttl_seconds is not None:
|
|
532
753
|
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
754
|
+
if delegated_auth_accessors is not None:
|
|
755
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
533
756
|
if description is not None:
|
|
534
757
|
pulumi.set(__self__, "description", description)
|
|
535
758
|
if disable_automated_rotation is not None:
|
|
536
759
|
pulumi.set(__self__, "disable_automated_rotation", disable_automated_rotation)
|
|
537
760
|
if disable_remount is not None:
|
|
538
761
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
762
|
+
if external_entropy_access is not None:
|
|
763
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
764
|
+
if force_no_cache is not None:
|
|
765
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
539
766
|
if iam_endpoint is not None:
|
|
540
767
|
pulumi.set(__self__, "iam_endpoint", iam_endpoint)
|
|
541
768
|
if identity_token_audience is not None:
|
|
@@ -544,14 +771,22 @@ class _SecretBackendState:
|
|
|
544
771
|
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
545
772
|
if identity_token_ttl is not None:
|
|
546
773
|
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
774
|
+
if listing_visibility is not None:
|
|
775
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
547
776
|
if local is not None:
|
|
548
777
|
pulumi.set(__self__, "local", local)
|
|
549
778
|
if max_lease_ttl_seconds is not None:
|
|
550
779
|
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
551
780
|
if namespace is not None:
|
|
552
781
|
pulumi.set(__self__, "namespace", namespace)
|
|
782
|
+
if options is not None:
|
|
783
|
+
pulumi.set(__self__, "options", options)
|
|
784
|
+
if passthrough_request_headers is not None:
|
|
785
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
553
786
|
if path is not None:
|
|
554
787
|
pulumi.set(__self__, "path", path)
|
|
788
|
+
if plugin_version is not None:
|
|
789
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
555
790
|
if region is not None:
|
|
556
791
|
pulumi.set(__self__, "region", region)
|
|
557
792
|
if role_arn is not None:
|
|
@@ -562,6 +797,8 @@ class _SecretBackendState:
|
|
|
562
797
|
pulumi.set(__self__, "rotation_schedule", rotation_schedule)
|
|
563
798
|
if rotation_window is not None:
|
|
564
799
|
pulumi.set(__self__, "rotation_window", rotation_window)
|
|
800
|
+
if seal_wrap is not None:
|
|
801
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
565
802
|
if secret_key is not None:
|
|
566
803
|
pulumi.set(__self__, "secret_key", secret_key)
|
|
567
804
|
if sts_endpoint is not None:
|
|
@@ -575,9 +812,9 @@ class _SecretBackendState:
|
|
|
575
812
|
if username_template is not None:
|
|
576
813
|
pulumi.set(__self__, "username_template", username_template)
|
|
577
814
|
|
|
578
|
-
@property
|
|
815
|
+
@_builtins.property
|
|
579
816
|
@pulumi.getter(name="accessKey")
|
|
580
|
-
def access_key(self) -> Optional[pulumi.Input[
|
|
817
|
+
def access_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
581
818
|
"""
|
|
582
819
|
The AWS Access Key ID this backend should use to
|
|
583
820
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
@@ -585,49 +822,120 @@ class _SecretBackendState:
|
|
|
585
822
|
return pulumi.get(self, "access_key")
|
|
586
823
|
|
|
587
824
|
@access_key.setter
|
|
588
|
-
def access_key(self, value: Optional[pulumi.Input[
|
|
825
|
+
def access_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
589
826
|
pulumi.set(self, "access_key", value)
|
|
590
827
|
|
|
591
|
-
@property
|
|
828
|
+
@_builtins.property
|
|
829
|
+
@pulumi.getter
|
|
830
|
+
def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
831
|
+
"""
|
|
832
|
+
Accessor of the mount
|
|
833
|
+
"""
|
|
834
|
+
return pulumi.get(self, "accessor")
|
|
835
|
+
|
|
836
|
+
@accessor.setter
|
|
837
|
+
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
838
|
+
pulumi.set(self, "accessor", value)
|
|
839
|
+
|
|
840
|
+
@_builtins.property
|
|
841
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
842
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
843
|
+
"""
|
|
844
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
845
|
+
"""
|
|
846
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
847
|
+
|
|
848
|
+
@allowed_managed_keys.setter
|
|
849
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
850
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
851
|
+
|
|
852
|
+
@_builtins.property
|
|
853
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
854
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
855
|
+
"""
|
|
856
|
+
List of headers to allow and pass from the request to the plugin
|
|
857
|
+
"""
|
|
858
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
859
|
+
|
|
860
|
+
@allowed_response_headers.setter
|
|
861
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
862
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
863
|
+
|
|
864
|
+
@_builtins.property
|
|
865
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
866
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
867
|
+
"""
|
|
868
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
869
|
+
"""
|
|
870
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
871
|
+
|
|
872
|
+
@audit_non_hmac_request_keys.setter
|
|
873
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
874
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
875
|
+
|
|
876
|
+
@_builtins.property
|
|
877
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
878
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
879
|
+
"""
|
|
880
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
881
|
+
"""
|
|
882
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
883
|
+
|
|
884
|
+
@audit_non_hmac_response_keys.setter
|
|
885
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
886
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
887
|
+
|
|
888
|
+
@_builtins.property
|
|
592
889
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
593
|
-
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[
|
|
890
|
+
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
594
891
|
"""
|
|
595
|
-
|
|
596
|
-
issued by this backend.
|
|
892
|
+
Default lease duration for secrets in seconds
|
|
597
893
|
"""
|
|
598
894
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
599
895
|
|
|
600
896
|
@default_lease_ttl_seconds.setter
|
|
601
|
-
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[
|
|
897
|
+
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
602
898
|
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
603
899
|
|
|
604
|
-
@property
|
|
900
|
+
@_builtins.property
|
|
901
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
902
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
903
|
+
"""
|
|
904
|
+
List of headers to allow and pass from the request to the plugin
|
|
905
|
+
"""
|
|
906
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
907
|
+
|
|
908
|
+
@delegated_auth_accessors.setter
|
|
909
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
910
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
911
|
+
|
|
912
|
+
@_builtins.property
|
|
605
913
|
@pulumi.getter
|
|
606
|
-
def description(self) -> Optional[pulumi.Input[
|
|
914
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
607
915
|
"""
|
|
608
|
-
|
|
916
|
+
Human-friendly description of the mount for the backend.
|
|
609
917
|
"""
|
|
610
918
|
return pulumi.get(self, "description")
|
|
611
919
|
|
|
612
920
|
@description.setter
|
|
613
|
-
def description(self, value: Optional[pulumi.Input[
|
|
921
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
614
922
|
pulumi.set(self, "description", value)
|
|
615
923
|
|
|
616
|
-
@property
|
|
924
|
+
@_builtins.property
|
|
617
925
|
@pulumi.getter(name="disableAutomatedRotation")
|
|
618
|
-
def disable_automated_rotation(self) -> Optional[pulumi.Input[
|
|
926
|
+
def disable_automated_rotation(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
619
927
|
"""
|
|
620
928
|
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
621
929
|
"""
|
|
622
930
|
return pulumi.get(self, "disable_automated_rotation")
|
|
623
931
|
|
|
624
932
|
@disable_automated_rotation.setter
|
|
625
|
-
def disable_automated_rotation(self, value: Optional[pulumi.Input[
|
|
933
|
+
def disable_automated_rotation(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
626
934
|
pulumi.set(self, "disable_automated_rotation", value)
|
|
627
935
|
|
|
628
|
-
@property
|
|
936
|
+
@_builtins.property
|
|
629
937
|
@pulumi.getter(name="disableRemount")
|
|
630
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
938
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
631
939
|
"""
|
|
632
940
|
If set, opts out of mount migration on path updates.
|
|
633
941
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -635,85 +943,120 @@ class _SecretBackendState:
|
|
|
635
943
|
return pulumi.get(self, "disable_remount")
|
|
636
944
|
|
|
637
945
|
@disable_remount.setter
|
|
638
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
946
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
639
947
|
pulumi.set(self, "disable_remount", value)
|
|
640
948
|
|
|
641
|
-
@property
|
|
949
|
+
@_builtins.property
|
|
950
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
951
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
952
|
+
"""
|
|
953
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
954
|
+
"""
|
|
955
|
+
return pulumi.get(self, "external_entropy_access")
|
|
956
|
+
|
|
957
|
+
@external_entropy_access.setter
|
|
958
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
959
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
960
|
+
|
|
961
|
+
@_builtins.property
|
|
962
|
+
@pulumi.getter(name="forceNoCache")
|
|
963
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
964
|
+
"""
|
|
965
|
+
If set to true, disables caching.
|
|
966
|
+
"""
|
|
967
|
+
return pulumi.get(self, "force_no_cache")
|
|
968
|
+
|
|
969
|
+
@force_no_cache.setter
|
|
970
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
971
|
+
pulumi.set(self, "force_no_cache", value)
|
|
972
|
+
|
|
973
|
+
@_builtins.property
|
|
642
974
|
@pulumi.getter(name="iamEndpoint")
|
|
643
|
-
def iam_endpoint(self) -> Optional[pulumi.Input[
|
|
975
|
+
def iam_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
644
976
|
"""
|
|
645
977
|
Specifies a custom HTTP IAM endpoint to use.
|
|
646
978
|
"""
|
|
647
979
|
return pulumi.get(self, "iam_endpoint")
|
|
648
980
|
|
|
649
981
|
@iam_endpoint.setter
|
|
650
|
-
def iam_endpoint(self, value: Optional[pulumi.Input[
|
|
982
|
+
def iam_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
651
983
|
pulumi.set(self, "iam_endpoint", value)
|
|
652
984
|
|
|
653
|
-
@property
|
|
985
|
+
@_builtins.property
|
|
654
986
|
@pulumi.getter(name="identityTokenAudience")
|
|
655
|
-
def identity_token_audience(self) -> Optional[pulumi.Input[
|
|
987
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
656
988
|
"""
|
|
657
989
|
The audience claim value. Requires Vault 1.16+.
|
|
658
990
|
"""
|
|
659
991
|
return pulumi.get(self, "identity_token_audience")
|
|
660
992
|
|
|
661
993
|
@identity_token_audience.setter
|
|
662
|
-
def identity_token_audience(self, value: Optional[pulumi.Input[
|
|
994
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
663
995
|
pulumi.set(self, "identity_token_audience", value)
|
|
664
996
|
|
|
665
|
-
@property
|
|
997
|
+
@_builtins.property
|
|
666
998
|
@pulumi.getter(name="identityTokenKey")
|
|
667
|
-
def identity_token_key(self) -> Optional[pulumi.Input[
|
|
999
|
+
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
668
1000
|
"""
|
|
669
|
-
The key to use for signing identity tokens.
|
|
1001
|
+
The key to use for signing identity tokens.
|
|
670
1002
|
"""
|
|
671
1003
|
return pulumi.get(self, "identity_token_key")
|
|
672
1004
|
|
|
673
1005
|
@identity_token_key.setter
|
|
674
|
-
def identity_token_key(self, value: Optional[pulumi.Input[
|
|
1006
|
+
def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
675
1007
|
pulumi.set(self, "identity_token_key", value)
|
|
676
1008
|
|
|
677
|
-
@property
|
|
1009
|
+
@_builtins.property
|
|
678
1010
|
@pulumi.getter(name="identityTokenTtl")
|
|
679
|
-
def identity_token_ttl(self) -> Optional[pulumi.Input[
|
|
1011
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
680
1012
|
"""
|
|
681
1013
|
The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
682
1014
|
"""
|
|
683
1015
|
return pulumi.get(self, "identity_token_ttl")
|
|
684
1016
|
|
|
685
1017
|
@identity_token_ttl.setter
|
|
686
|
-
def identity_token_ttl(self, value: Optional[pulumi.Input[
|
|
1018
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
687
1019
|
pulumi.set(self, "identity_token_ttl", value)
|
|
688
1020
|
|
|
689
|
-
@property
|
|
1021
|
+
@_builtins.property
|
|
1022
|
+
@pulumi.getter(name="listingVisibility")
|
|
1023
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1024
|
+
"""
|
|
1025
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1026
|
+
"""
|
|
1027
|
+
return pulumi.get(self, "listing_visibility")
|
|
1028
|
+
|
|
1029
|
+
@listing_visibility.setter
|
|
1030
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1031
|
+
pulumi.set(self, "listing_visibility", value)
|
|
1032
|
+
|
|
1033
|
+
@_builtins.property
|
|
690
1034
|
@pulumi.getter
|
|
691
|
-
def local(self) -> Optional[pulumi.Input[
|
|
1035
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
692
1036
|
"""
|
|
693
|
-
Specifies
|
|
1037
|
+
Specifies if the secret backend is local only
|
|
694
1038
|
"""
|
|
695
1039
|
return pulumi.get(self, "local")
|
|
696
1040
|
|
|
697
1041
|
@local.setter
|
|
698
|
-
def local(self, value: Optional[pulumi.Input[
|
|
1042
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
699
1043
|
pulumi.set(self, "local", value)
|
|
700
1044
|
|
|
701
|
-
@property
|
|
1045
|
+
@_builtins.property
|
|
702
1046
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
703
|
-
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[
|
|
1047
|
+
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
704
1048
|
"""
|
|
705
|
-
|
|
706
|
-
for credentials issued by this backend.
|
|
1049
|
+
Maximum possible lease duration for secrets in seconds
|
|
707
1050
|
"""
|
|
708
1051
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
709
1052
|
|
|
710
1053
|
@max_lease_ttl_seconds.setter
|
|
711
|
-
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[
|
|
1054
|
+
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
712
1055
|
pulumi.set(self, "max_lease_ttl_seconds", value)
|
|
713
1056
|
|
|
714
|
-
@property
|
|
1057
|
+
@_builtins.property
|
|
715
1058
|
@pulumi.getter
|
|
716
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
1059
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
717
1060
|
"""
|
|
718
1061
|
The namespace to provision the resource in.
|
|
719
1062
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -723,12 +1066,36 @@ class _SecretBackendState:
|
|
|
723
1066
|
return pulumi.get(self, "namespace")
|
|
724
1067
|
|
|
725
1068
|
@namespace.setter
|
|
726
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
1069
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
727
1070
|
pulumi.set(self, "namespace", value)
|
|
728
1071
|
|
|
729
|
-
@property
|
|
1072
|
+
@_builtins.property
|
|
1073
|
+
@pulumi.getter
|
|
1074
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
1075
|
+
"""
|
|
1076
|
+
Specifies mount type specific options that are passed to the backend
|
|
1077
|
+
"""
|
|
1078
|
+
return pulumi.get(self, "options")
|
|
1079
|
+
|
|
1080
|
+
@options.setter
|
|
1081
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
1082
|
+
pulumi.set(self, "options", value)
|
|
1083
|
+
|
|
1084
|
+
@_builtins.property
|
|
1085
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
1086
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
1087
|
+
"""
|
|
1088
|
+
List of headers to allow and pass from the request to the plugin
|
|
1089
|
+
"""
|
|
1090
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
1091
|
+
|
|
1092
|
+
@passthrough_request_headers.setter
|
|
1093
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
1094
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
1095
|
+
|
|
1096
|
+
@_builtins.property
|
|
730
1097
|
@pulumi.getter
|
|
731
|
-
def path(self) -> Optional[pulumi.Input[
|
|
1098
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
732
1099
|
"""
|
|
733
1100
|
The unique path this backend should be mounted at. Must
|
|
734
1101
|
not begin or end with a `/`. Defaults to `aws`.
|
|
@@ -736,36 +1103,48 @@ class _SecretBackendState:
|
|
|
736
1103
|
return pulumi.get(self, "path")
|
|
737
1104
|
|
|
738
1105
|
@path.setter
|
|
739
|
-
def path(self, value: Optional[pulumi.Input[
|
|
1106
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
740
1107
|
pulumi.set(self, "path", value)
|
|
741
1108
|
|
|
742
|
-
@property
|
|
1109
|
+
@_builtins.property
|
|
1110
|
+
@pulumi.getter(name="pluginVersion")
|
|
1111
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
1112
|
+
"""
|
|
1113
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1114
|
+
"""
|
|
1115
|
+
return pulumi.get(self, "plugin_version")
|
|
1116
|
+
|
|
1117
|
+
@plugin_version.setter
|
|
1118
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
1119
|
+
pulumi.set(self, "plugin_version", value)
|
|
1120
|
+
|
|
1121
|
+
@_builtins.property
|
|
743
1122
|
@pulumi.getter
|
|
744
|
-
def region(self) -> Optional[pulumi.Input[
|
|
1123
|
+
def region(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
745
1124
|
"""
|
|
746
1125
|
The AWS region to make API calls against. Defaults to us-east-1.
|
|
747
1126
|
"""
|
|
748
1127
|
return pulumi.get(self, "region")
|
|
749
1128
|
|
|
750
1129
|
@region.setter
|
|
751
|
-
def region(self, value: Optional[pulumi.Input[
|
|
1130
|
+
def region(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
752
1131
|
pulumi.set(self, "region", value)
|
|
753
1132
|
|
|
754
|
-
@property
|
|
1133
|
+
@_builtins.property
|
|
755
1134
|
@pulumi.getter(name="roleArn")
|
|
756
|
-
def role_arn(self) -> Optional[pulumi.Input[
|
|
1135
|
+
def role_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
757
1136
|
"""
|
|
758
1137
|
Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
759
1138
|
"""
|
|
760
1139
|
return pulumi.get(self, "role_arn")
|
|
761
1140
|
|
|
762
1141
|
@role_arn.setter
|
|
763
|
-
def role_arn(self, value: Optional[pulumi.Input[
|
|
1142
|
+
def role_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
764
1143
|
pulumi.set(self, "role_arn", value)
|
|
765
1144
|
|
|
766
|
-
@property
|
|
1145
|
+
@_builtins.property
|
|
767
1146
|
@pulumi.getter(name="rotationPeriod")
|
|
768
|
-
def rotation_period(self) -> Optional[pulumi.Input[
|
|
1147
|
+
def rotation_period(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
769
1148
|
"""
|
|
770
1149
|
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
771
1150
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
@@ -773,12 +1152,12 @@ class _SecretBackendState:
|
|
|
773
1152
|
return pulumi.get(self, "rotation_period")
|
|
774
1153
|
|
|
775
1154
|
@rotation_period.setter
|
|
776
|
-
def rotation_period(self, value: Optional[pulumi.Input[
|
|
1155
|
+
def rotation_period(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
777
1156
|
pulumi.set(self, "rotation_period", value)
|
|
778
1157
|
|
|
779
|
-
@property
|
|
1158
|
+
@_builtins.property
|
|
780
1159
|
@pulumi.getter(name="rotationSchedule")
|
|
781
|
-
def rotation_schedule(self) -> Optional[pulumi.Input[
|
|
1160
|
+
def rotation_schedule(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
782
1161
|
"""
|
|
783
1162
|
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
784
1163
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
@@ -786,12 +1165,12 @@ class _SecretBackendState:
|
|
|
786
1165
|
return pulumi.get(self, "rotation_schedule")
|
|
787
1166
|
|
|
788
1167
|
@rotation_schedule.setter
|
|
789
|
-
def rotation_schedule(self, value: Optional[pulumi.Input[
|
|
1168
|
+
def rotation_schedule(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
790
1169
|
pulumi.set(self, "rotation_schedule", value)
|
|
791
1170
|
|
|
792
|
-
@property
|
|
1171
|
+
@_builtins.property
|
|
793
1172
|
@pulumi.getter(name="rotationWindow")
|
|
794
|
-
def rotation_window(self) -> Optional[pulumi.Input[
|
|
1173
|
+
def rotation_window(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
795
1174
|
"""
|
|
796
1175
|
The maximum amount of time in seconds allowed to complete
|
|
797
1176
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
@@ -800,72 +1179,84 @@ class _SecretBackendState:
|
|
|
800
1179
|
return pulumi.get(self, "rotation_window")
|
|
801
1180
|
|
|
802
1181
|
@rotation_window.setter
|
|
803
|
-
def rotation_window(self, value: Optional[pulumi.Input[
|
|
1182
|
+
def rotation_window(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
804
1183
|
pulumi.set(self, "rotation_window", value)
|
|
805
1184
|
|
|
806
|
-
@property
|
|
1185
|
+
@_builtins.property
|
|
1186
|
+
@pulumi.getter(name="sealWrap")
|
|
1187
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
1188
|
+
"""
|
|
1189
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1190
|
+
"""
|
|
1191
|
+
return pulumi.get(self, "seal_wrap")
|
|
1192
|
+
|
|
1193
|
+
@seal_wrap.setter
|
|
1194
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
1195
|
+
pulumi.set(self, "seal_wrap", value)
|
|
1196
|
+
|
|
1197
|
+
@_builtins.property
|
|
807
1198
|
@pulumi.getter(name="secretKey")
|
|
808
|
-
def secret_key(self) -> Optional[pulumi.Input[
|
|
1199
|
+
def secret_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
809
1200
|
"""
|
|
810
1201
|
The AWS Secret Access Key to use when generating new credentials.
|
|
811
1202
|
"""
|
|
812
1203
|
return pulumi.get(self, "secret_key")
|
|
813
1204
|
|
|
814
1205
|
@secret_key.setter
|
|
815
|
-
def secret_key(self, value: Optional[pulumi.Input[
|
|
1206
|
+
def secret_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
816
1207
|
pulumi.set(self, "secret_key", value)
|
|
817
1208
|
|
|
818
|
-
@property
|
|
1209
|
+
@_builtins.property
|
|
819
1210
|
@pulumi.getter(name="stsEndpoint")
|
|
820
|
-
def sts_endpoint(self) -> Optional[pulumi.Input[
|
|
1211
|
+
def sts_endpoint(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
821
1212
|
"""
|
|
822
1213
|
Specifies a custom HTTP STS endpoint to use.
|
|
823
1214
|
"""
|
|
824
1215
|
return pulumi.get(self, "sts_endpoint")
|
|
825
1216
|
|
|
826
1217
|
@sts_endpoint.setter
|
|
827
|
-
def sts_endpoint(self, value: Optional[pulumi.Input[
|
|
1218
|
+
def sts_endpoint(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
828
1219
|
pulumi.set(self, "sts_endpoint", value)
|
|
829
1220
|
|
|
830
|
-
@property
|
|
1221
|
+
@_builtins.property
|
|
831
1222
|
@pulumi.getter(name="stsFallbackEndpoints")
|
|
832
|
-
def sts_fallback_endpoints(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
1223
|
+
def sts_fallback_endpoints(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
833
1224
|
"""
|
|
834
1225
|
Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
835
1226
|
"""
|
|
836
1227
|
return pulumi.get(self, "sts_fallback_endpoints")
|
|
837
1228
|
|
|
838
1229
|
@sts_fallback_endpoints.setter
|
|
839
|
-
def sts_fallback_endpoints(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
1230
|
+
def sts_fallback_endpoints(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
840
1231
|
pulumi.set(self, "sts_fallback_endpoints", value)
|
|
841
1232
|
|
|
842
|
-
@property
|
|
1233
|
+
@_builtins.property
|
|
843
1234
|
@pulumi.getter(name="stsFallbackRegions")
|
|
844
|
-
def sts_fallback_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
1235
|
+
def sts_fallback_regions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
845
1236
|
"""
|
|
846
1237
|
Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
847
1238
|
"""
|
|
848
1239
|
return pulumi.get(self, "sts_fallback_regions")
|
|
849
1240
|
|
|
850
1241
|
@sts_fallback_regions.setter
|
|
851
|
-
def sts_fallback_regions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
1242
|
+
def sts_fallback_regions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
852
1243
|
pulumi.set(self, "sts_fallback_regions", value)
|
|
853
1244
|
|
|
854
|
-
@property
|
|
1245
|
+
@_builtins.property
|
|
855
1246
|
@pulumi.getter(name="stsRegion")
|
|
856
|
-
def sts_region(self) -> Optional[pulumi.Input[
|
|
1247
|
+
def sts_region(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
857
1248
|
"""
|
|
858
1249
|
Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
859
1250
|
"""
|
|
860
1251
|
return pulumi.get(self, "sts_region")
|
|
861
1252
|
|
|
862
1253
|
@sts_region.setter
|
|
863
|
-
def sts_region(self, value: Optional[pulumi.Input[
|
|
1254
|
+
def sts_region(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
864
1255
|
pulumi.set(self, "sts_region", value)
|
|
865
1256
|
|
|
866
|
-
@property
|
|
1257
|
+
@_builtins.property
|
|
867
1258
|
@pulumi.getter(name="usernameTemplate")
|
|
868
|
-
def username_template(self) -> Optional[pulumi.Input[
|
|
1259
|
+
def username_template(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
869
1260
|
"""
|
|
870
1261
|
Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
871
1262
|
|
|
@@ -881,7 +1272,7 @@ class _SecretBackendState:
|
|
|
881
1272
|
return pulumi.get(self, "username_template")
|
|
882
1273
|
|
|
883
1274
|
@username_template.setter
|
|
884
|
-
def username_template(self, value: Optional[pulumi.Input[
|
|
1275
|
+
def username_template(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
885
1276
|
pulumi.set(self, "username_template", value)
|
|
886
1277
|
|
|
887
1278
|
|
|
@@ -891,30 +1282,42 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
891
1282
|
def __init__(__self__,
|
|
892
1283
|
resource_name: str,
|
|
893
1284
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
894
|
-
access_key: Optional[pulumi.Input[
|
|
895
|
-
|
|
896
|
-
|
|
897
|
-
|
|
898
|
-
|
|
899
|
-
|
|
900
|
-
|
|
901
|
-
|
|
902
|
-
|
|
903
|
-
|
|
904
|
-
|
|
905
|
-
|
|
906
|
-
|
|
907
|
-
|
|
908
|
-
|
|
909
|
-
|
|
910
|
-
|
|
911
|
-
|
|
912
|
-
|
|
913
|
-
|
|
914
|
-
|
|
915
|
-
|
|
916
|
-
|
|
917
|
-
|
|
1285
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1286
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1287
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1288
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1289
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1290
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1291
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1292
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1293
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1294
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1295
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1296
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1297
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1298
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1299
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1300
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1301
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1302
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1303
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1304
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1305
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1306
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1307
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1308
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1309
|
+
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1310
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1311
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1312
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1313
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1314
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1315
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1316
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1317
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1318
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1319
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1320
|
+
username_template: Optional[pulumi.Input[_builtins.str]] = None,
|
|
918
1321
|
__props__=None):
|
|
919
1322
|
"""
|
|
920
1323
|
## Import
|
|
@@ -927,42 +1330,52 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
927
1330
|
|
|
928
1331
|
:param str resource_name: The name of the resource.
|
|
929
1332
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
930
|
-
:param pulumi.Input[
|
|
1333
|
+
:param pulumi.Input[_builtins.str] access_key: The AWS Access Key ID this backend should use to
|
|
931
1334
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
932
|
-
:param pulumi.Input[
|
|
933
|
-
|
|
934
|
-
:param pulumi.Input[
|
|
935
|
-
:param pulumi.Input[
|
|
936
|
-
:param pulumi.Input[
|
|
1335
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1336
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1337
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1338
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1339
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
1340
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1341
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
1342
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1343
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
937
1344
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
938
|
-
:param pulumi.Input[
|
|
939
|
-
:param pulumi.Input[
|
|
940
|
-
:param pulumi.Input[
|
|
941
|
-
:param pulumi.Input[
|
|
942
|
-
:param pulumi.Input[
|
|
943
|
-
:param pulumi.Input[
|
|
944
|
-
|
|
945
|
-
:param pulumi.Input[
|
|
1345
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1346
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
1347
|
+
:param pulumi.Input[_builtins.str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
1348
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
|
|
1349
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
1350
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
1351
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1352
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the secret backend is local only
|
|
1353
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
1354
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
946
1355
|
The value should not contain leading or trailing forward slashes.
|
|
947
1356
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
948
1357
|
*Available only for Vault Enterprise*.
|
|
949
|
-
:param pulumi.Input[
|
|
1358
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1359
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
1360
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
950
1361
|
not begin or end with a `/`. Defaults to `aws`.
|
|
951
|
-
:param pulumi.Input[
|
|
952
|
-
:param pulumi.Input[
|
|
953
|
-
:param pulumi.Input[
|
|
1362
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1363
|
+
:param pulumi.Input[_builtins.str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
1364
|
+
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
1365
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
954
1366
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
955
|
-
:param pulumi.Input[
|
|
1367
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
956
1368
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
957
|
-
:param pulumi.Input[
|
|
1369
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
958
1370
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
959
1371
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
960
|
-
:param pulumi.Input[
|
|
961
|
-
:param pulumi.Input[
|
|
962
|
-
:param pulumi.Input[
|
|
963
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
964
|
-
:param pulumi.Input[
|
|
965
|
-
:param pulumi.Input[
|
|
1372
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1373
|
+
:param pulumi.Input[_builtins.str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
1374
|
+
:param pulumi.Input[_builtins.str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
1375
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
1376
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_regions: Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
1377
|
+
:param pulumi.Input[_builtins.str] sts_region: Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
1378
|
+
:param pulumi.Input[_builtins.str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
966
1379
|
|
|
967
1380
|
```
|
|
968
1381
|
{{ if (eq .Type "STS") }}
|
|
@@ -1003,30 +1416,42 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1003
1416
|
def _internal_init(__self__,
|
|
1004
1417
|
resource_name: str,
|
|
1005
1418
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1006
|
-
access_key: Optional[pulumi.Input[
|
|
1007
|
-
|
|
1008
|
-
|
|
1009
|
-
|
|
1010
|
-
|
|
1011
|
-
|
|
1012
|
-
|
|
1013
|
-
|
|
1014
|
-
|
|
1015
|
-
|
|
1016
|
-
|
|
1017
|
-
|
|
1018
|
-
|
|
1019
|
-
|
|
1020
|
-
|
|
1021
|
-
|
|
1022
|
-
|
|
1023
|
-
|
|
1024
|
-
|
|
1025
|
-
|
|
1026
|
-
|
|
1027
|
-
|
|
1028
|
-
|
|
1029
|
-
|
|
1419
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1420
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1421
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1422
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1423
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1424
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1425
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1426
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1427
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1428
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1429
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1430
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1431
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1432
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1433
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1434
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1435
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1436
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1437
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1438
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1439
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1440
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1441
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1442
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1443
|
+
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1444
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1445
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1446
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1447
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1448
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1449
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1450
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1451
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1452
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1453
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1454
|
+
username_template: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1030
1455
|
__props__=None):
|
|
1031
1456
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
1032
1457
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -1037,29 +1462,42 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1037
1462
|
__props__ = SecretBackendArgs.__new__(SecretBackendArgs)
|
|
1038
1463
|
|
|
1039
1464
|
__props__.__dict__["access_key"] = None if access_key is None else pulumi.Output.secret(access_key)
|
|
1465
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1466
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1467
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1468
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
1040
1469
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1470
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
1041
1471
|
__props__.__dict__["description"] = description
|
|
1042
1472
|
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
1043
1473
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1474
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1475
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
1044
1476
|
__props__.__dict__["iam_endpoint"] = iam_endpoint
|
|
1045
1477
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
1046
1478
|
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
1047
1479
|
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
1480
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
1048
1481
|
__props__.__dict__["local"] = local
|
|
1049
1482
|
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
1050
1483
|
__props__.__dict__["namespace"] = namespace
|
|
1484
|
+
__props__.__dict__["options"] = options
|
|
1485
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
1051
1486
|
__props__.__dict__["path"] = path
|
|
1487
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
1052
1488
|
__props__.__dict__["region"] = region
|
|
1053
1489
|
__props__.__dict__["role_arn"] = role_arn
|
|
1054
1490
|
__props__.__dict__["rotation_period"] = rotation_period
|
|
1055
1491
|
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
1056
1492
|
__props__.__dict__["rotation_window"] = rotation_window
|
|
1493
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
1057
1494
|
__props__.__dict__["secret_key"] = None if secret_key is None else pulumi.Output.secret(secret_key)
|
|
1058
1495
|
__props__.__dict__["sts_endpoint"] = sts_endpoint
|
|
1059
1496
|
__props__.__dict__["sts_fallback_endpoints"] = sts_fallback_endpoints
|
|
1060
1497
|
__props__.__dict__["sts_fallback_regions"] = sts_fallback_regions
|
|
1061
1498
|
__props__.__dict__["sts_region"] = sts_region
|
|
1062
1499
|
__props__.__dict__["username_template"] = username_template
|
|
1500
|
+
__props__.__dict__["accessor"] = None
|
|
1063
1501
|
secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["accessKey", "secretKey"])
|
|
1064
1502
|
opts = pulumi.ResourceOptions.merge(opts, secret_opts)
|
|
1065
1503
|
super(SecretBackend, __self__).__init__(
|
|
@@ -1072,30 +1510,43 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1072
1510
|
def get(resource_name: str,
|
|
1073
1511
|
id: pulumi.Input[str],
|
|
1074
1512
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
1075
|
-
access_key: Optional[pulumi.Input[
|
|
1076
|
-
|
|
1077
|
-
|
|
1078
|
-
|
|
1079
|
-
|
|
1080
|
-
|
|
1081
|
-
|
|
1082
|
-
|
|
1083
|
-
|
|
1084
|
-
|
|
1085
|
-
|
|
1086
|
-
|
|
1087
|
-
|
|
1088
|
-
|
|
1089
|
-
|
|
1090
|
-
|
|
1091
|
-
|
|
1092
|
-
|
|
1093
|
-
|
|
1094
|
-
|
|
1095
|
-
|
|
1096
|
-
|
|
1097
|
-
|
|
1098
|
-
|
|
1513
|
+
access_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1514
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1515
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1516
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1517
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1518
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1519
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1520
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1521
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1522
|
+
disable_automated_rotation: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1523
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1524
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1525
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1526
|
+
iam_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1527
|
+
identity_token_audience: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1528
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1529
|
+
identity_token_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1530
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1531
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1532
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1533
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1534
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1535
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1536
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1537
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1538
|
+
region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1539
|
+
role_arn: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1540
|
+
rotation_period: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1541
|
+
rotation_schedule: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1542
|
+
rotation_window: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1543
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1544
|
+
secret_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1545
|
+
sts_endpoint: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1546
|
+
sts_fallback_endpoints: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1547
|
+
sts_fallback_regions: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1548
|
+
sts_region: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1549
|
+
username_template: Optional[pulumi.Input[_builtins.str]] = None) -> 'SecretBackend':
|
|
1099
1550
|
"""
|
|
1100
1551
|
Get an existing SecretBackend resource's state with the given name, id, and optional extra
|
|
1101
1552
|
properties used to qualify the lookup.
|
|
@@ -1103,42 +1554,53 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1103
1554
|
:param str resource_name: The unique name of the resulting resource.
|
|
1104
1555
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
1105
1556
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
1106
|
-
:param pulumi.Input[
|
|
1557
|
+
:param pulumi.Input[_builtins.str] access_key: The AWS Access Key ID this backend should use to
|
|
1107
1558
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
1108
|
-
:param pulumi.Input[
|
|
1109
|
-
|
|
1110
|
-
:param pulumi.Input[
|
|
1111
|
-
:param pulumi.Input[
|
|
1112
|
-
:param pulumi.Input[
|
|
1559
|
+
:param pulumi.Input[_builtins.str] accessor: Accessor of the mount
|
|
1560
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1561
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1562
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1563
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1564
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for secrets in seconds
|
|
1565
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1566
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend.
|
|
1567
|
+
:param pulumi.Input[_builtins.bool] disable_automated_rotation: Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1568
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
1113
1569
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1114
|
-
:param pulumi.Input[
|
|
1115
|
-
:param pulumi.Input[
|
|
1116
|
-
:param pulumi.Input[
|
|
1117
|
-
:param pulumi.Input[
|
|
1118
|
-
:param pulumi.Input[
|
|
1119
|
-
:param pulumi.Input[
|
|
1120
|
-
|
|
1121
|
-
:param pulumi.Input[
|
|
1570
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1571
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
1572
|
+
:param pulumi.Input[_builtins.str] iam_endpoint: Specifies a custom HTTP IAM endpoint to use.
|
|
1573
|
+
:param pulumi.Input[_builtins.str] identity_token_audience: The audience claim value. Requires Vault 1.16+.
|
|
1574
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing identity tokens.
|
|
1575
|
+
:param pulumi.Input[_builtins.int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
1576
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1577
|
+
:param pulumi.Input[_builtins.bool] local: Specifies if the secret backend is local only
|
|
1578
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for secrets in seconds
|
|
1579
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
1122
1580
|
The value should not contain leading or trailing forward slashes.
|
|
1123
1581
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
1124
1582
|
*Available only for Vault Enterprise*.
|
|
1125
|
-
:param pulumi.Input[
|
|
1583
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1584
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
1585
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
1126
1586
|
not begin or end with a `/`. Defaults to `aws`.
|
|
1127
|
-
:param pulumi.Input[
|
|
1128
|
-
:param pulumi.Input[
|
|
1129
|
-
:param pulumi.Input[
|
|
1587
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1588
|
+
:param pulumi.Input[_builtins.str] region: The AWS region to make API calls against. Defaults to us-east-1.
|
|
1589
|
+
:param pulumi.Input[_builtins.str] role_arn: Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
1590
|
+
:param pulumi.Input[_builtins.int] rotation_period: The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1130
1591
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1131
|
-
:param pulumi.Input[
|
|
1592
|
+
:param pulumi.Input[_builtins.str] rotation_schedule: The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1132
1593
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1133
|
-
:param pulumi.Input[
|
|
1594
|
+
:param pulumi.Input[_builtins.int] rotation_window: The maximum amount of time in seconds allowed to complete
|
|
1134
1595
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
1135
1596
|
unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.19+.
|
|
1136
|
-
:param pulumi.Input[
|
|
1137
|
-
:param pulumi.Input[
|
|
1138
|
-
:param pulumi.Input[
|
|
1139
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
1140
|
-
:param pulumi.Input[
|
|
1141
|
-
:param pulumi.Input[
|
|
1597
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1598
|
+
:param pulumi.Input[_builtins.str] secret_key: The AWS Secret Access Key to use when generating new credentials.
|
|
1599
|
+
:param pulumi.Input[_builtins.str] sts_endpoint: Specifies a custom HTTP STS endpoint to use.
|
|
1600
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_endpoints: Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
1601
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sts_fallback_regions: Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
1602
|
+
:param pulumi.Input[_builtins.str] sts_region: Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
1603
|
+
:param pulumi.Input[_builtins.str] username_template: Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
1142
1604
|
|
|
1143
1605
|
```
|
|
1144
1606
|
{{ if (eq .Type "STS") }}
|
|
@@ -1154,23 +1616,36 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1154
1616
|
__props__ = _SecretBackendState.__new__(_SecretBackendState)
|
|
1155
1617
|
|
|
1156
1618
|
__props__.__dict__["access_key"] = access_key
|
|
1619
|
+
__props__.__dict__["accessor"] = accessor
|
|
1620
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1621
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1622
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1623
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
1157
1624
|
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
1625
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
1158
1626
|
__props__.__dict__["description"] = description
|
|
1159
1627
|
__props__.__dict__["disable_automated_rotation"] = disable_automated_rotation
|
|
1160
1628
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1629
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1630
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
1161
1631
|
__props__.__dict__["iam_endpoint"] = iam_endpoint
|
|
1162
1632
|
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
1163
1633
|
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
1164
1634
|
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
1635
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
1165
1636
|
__props__.__dict__["local"] = local
|
|
1166
1637
|
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
1167
1638
|
__props__.__dict__["namespace"] = namespace
|
|
1639
|
+
__props__.__dict__["options"] = options
|
|
1640
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
1168
1641
|
__props__.__dict__["path"] = path
|
|
1642
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
1169
1643
|
__props__.__dict__["region"] = region
|
|
1170
1644
|
__props__.__dict__["role_arn"] = role_arn
|
|
1171
1645
|
__props__.__dict__["rotation_period"] = rotation_period
|
|
1172
1646
|
__props__.__dict__["rotation_schedule"] = rotation_schedule
|
|
1173
1647
|
__props__.__dict__["rotation_window"] = rotation_window
|
|
1648
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
1174
1649
|
__props__.__dict__["secret_key"] = secret_key
|
|
1175
1650
|
__props__.__dict__["sts_endpoint"] = sts_endpoint
|
|
1176
1651
|
__props__.__dict__["sts_fallback_endpoints"] = sts_fallback_endpoints
|
|
@@ -1179,101 +1654,171 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1179
1654
|
__props__.__dict__["username_template"] = username_template
|
|
1180
1655
|
return SecretBackend(resource_name, opts=opts, __props__=__props__)
|
|
1181
1656
|
|
|
1182
|
-
@property
|
|
1657
|
+
@_builtins.property
|
|
1183
1658
|
@pulumi.getter(name="accessKey")
|
|
1184
|
-
def access_key(self) -> pulumi.Output[Optional[
|
|
1659
|
+
def access_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1185
1660
|
"""
|
|
1186
1661
|
The AWS Access Key ID this backend should use to
|
|
1187
1662
|
issue new credentials. Vault uses the official AWS SDK to authenticate, and thus can also use standard AWS environment credentials, shared file credentials or IAM role/ECS task credentials.
|
|
1188
1663
|
"""
|
|
1189
1664
|
return pulumi.get(self, "access_key")
|
|
1190
1665
|
|
|
1191
|
-
@property
|
|
1666
|
+
@_builtins.property
|
|
1667
|
+
@pulumi.getter
|
|
1668
|
+
def accessor(self) -> pulumi.Output[_builtins.str]:
|
|
1669
|
+
"""
|
|
1670
|
+
Accessor of the mount
|
|
1671
|
+
"""
|
|
1672
|
+
return pulumi.get(self, "accessor")
|
|
1673
|
+
|
|
1674
|
+
@_builtins.property
|
|
1675
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
1676
|
+
def allowed_managed_keys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1677
|
+
"""
|
|
1678
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
1679
|
+
"""
|
|
1680
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
1681
|
+
|
|
1682
|
+
@_builtins.property
|
|
1683
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
1684
|
+
def allowed_response_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1685
|
+
"""
|
|
1686
|
+
List of headers to allow and pass from the request to the plugin
|
|
1687
|
+
"""
|
|
1688
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
1689
|
+
|
|
1690
|
+
@_builtins.property
|
|
1691
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
1692
|
+
def audit_non_hmac_request_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1693
|
+
"""
|
|
1694
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1695
|
+
"""
|
|
1696
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
1697
|
+
|
|
1698
|
+
@_builtins.property
|
|
1699
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
1700
|
+
def audit_non_hmac_response_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1701
|
+
"""
|
|
1702
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1703
|
+
"""
|
|
1704
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
1705
|
+
|
|
1706
|
+
@_builtins.property
|
|
1192
1707
|
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
1193
|
-
def default_lease_ttl_seconds(self) -> pulumi.Output[
|
|
1708
|
+
def default_lease_ttl_seconds(self) -> pulumi.Output[_builtins.int]:
|
|
1194
1709
|
"""
|
|
1195
|
-
|
|
1196
|
-
issued by this backend.
|
|
1710
|
+
Default lease duration for secrets in seconds
|
|
1197
1711
|
"""
|
|
1198
1712
|
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
1199
1713
|
|
|
1200
|
-
@property
|
|
1714
|
+
@_builtins.property
|
|
1715
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
1716
|
+
def delegated_auth_accessors(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1717
|
+
"""
|
|
1718
|
+
List of headers to allow and pass from the request to the plugin
|
|
1719
|
+
"""
|
|
1720
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
1721
|
+
|
|
1722
|
+
@_builtins.property
|
|
1201
1723
|
@pulumi.getter
|
|
1202
|
-
def description(self) -> pulumi.Output[Optional[
|
|
1724
|
+
def description(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1203
1725
|
"""
|
|
1204
|
-
|
|
1726
|
+
Human-friendly description of the mount for the backend.
|
|
1205
1727
|
"""
|
|
1206
1728
|
return pulumi.get(self, "description")
|
|
1207
1729
|
|
|
1208
|
-
@property
|
|
1730
|
+
@_builtins.property
|
|
1209
1731
|
@pulumi.getter(name="disableAutomatedRotation")
|
|
1210
|
-
def disable_automated_rotation(self) -> pulumi.Output[Optional[
|
|
1732
|
+
def disable_automated_rotation(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1211
1733
|
"""
|
|
1212
1734
|
Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
|
|
1213
1735
|
"""
|
|
1214
1736
|
return pulumi.get(self, "disable_automated_rotation")
|
|
1215
1737
|
|
|
1216
|
-
@property
|
|
1738
|
+
@_builtins.property
|
|
1217
1739
|
@pulumi.getter(name="disableRemount")
|
|
1218
|
-
def disable_remount(self) -> pulumi.Output[Optional[
|
|
1740
|
+
def disable_remount(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1219
1741
|
"""
|
|
1220
1742
|
If set, opts out of mount migration on path updates.
|
|
1221
1743
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
1222
1744
|
"""
|
|
1223
1745
|
return pulumi.get(self, "disable_remount")
|
|
1224
1746
|
|
|
1225
|
-
@property
|
|
1747
|
+
@_builtins.property
|
|
1748
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
1749
|
+
def external_entropy_access(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1750
|
+
"""
|
|
1751
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
1752
|
+
"""
|
|
1753
|
+
return pulumi.get(self, "external_entropy_access")
|
|
1754
|
+
|
|
1755
|
+
@_builtins.property
|
|
1756
|
+
@pulumi.getter(name="forceNoCache")
|
|
1757
|
+
def force_no_cache(self) -> pulumi.Output[_builtins.bool]:
|
|
1758
|
+
"""
|
|
1759
|
+
If set to true, disables caching.
|
|
1760
|
+
"""
|
|
1761
|
+
return pulumi.get(self, "force_no_cache")
|
|
1762
|
+
|
|
1763
|
+
@_builtins.property
|
|
1226
1764
|
@pulumi.getter(name="iamEndpoint")
|
|
1227
|
-
def iam_endpoint(self) -> pulumi.Output[Optional[
|
|
1765
|
+
def iam_endpoint(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1228
1766
|
"""
|
|
1229
1767
|
Specifies a custom HTTP IAM endpoint to use.
|
|
1230
1768
|
"""
|
|
1231
1769
|
return pulumi.get(self, "iam_endpoint")
|
|
1232
1770
|
|
|
1233
|
-
@property
|
|
1771
|
+
@_builtins.property
|
|
1234
1772
|
@pulumi.getter(name="identityTokenAudience")
|
|
1235
|
-
def identity_token_audience(self) -> pulumi.Output[Optional[
|
|
1773
|
+
def identity_token_audience(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1236
1774
|
"""
|
|
1237
1775
|
The audience claim value. Requires Vault 1.16+.
|
|
1238
1776
|
"""
|
|
1239
1777
|
return pulumi.get(self, "identity_token_audience")
|
|
1240
1778
|
|
|
1241
|
-
@property
|
|
1779
|
+
@_builtins.property
|
|
1242
1780
|
@pulumi.getter(name="identityTokenKey")
|
|
1243
|
-
def identity_token_key(self) -> pulumi.Output[Optional[
|
|
1781
|
+
def identity_token_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1244
1782
|
"""
|
|
1245
|
-
The key to use for signing identity tokens.
|
|
1783
|
+
The key to use for signing identity tokens.
|
|
1246
1784
|
"""
|
|
1247
1785
|
return pulumi.get(self, "identity_token_key")
|
|
1248
1786
|
|
|
1249
|
-
@property
|
|
1787
|
+
@_builtins.property
|
|
1250
1788
|
@pulumi.getter(name="identityTokenTtl")
|
|
1251
|
-
def identity_token_ttl(self) -> pulumi.Output[
|
|
1789
|
+
def identity_token_ttl(self) -> pulumi.Output[_builtins.int]:
|
|
1252
1790
|
"""
|
|
1253
1791
|
The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
|
|
1254
1792
|
"""
|
|
1255
1793
|
return pulumi.get(self, "identity_token_ttl")
|
|
1256
1794
|
|
|
1257
|
-
@property
|
|
1795
|
+
@_builtins.property
|
|
1796
|
+
@pulumi.getter(name="listingVisibility")
|
|
1797
|
+
def listing_visibility(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1798
|
+
"""
|
|
1799
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1800
|
+
"""
|
|
1801
|
+
return pulumi.get(self, "listing_visibility")
|
|
1802
|
+
|
|
1803
|
+
@_builtins.property
|
|
1258
1804
|
@pulumi.getter
|
|
1259
|
-
def local(self) -> pulumi.Output[Optional[
|
|
1805
|
+
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1260
1806
|
"""
|
|
1261
|
-
Specifies
|
|
1807
|
+
Specifies if the secret backend is local only
|
|
1262
1808
|
"""
|
|
1263
1809
|
return pulumi.get(self, "local")
|
|
1264
1810
|
|
|
1265
|
-
@property
|
|
1811
|
+
@_builtins.property
|
|
1266
1812
|
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
1267
|
-
def max_lease_ttl_seconds(self) -> pulumi.Output[
|
|
1813
|
+
def max_lease_ttl_seconds(self) -> pulumi.Output[_builtins.int]:
|
|
1268
1814
|
"""
|
|
1269
|
-
|
|
1270
|
-
for credentials issued by this backend.
|
|
1815
|
+
Maximum possible lease duration for secrets in seconds
|
|
1271
1816
|
"""
|
|
1272
1817
|
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
1273
1818
|
|
|
1274
|
-
@property
|
|
1819
|
+
@_builtins.property
|
|
1275
1820
|
@pulumi.getter
|
|
1276
|
-
def namespace(self) -> pulumi.Output[Optional[
|
|
1821
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1277
1822
|
"""
|
|
1278
1823
|
The namespace to provision the resource in.
|
|
1279
1824
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -1282,52 +1827,76 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1282
1827
|
"""
|
|
1283
1828
|
return pulumi.get(self, "namespace")
|
|
1284
1829
|
|
|
1285
|
-
@property
|
|
1830
|
+
@_builtins.property
|
|
1831
|
+
@pulumi.getter
|
|
1832
|
+
def options(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1833
|
+
"""
|
|
1834
|
+
Specifies mount type specific options that are passed to the backend
|
|
1835
|
+
"""
|
|
1836
|
+
return pulumi.get(self, "options")
|
|
1837
|
+
|
|
1838
|
+
@_builtins.property
|
|
1839
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
1840
|
+
def passthrough_request_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1841
|
+
"""
|
|
1842
|
+
List of headers to allow and pass from the request to the plugin
|
|
1843
|
+
"""
|
|
1844
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
1845
|
+
|
|
1846
|
+
@_builtins.property
|
|
1286
1847
|
@pulumi.getter
|
|
1287
|
-
def path(self) -> pulumi.Output[Optional[
|
|
1848
|
+
def path(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1288
1849
|
"""
|
|
1289
1850
|
The unique path this backend should be mounted at. Must
|
|
1290
1851
|
not begin or end with a `/`. Defaults to `aws`.
|
|
1291
1852
|
"""
|
|
1292
1853
|
return pulumi.get(self, "path")
|
|
1293
1854
|
|
|
1294
|
-
@property
|
|
1855
|
+
@_builtins.property
|
|
1856
|
+
@pulumi.getter(name="pluginVersion")
|
|
1857
|
+
def plugin_version(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1858
|
+
"""
|
|
1859
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1860
|
+
"""
|
|
1861
|
+
return pulumi.get(self, "plugin_version")
|
|
1862
|
+
|
|
1863
|
+
@_builtins.property
|
|
1295
1864
|
@pulumi.getter
|
|
1296
|
-
def region(self) -> pulumi.Output[
|
|
1865
|
+
def region(self) -> pulumi.Output[_builtins.str]:
|
|
1297
1866
|
"""
|
|
1298
1867
|
The AWS region to make API calls against. Defaults to us-east-1.
|
|
1299
1868
|
"""
|
|
1300
1869
|
return pulumi.get(self, "region")
|
|
1301
1870
|
|
|
1302
|
-
@property
|
|
1871
|
+
@_builtins.property
|
|
1303
1872
|
@pulumi.getter(name="roleArn")
|
|
1304
|
-
def role_arn(self) -> pulumi.Output[Optional[
|
|
1873
|
+
def role_arn(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1305
1874
|
"""
|
|
1306
1875
|
Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
|
|
1307
1876
|
"""
|
|
1308
1877
|
return pulumi.get(self, "role_arn")
|
|
1309
1878
|
|
|
1310
|
-
@property
|
|
1879
|
+
@_builtins.property
|
|
1311
1880
|
@pulumi.getter(name="rotationPeriod")
|
|
1312
|
-
def rotation_period(self) -> pulumi.Output[Optional[
|
|
1881
|
+
def rotation_period(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1313
1882
|
"""
|
|
1314
1883
|
The amount of time in seconds Vault should wait before rotating the root credential.
|
|
1315
1884
|
A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
|
|
1316
1885
|
"""
|
|
1317
1886
|
return pulumi.get(self, "rotation_period")
|
|
1318
1887
|
|
|
1319
|
-
@property
|
|
1888
|
+
@_builtins.property
|
|
1320
1889
|
@pulumi.getter(name="rotationSchedule")
|
|
1321
|
-
def rotation_schedule(self) -> pulumi.Output[Optional[
|
|
1890
|
+
def rotation_schedule(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1322
1891
|
"""
|
|
1323
1892
|
The schedule, in [cron-style time format](https://en.wikipedia.org/wiki/Cron),
|
|
1324
1893
|
defining the schedule on which Vault should rotate the root token. Requires Vault Enterprise 1.19+.
|
|
1325
1894
|
"""
|
|
1326
1895
|
return pulumi.get(self, "rotation_schedule")
|
|
1327
1896
|
|
|
1328
|
-
@property
|
|
1897
|
+
@_builtins.property
|
|
1329
1898
|
@pulumi.getter(name="rotationWindow")
|
|
1330
|
-
def rotation_window(self) -> pulumi.Output[Optional[
|
|
1899
|
+
def rotation_window(self) -> pulumi.Output[Optional[_builtins.int]]:
|
|
1331
1900
|
"""
|
|
1332
1901
|
The maximum amount of time in seconds allowed to complete
|
|
1333
1902
|
a rotation when a scheduled token rotation occurs. The default rotation window is
|
|
@@ -1335,49 +1904,57 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
1335
1904
|
"""
|
|
1336
1905
|
return pulumi.get(self, "rotation_window")
|
|
1337
1906
|
|
|
1338
|
-
@property
|
|
1907
|
+
@_builtins.property
|
|
1908
|
+
@pulumi.getter(name="sealWrap")
|
|
1909
|
+
def seal_wrap(self) -> pulumi.Output[_builtins.bool]:
|
|
1910
|
+
"""
|
|
1911
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1912
|
+
"""
|
|
1913
|
+
return pulumi.get(self, "seal_wrap")
|
|
1914
|
+
|
|
1915
|
+
@_builtins.property
|
|
1339
1916
|
@pulumi.getter(name="secretKey")
|
|
1340
|
-
def secret_key(self) -> pulumi.Output[Optional[
|
|
1917
|
+
def secret_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1341
1918
|
"""
|
|
1342
1919
|
The AWS Secret Access Key to use when generating new credentials.
|
|
1343
1920
|
"""
|
|
1344
1921
|
return pulumi.get(self, "secret_key")
|
|
1345
1922
|
|
|
1346
|
-
@property
|
|
1923
|
+
@_builtins.property
|
|
1347
1924
|
@pulumi.getter(name="stsEndpoint")
|
|
1348
|
-
def sts_endpoint(self) -> pulumi.Output[Optional[
|
|
1925
|
+
def sts_endpoint(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1349
1926
|
"""
|
|
1350
1927
|
Specifies a custom HTTP STS endpoint to use.
|
|
1351
1928
|
"""
|
|
1352
1929
|
return pulumi.get(self, "sts_endpoint")
|
|
1353
1930
|
|
|
1354
|
-
@property
|
|
1931
|
+
@_builtins.property
|
|
1355
1932
|
@pulumi.getter(name="stsFallbackEndpoints")
|
|
1356
|
-
def sts_fallback_endpoints(self) -> pulumi.Output[Optional[Sequence[
|
|
1933
|
+
def sts_fallback_endpoints(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1357
1934
|
"""
|
|
1358
1935
|
Ordered list of `sts_endpoint`s to try if the defined one fails. Requires Vault 1.19+
|
|
1359
1936
|
"""
|
|
1360
1937
|
return pulumi.get(self, "sts_fallback_endpoints")
|
|
1361
1938
|
|
|
1362
|
-
@property
|
|
1939
|
+
@_builtins.property
|
|
1363
1940
|
@pulumi.getter(name="stsFallbackRegions")
|
|
1364
|
-
def sts_fallback_regions(self) -> pulumi.Output[Optional[Sequence[
|
|
1941
|
+
def sts_fallback_regions(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1365
1942
|
"""
|
|
1366
1943
|
Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
|
|
1367
1944
|
"""
|
|
1368
1945
|
return pulumi.get(self, "sts_fallback_regions")
|
|
1369
1946
|
|
|
1370
|
-
@property
|
|
1947
|
+
@_builtins.property
|
|
1371
1948
|
@pulumi.getter(name="stsRegion")
|
|
1372
|
-
def sts_region(self) -> pulumi.Output[Optional[
|
|
1949
|
+
def sts_region(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1373
1950
|
"""
|
|
1374
1951
|
Specifies the region of the STS endpoint. Should be included if `sts_endpoint` is supplied. Requires Vault 1.19+
|
|
1375
1952
|
"""
|
|
1376
1953
|
return pulumi.get(self, "sts_region")
|
|
1377
1954
|
|
|
1378
|
-
@property
|
|
1955
|
+
@_builtins.property
|
|
1379
1956
|
@pulumi.getter(name="usernameTemplate")
|
|
1380
|
-
def username_template(self) -> pulumi.Output[
|
|
1957
|
+
def username_template(self) -> pulumi.Output[_builtins.str]:
|
|
1381
1958
|
"""
|
|
1382
1959
|
Template describing how dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters) and STS usernames (capped at 32 characters). If no template is provided the field defaults to the template:
|
|
1383
1960
|
|